Itaú Unibanco S A : Itaú 2Q 21 Risk and capital management Pillar 3 Second quarter of 2021 (Form 6-K)

Itaú 2Q 21 Risk and capital management Pillar 3 Second quarter of 2021

Contents Objective Key indicators Prudential Metrics and Risk Management KM1: Key metrics at consolidated level OVA: Bank risk management approach Scope and main characteristics of risk management Risk and Capital Governance Risk Appetite Risk Culture Stress Testing Recovery Plan Capital Adequacy Assessment Capital Adequacy OV1: Overview of risk-weighted assets (RWA) Links between financial statements and regulatory exposures LIA: Explanations of differences between accounting and regulatory exposure amounts LI1: Differences between accounting and regulatory scopes of consolidation and mapping of financial statement categories with regulatory risk categories LI2: Main sources of differences between regulatory exposure amounts and carrying values in financial statements PV1: Prudent valuation adjustments (PVA) Institutions that comprise the Financial Statement of Itaú Unibanco Holding Non Consolidated Institutions Material Entities Composition of Capital CCA: Main features of regulatory capital instuments CC1: Composition of regulatory capital CC2: Reconciliation of regulatory capital to balance sheet Macroprudential Indicators CCyB1: Geographical distribution of credit risk exposures considered in the calculation of the Countercyclical Capital Buffer GSIB1: Disclosure of G-SIB indicators Leverage Ratio LR1: Summary comparison of accounting assets vs leverage ratio exposure measure (RA) LR2: Leverage ratio common disclosure Liquidity Ratios LIQA: Liquidity Risk Management Information Framework and Treatment LIQ1: Liquidity Coverage Ratio (LCR) LIQ2: Net Stable Funding Ratio (NSFR) Credit Risk CRA: Qualitative information on credit risk management CR1: Credit Quality of Assets CR2: Changes in Stock of defaulted loans and debts securities CRB: Additional disclosure related to the credit quality of assets Credit risk mitigation Exposure by industry Exposure by remaining maturity Overdue exposures Exposure by geographical area in Brazil and by country Largest debtors exposures Restructured exposures

CRC: Qualitative disclosure related to Credit Risk Mitigation techniques CR3: Credit Risk mitigation techniques - overview CR4: Standardized Approach - Credit Risk exposure and credit risk mitigation effects CR5: Standardized Approach - exposures by asset classes and risk weights Counterparty Credit Risk (CCR) CCRA: Qualitative disclosure related to CCR CCR1: Analysis of CCR exposures by approach CCR3: Standardized approach - CCR exposures by regulatory portfolio and risk weights CCR5: Composition of collateral for CCR exposures CCR6: CCR associated with credit derivatives exposures CCR8: CCR associated with Exposures to central counterparties Securitization Exposures SECA: Qualitative disclosure requirements related to securitisation exposures SEC1: Securitisation exposures in the banking book SEC2: Securitisation exposures in the trading book SEC3: Securitisation exposures in the banking book and associated regulatory capital requirements - bank acting as originator or as sponsor SEC4: Securitisation exposures in the banking book and associated capital requirements - bank acting as investor Market Risk MRA: Qualitative disclosure requirements related to market risk MR1: Market risk under standardized approach MRB: Qualitative disclosures on market risk in the Internal Models Approach (IMA) MR2: RWA flow statements of market risk exposures under an IMA Exposures subject to market risk MR3: IMA values for trading portfolios MR4: Comparison of VaR estimates with gains/losses Backtesting Total Exposure associated with Derivatives IRRBB IRRBBA: IRRBB risk management objectives and policies Framework and Treatment IRRBB1 - Quantitative information on IRRBB Other Risks Insurance products, pension plans and premium bonds risks Social and Environmental Risk Model Risk Regulatory or Compliance Risk Reputational Risk Country Risk Business and Strategy Risk Contagion Risk Operational Risk Crisis Management and Business Continuity Independent Validation of Risk Models Glossary of Acronyms Glossary of Regulations

Risk and Capital Management - Pillar 3 Objective This document presents Itaú Unibanco Holding S.A. (Itaú Unibanco) information required by the Central Bank of Brazil (BACEN) through Resolution BCB nº 54 and subsequent amendments, which addresses the disclosure of information on risks and capital management, the comparison between accounting and prudential information, the liquidity and market risk indicators, the calculation of risk-weighted assets (RWA), the calculation of the Total Capital ('Patrimônio de Referência'-PR), and the compensation of management members.1 The referred Resolution brought several amendments in the disclosure format of the Pillar 3 information, besides changes in the scope and frequency of the information disclosed. All these amendments, implemented by the Central Bank, aim the convergence of the Brazilian financial regulation to the recommendations of the Basel Committee, seeking to harmonize the information disclosed by financial institutions at an international level, and taking into account the structural conditions of the Brazilian economy. The disclosure policy of the Risk and Capital Management Report presents the guidelines and responsibilities of the areas involved in its preparation, as well as the description of the information that must be disclosed and the integrity endorsement and approval governance, as established by the article 56 of the Resolution nº. 4,557. Key indicators Itaú Unibanco's risk and capital management focuses on maintaining the institution in line with the risk strategy approved by the Board of Directors. The key indicators based on the Prudential Consolidation, on June 30, 2021, are summarized below. Common Equity Tier I Ratio 11.9% March 31, 2012 Tier I Ratio 13.5% Mar 31, 2021 230 Total Capital Ratio 14.9% Mach 31,2021 24.9 Tier! ES Common Equity Tier R$ 124,964 March 31, 2021 A2103 R$ 141,674 March 31, 2021 224 Total Capital Son R$ 156,561 March 31, 2021 AS 155.900 RWA R$ 1,048,628 March 31, 2021 $ 1.072.193 0,0% 0,4% 0,2% -0,7% 13,0% 17% 13,5% 1,6% 11,3% 11,9% The Mar 21 Partial Spin-off of Netheque Prudential Adjustments Additional Capital There In 21 Convite ICETO 1Compensation of management members data is reported annually. Itaú Unibanco

Risk and Capital Management - Pillar 3 Prudential Metrics and Risk Management Itaú Unibanco invests in robust and company-wide risk management processes to serve as a basis for its strategic decisions intended to ensure business sustainability. The key prudential metrics related to regulatory capital and information on the bank's integrated risk management are presented below. KM1: Key metrics at consolidated level In order to ensure the soundness of Itaú Unibanco and the availability of capital to support business growth, Itaú Unibanco maintains capital levels above the minimum requirements, as demonstrated by the Common Equity Tier I, Additional Tier I Capital and Total CapitaI ratios. On June 30, 2021, the Total Capital (PR) reached R$ 156,561 million, R$ 141,674 million of Tier I and R$ 14,887 million of Tier II. R$ million Available capital amounts) Common Equity Tier 1 (CET) Tier 1 Total capital Excess of capital committed to adjusted permanent Total capital detached Risk-weighted assets (amounts) Total risk-weighted Assets (RWA) Risk-based capital ratios as a percentage of RWA Common Equity Tier 1 ratio (8) Tier 1 ratio) Total capital ratio) Additional CET1 buffer requirements as a percentage of RWA Cap al conservation buffer requirement (y Counter call buffer requirement () Bank G-sis and/or D-81B additional requirements (*) Total of bank CET1 specific buffer requirements () CET1 valuable after meeting the bank's minimum capital requirements (9) Basel leverage ratio Total Basel Il leverage ratio exposure measure Basel III leverage ratio 196) Liquidity Coverage Ratio Total high quality liquid assets (HOLA) Total net cash outflow LCR (9) Net Stable Funding Ratio Total available table funding Total required table funding NSFR (9) 06/30/2021 03/31/2021 12/31/2020 09/30/2020 06/30/2020 124,964 141,674 156,561 121,025 139,552 155,280 119,960 137.157 151,244 113,910 132,272 146,894 108,119 126,214 140,650 1,048,628 1,072,193 1,042,207 1,068,739 1,040,622 11.9% 13.5% 14.9% 11.3% 13.0% 14.5% 11.5% 13.2% 14.5% 10.7% 12.4% 13.7% 10.4% 12.1% 13.5% 1.625% 1.25% 1.25% 1.25% 1.25% 1.0% 2.625% 4.2% 1.0% 2.25% 4.1% 1.0% 2.25% 4.1% 1.0% 2.25% 3.3% 1.0% 2.25% 3.1% 1,883,388 7.5% 1,918,231 7.3% 1,903,298 72% 1,914,229 6.9% 1,853,479 6.8% 324,440 179,322 180.9% 356,222 186,513 191.0% 343,174 176,355 194.6% 328,202 168,331 195.0% 283,267 158,126 179.1% 949,811 774,165 122.7% 990,197 792,199 125.0% 956,033 758,907 126.0% 932,718 754,386 123.6% 892,597 728,795 122.5% 1) For purposes of calculating the Conservation capital buffer. BACEN Resolution 4,783 establishes for defined periods percentages to be applied to the RWA value with a gradual increase until Apr 122, when it reaches 2.5% 2) The countercyclical capital buffer is fixed by the Financial Stability Committee (Comely based on discussions about the pace of credit expansion (BACEN Communication No 37,219/21), and currently is set to zero. Should the requirement increase the new percentage takes effect twelve months after the announcement 3) The BACEN rules establish Capital Buffers that corresponds to the sum of the Conservation, Contracyclical and Systemic requirements, as defined in CMN Resolution 4,193 Itaú Unibanco

Risk and Capital Management - Pillar 3 The Basel Ratio reached 14.9% on June 30, 2021, an increase of 0.4 pp when compared to March 31, 2021, mainly due to the result for the period. Besides, Itaú Unibanco has a R$ 72,671 million capital surplus in relation to its minimum required Total Capital. It corresponds to 6.9 p.p. above the minimum requirement (8%) and higher than the Capital Buffer requirement of 2.625% (R$ 27,526 million). Considering the Capital Buffers, the capital surplus would be 4.275 p.p. The fixed assets ratio shows the commitment percentage of the adjusted Referential Equity with the adjusted permanent assets. Itaú Unibanco falls within the maximum limit of 50% of adjusted PR, established by BACEN. At June 30, 2021, the fixed assets ratio reached 18.0%, showing a surplus of R$ 50,177 million. OVA - Bank risk management approach Scope and main characteristics of risk management To undertake and manage risks is one of the activities of Itaú Unibanco. For this reason, the institution must have clearly established risk management objectives. In this context, the risk appetite defines the nature and the level of risks acceptable for the institution, while the risk culture guides the attitudes required to manage them. Itaú Unibanco invests in robust risk management processes, that are the basis for its strategic decisions to ensure business sustainability and maximize shareholder value creation. These processes are in line with the guidelines of the Board of Directors and Executives who, through corporate bodies, define the institution's global objectives, which are then translated into targets and thresholds for the business units that manage risks. Control and capital management units, in turn, support Itaú Unibanco's management through the processes of analysis and monitoring of capital and risk. The principles that provide the risk management and the risk appetite foundations, as well as guidelines regarding the actions taken by Itaú Unibanco's employees in their daily routines are as follows: Sustainability and customer satisfaction: the vision of Itaú Unibanco is to be a leading bank in sustainable performance and customer satisfaction. For this reason, the institution is concerned about creating shared values for employees, customers, shareholders and society to ensure the longevity of the business. Itaú Unibanco is concerned about doing business that is good for customers and for the institution; Risk culture: the institution's risk culture goes beyond policies, procedures and processes. It strengths the individual and collective responsibility of all employees to manage and mitigate risks consciously, respecting the ethic way of doing business. The risk culture is described in the item 'Risk Culture'; Risk Pricing: Itaú Unibanco operates and assumes risks in business that it knows and understands, avoids the ones that are unknown or that do not provide competitive advantages, and carefully assesses risk-return ratios; Diversification: the institution has low appetite for volatility in its results. Accordingly, it operates with a diversified base of customers, products and business, seeking risk diversification and giving priority to low-risk transactions; Operational excellence: Itaú Unibanco intends to provide agility, as well as a robust and stable infrastructure, in order to offer high quality services; Itaú Unibanco

Risk and Capital Management - Pillar 3 Ethics and respect for regulations: at Itaú Unibanco, ethics is non-negotiable. For this reason, the institution promotes an institutional environment of integrity, educating its employees to cultivate ethical relationships and businesses, as well as respecting the norms, and therefore looking after the institution's reputation. Since August, 2017, the Resolution CMN 4,557 came into force, which established the structure of risk and capital management. The resolution highlights are the implementation of a continuous and integrated risk management framework; the requirements for the definition of the Risk Appetite Statement (RAS) and the stress test program; the establishment of a Risk Committee; the indication, before BACEN, of the Chief Risk Officer (CRO); and the CRO's roles, responsibilities and independence requirements. Risk and Capital Governance The Board of Directors is the main body responsible for establishing the guidelines, policies and authority levels regarding risk and capital management. In turn, the Risk and Capital Management Committee (CGRC) provides support to the Board of Directors in the performance of their duties relating to risk and capital management. At the executive level, corporate bodies headed by Itaú Unibanco's Chief Executive Officer (CEO) are established to manage risks and capital. Their decisions are overseen by the CGRC. Additionally, the Itaú Unibanco Holding has corporate bodies that perform delegated duties in the risk and capital management, under the responsibility of CRO (Chief Risk Officer). To support this structure, the Risk Area is structured with specialized departments. The objective is to provide independent and centralized management of the institution's risks and capital, and to ensure the accordance with the established rules and procedures. Itaú Unibanco's risk management organizational structure complies with Brazilian and international regulations in place and is aligned with the market's best practices, including governance for identifying emerging risks, which are those with medium and long-term impact potentially material about the business. Responsibilities for risk management at Itaú Unibanco are structured according to the concept of three lines of defense, namely: in the first line of defense, the business and corporate support areas manage risks they give rise to, by identifying, assessing, controlling and reporting such risks; in the second line of defense, an independent unit provides central control, so as to ensure that Itaú Unibanco's risk is managed according to the risk appetite and established policies and procedures. This centralized control provides the Board and executives with a global overview of Itaú Unibanco's exposure, to ensure correct and timely corporate decisions; in the third line of defense, internal audit provides an independent assessment of the institution's activities, so that senior management can see that controls are adequate, risk management is effective and institutional standards and regulatory requirements are being complied with. Itaú Unibanco uses robust automated systems for full compliance with capital regulations, as well as for measuring risks in accordance with the regulatory determinations and models in place. It also monitors adherence to the qualitative and quantitative regulators' minimum capital and risk management requirements. Itaú Unibanco

Risk and Capital Management - Pillar 3 Risk Appetite Itaú Unibanco has a risk appetite policy, which was established and approved by the Board of Directors and guides the institution's business strategy. The bank's risk appetite is grounded on the following declaration of the Board of Directors: 'We are a universal bank, operating predominantly in Latin America. Supported by our risk culture, we operate based on rigorous ethical and regulatory compliance standards, seeking high and growing results, with low volatility, by means of the long-lasting relationship with clients, correctly pricing risks, well-distributed fund-raising and proper use of capital.' Based on this declaration, the bank established five dimensions, each of which comprising a set of metrics associated with the key risks involved, combining complementary measurements and seeking a comprehensive view of its exposure: Capitalization: establishes that Itaú Unibanco should have sufficient capital to protect itself against a serious recession or stress events without the need to adjust its capital structure under adverse circumstances. It is monitored by following up the bank's capital ratios, in usual or stress situations, and the institution's debt issue ratings. Liquidity: establishes that the institution's liquidity should be able to support long stress periods. It is monitored by following up on liquidity ratios. Composition of results: establishes that business will mainly focus on Latin America, where Itaú Unibanco will have a diversified range of customers and products, with low appetite for results volatility and high risk. This dimension includes business and profitability, as well as market and credit risks aspects. The metrics monitored by the bank seek to ensure, by means of exposure concentration limits such as, for example, industry sectors, quality of counterparties, countries and geographic regions and risk factors, a suitable composition of the bank's portfolios, aiming at low volatility of results and business sustainability. Operational risk: focuses on controlling operational risk events that may adversely impact the bank's business strategy and operations. This control is carried out by monitoring key operational risk events and incurred losses. Reputation: deals with risks that may impact brand value and the institution's reputation before its customers, employees, regulators, investors and the general public. In this dimension, risks are monitored by following up on customers' satisfaction or dissatisfaction, media exposure and observation of the institution's conduct. The Board of Directors is responsible for approving risk appetite guidelines and limits, performing its activities with the support of the Risk and Capital Management Committee (CGRC) and the Chief Risk Officer (CRO). Metrics are regularly monitored and must comply with the limits defined. The monitoring is reported to the risk commissions and to the Board of Directors, guiding the use of preventive measures to ensure that exposures are within the limits provided and in line with the bank's strategy. Risk Culture Aiming at strengthening its values and aligning the behavior of its employees with risk management guidelines, the institution adopts several initiatives to disseminate and strengthen its Risk Culture, which is based on four principles: conscious risk taking, discussions and actions on the institution's risks, and each and everyone's responsibility for risk management. Itaú Unibanco 5

Risk and Capital Management - Pillar 3 Chart 1-Risk Culture Besides the risk management policies, procedures and processes, the institution promotes its Risk Culture by emphasizing a behavior that helps people of all company levels to undertake and manage risks in a conscious way. By disseminating these principles, the institution fosters the understanding and the open discussion about risks, so that they are kept within the risk appetite levels established and each employee individually, regardless of their position, area or duties, may also assume responsibility for managing the risks of the business. Itaú Unibanco also makes some channels available for communication of operating failures, internal or external fraud, conflicts at the workplace, or cases that may result in inconveniences and/or losses for the institution or its customers. All employees or third parties are responsible for informing any problems immediately, as soon as they become aware of the situation. Stress Testing The stress test is a process of simulating extreme economic and market conditions on Itaú Unibanco's results, liquidity and capital. The institution has been carrying out this test in order to assess its solvency in plausible scenarios of crisis, as well as to identify areas that are more susceptible to the impact of stress that may be the subject of risk mitigation. For the purposes of the test, the economic research area estimates macroeconomic variables for each stress scenario. The elaboration of stress scenarios considers the qualitative analysis of the Brazilian and the global conjuncture, historical and hypothetical elements, short and long term risks, among other aspects, as defined in CMN Resolution 4,557. In this process, the main potential risks to the economy are assessed based on the judgment of the bank's team of economists, endorsed by the Chief Economist of Itaú Unibanco and approved by the Board of Directors. Projections for the macroeconomic variables (such as GDP, the basic interest rate and inflation) and for variables in the credit market (such as raisings, lending, rates of default, margins and charges) used are based on exogenous shocks or through use of models validated by an independent area. Then, the stress scenarios adopted are used to influence the budgeted result and balance sheet. In addition to the scenario analysis methodology, sensitivity analysis and the Reverse Stress Test are also used. Itaú Unibanco 6

Risk and Capital Management - Pillar 3 Itaú Unibanco uses the simulations to manage its portfolio risks, considering Brazil (segregated into wholesale and retail) and External Units, from which the risk-weighted assets and the capital and liquidity ratios are derived. The stress test is also an integral part of the ICAAP (Internal Capital Adequacy Process), the main purpose of which is to assess whether, even in severely adverse situations, the institution would have adequate levels of capital and liquidity, without any impact on the development of its activities. This information enables potential offenders to the business to be identified and provides support for the strategic decisions of the Board of Directors, the budgeting and risk management process, as well as serving as an input for the institution's risk appetite metrics. Recovery Plan In response to the latest international crises, the Central Bank issued the Resolution No. 4,502, which requires the development of a Recovery Plan for the financial institutions that are classified in the Segment 1, with a total exposure of more than 10% of Gross Domestic Product (GDP). This plan aims to reestablish adequate levels of capital and liquidity, above the regulatory requirements, through appropriate strategies in the event of severe stress shocks of a systemic or idiosyncratic nature. Accordingly, each institution would be able to preserve its financial feasibility and, at the same time, mitigate the impact on the National Financial System. Itaú Unibanco has a Recovery Plan that contemplates the entire conglomerate, including foreign subsidiaries, and contains the description of the following items: I. Critical functions rendered by Itaú Unibanco to the market, activities that, if abruptly interrupted, could impact the National Financial System (SFN) and the functioning of the real economy; II. Institution's essential services: activities, operations or services which discontinuity could compromise the bank's viability; III. Monthly monitoring program, establishing critical levels for a set of indicators, with a view to risk monitoring and eventual trigger for the execution of the Recovery Plan; IV. Stress scenarios, contemplating events that may threaten the business continuity and the viability of the institution, including reverse tests, which seek to identify remote risk scenarios, contributing to an increase of the management sensitivity; V. Recovery strategies in response to different stress scenarios, including the main risks and barriers, as well as the mitigators of the latter and the procedures for the operationalization of each strategy; VI. Communication plan with stakeholders, seeking its timely execution with the market, regulators and other stakeholders; VII. Governance mechanisms necessary for the coordination and execution of the Recovery Plan, such as the definition of the director responsible for the exercise at Itaú Unibanco. This plan is reviewed annually and is subjected to the approval of the Board of Directors. With this practice, Itaú Unibanco has been able to continuously demonstrate, that even in severe scenarios, with remote probability of occurrence, it has strategies capable of generating sufficient resources to ensure the sustainable maintenance of critical activities and essential services, without losses to customers, to the financial system and to other participants in the markets in which it operates. Itaú Unibanco 7

Risk and Capital Management - Pillar 3 Itaú Unibanco ensures the exercise maintenance to guarantee that strategies remain up-to-date and viable in the face of organizational, competitive or systemic changes. Capital Adequacy Assessment For its capital adequacy assessment process, the annual Itaú Unibanco's procedure is as follows: Identification of material risks and assessment of the need for additional capital; Preparation of the capital plan, both in normality and stress situations; Internal assessment of capital adequacy; Structuring of capital contingency and recovery plans; Preparation of management and regulatory reports. By adopting a prospective stance regarding capital management, Itaú Unibanco implemented its capital management structure and its ICAAP in order to comply with National Monetary Council (CMN) Resolution 4,557, BACEN Circular 3,846 and BACEN Circular Letter 3,907. The result of the last ICAAP, which includes stress tests - dated as of December 2020 - showed that, in addition to having enough capital to face all material risks, Itaú Unibanco has a significant buffer, thus ensuring the soundness of its equity position. Capital Adequacy Itaú Unibanco, through the ICAAP process, assesses the adequacy of its capital to face the incurred risks, composed by regulatory capital for credit, market and operational risks and by the necessary capital to face other risks. In order to ensure the soundness and the availability of Itaú Unibanco's capital to support business growth, the Total Capital levels were maintained above the minimum requirements. Itaú Unibanco 8

Risk and Capital Management - Pillar 3 OV1 - Overview of risk-weighted assets (RWA) According to CMN Resolution 4,193 and subsequent amendments, for assessing the minimum capital requirements, the RWA must be calculated by adding the following risk exposures: RWA = RWACPAD + RWAMINT + RWAOPAD RWACPAD = portion related to exposures to credit risk, calculated using standardized approach; RWAMINT = portion related to the market risk capital requirement, made up of the maximum between the internal model and 80% of the standardized model, and regulated by BACEN Circulars 3,646 and 3,674; RWAOPAD = portion related to the operational risk capital requirement, calculated using standardized approach. RS milion Credit Risk: standardised approach Crederik excluding counterparty credit risk) Counterparty credit risk (CCR) Of which: standardised approach for counterpany credit risk (SA-CCR) Of which: Current Exposure Method approach (CEM) Of which: other CCR Credit valuation adjustment (CVA) Equity investments in funds - look-through approach Equity investments in funds - mandate-based approach Equity investments in funds - tall-back approach Securitisation exposures - standardised approach Amounts below the thresholds for deduction Market risk Of which: standardised approach Of which: internal models approach (IMA) Operational risk Total RWA 06/30/2021 941,021 817,765 43,576 27,400 - 16,176 7,222 6,223 63 794 1,352 64,026 25,581 31,976 22,864 82,026 1,048,628 03/31/2021 963,403 820,024 45,217 27,544 - 17,673 6,960 ,6,950 - 1,265 1,174 81,813 26,764 33,455 25,227 82,026 1,072,193 Minimum capital requirements 06/30/2021 75,282 65.421 3.486 2,192 - 1,294 578 498 5 64 108 5,122 2,046 2,558 1,829 6,562 83,890 The R$23,565 million reduction in Risk Weighted Assets (RWA) was due to the reduction in the Credit Risk portion (RWACPAD) mainly due to the appreciation of the Real and the reduction in tax credits. Itaú Unibanco

Risk and Capital Management - Pillar 3 Links between financial statements and regulatory exposures LIA: Explanations of differences between accounting and regulatory exposure amounts The main difference between the accounting carrying value and the amounts considered for regulatory purposes is the non-consolidation of non-financial companies (especially Insurance, Pension Plan and Capitalization companies) in the regulatory consolidated, a difference that also impacts the elimination of related parties transactions. Within the regulatory scope, the procedures for assessing the need for prudent valuation adjustments (PVAs) arising from the pricing of financial instruments, as well as the description of the systems and controls used to ensure its reliability are described below. The pricing methodology for the financial instruments subject to Resolution No. 4,277, of October 31st, 2013, conducted by an independent area from the business areas, considers, in addition to benchmarks, the risks listed in the closeout uncertainty, market concentration, early termination, model risk, investing and funding costs, unearned credit spread and others. The fair value measurement at Itaú Unibanco follows the principles enclosed in the main regulatory bodies, such as CVM and BACEN. The institution follows the best practices in terms of pricing policies, procedures and methodologies and is committed to secure the pricing of financial instruments in its balance sheet with prices quoted and disclosed by the market, and in the impossibility of doing so, expends its best efforts to estimate which would be the fair price at which financial assets would be effectively traded, maximizing the use of relevant observable data and, under specific conditions, these instruments can be valued on a model basis. In all of these situations, the organization has control over its pricing methods and model risk management. The process of independent price verification (IPV) follows the guidelines included in Resolution No. 4,277, with daily verification of prices and market inputs, which is performed by a team independent from the pricing team. This process is also subject to an independent evaluation by the internal control, internal audit and external audit teams. The institution has a hybrid model for assessing the need for prudent valuation adjustments with two components. The first component is a timely assessment model that assesses new products, operations and risk factors traded and verifies the compliance and liability with any components of the existing prudent valuation adjustments. The second is a periodic assessment that aims to analyze the existing prudent valuation adjustments in relation to adequate pricing. The process and methodology are evaluated periodically and independently by internal controls and internal audit. In the line Other Differences of the table LI2, are reported the transactions subject to credit risk and counterparty credit risk, which are not accounted for in the balance sheet or in the off-balance sheet amounts. Itaú Unibanco 10

Risk and Capital Management - Pillar 3 LI1: Differences between accounting and regulatory scopes of consolidation and mapping of financial statement categories with regulatory risk categories 06/30/2021 Carrying values of items: Carrying values as reported in published financial statements Carrying values under scope of regulatory consolidation Subject to credit risk framework Subject to counterparty credit risk framework Subject to the securitisation framework Subject to the market risk framework Not subject to capital requirements or subject to deduction from capital R$ million, at the end of the period Assets Current assets and Long-term receivables Cash Interbank investments Securities and derivative financial instruments Interbank accounts lnterbranch accounts Loan, lease and other credit operations Other receivables Deferred tax assets Sundry Other assets Permanent assets Investments Real estate Goodwill and Intangible assets Goodwill Intangible assets Other Total assets Liabilities Current and Long-term Liabilities Deposits Deposits received under securities repurchase agreements Funds from acceptances and issuance of securities Interbank accounts lnterbranch accounts Borrowings and onlending Derivative financial instruments Technical provision for insurance, pension plan and capitalization Provisions Allowance for financial guarantees provided Other liabilities Deferred tax liabilities Sundry Deferred income Total liabilities 2,039,237 1,807,186 1,437,169 318,236 10,103 238,862 37,831 39,837 39,749 39,749 10,499 218,463 215,220 56,180 159,040 8,119 728,483 504,408 418,601 66,889 10,103 62,074 4,968 152,134 152,134 135,087 17,047 262 262 262 676,749 677,592 670,331 51 ,561 7,261 220,196 214,791 114,191 92,307 106,609 8,293 58,763 50,619 8,144 156,028 63,572 92,307 106,609 149 3,113 3,030 3,030 26,507 43,498 28,205 15,293 6,829 25,049 22,340 2,709 6,253 5,764 5,764 13,425 12,685 101 12,584 3,176 3,176 9,408 9,408 101 101 2,065,744 1,850,684 1,465,374 318,236 10,103 238,862 53,124 1,915,895 1,700,804 266,661 193,463 1,434,143 793,501 796,672 41,550 796,672 250,190 250,248 231,076 3,836 19,172 127,625 127,625 13,337 127,625 63,788 63,788 63,788 10,463 10,466 266 10,466 85,777 85,777 7,612 85,777 65,701 65,713 35,585 1,127 30,128 221,664 17,160 16,737 16,737 742 742 742 279,284 283,036 125,735 283,036 2,660 2,660 280,376 125,735 280,376 3,207 3,249 3,249 1,919,102 1,704,053 266,661 193,463 1,437,392 Itaú Unibanco

Risk and Capital Management - Pillar 3 LI2: Main sources of differences between regulatory exposure amounts and carrying values in financial statements R$ million 06/30/2021 Carrying values of items: Total Subject to credit risk framework Subject to counterparty credit risk framework Subject to the Subject to the securitisation market risk framework framework 1,465,374 10,103 1,797,560 266,661 1,530,899 165,124 Asset carrying value amount under scope of regulatory consolidation Liabilities carrying value amount under regulatory scope of consolidation Total net amount under regulatory scope of consolidation Off-balance sheet amounts Differences in valuations Other differences Exposure amounts considered for regulatory purposes 318,236 266,661 51,575 30,586 238,862 193,463 45,399 10,103 1,465,374 134,538 86,806 1,782,829 (10,795) 1,589,117 97,601 179,762 10,103 45,399 PV1: Prudent valuation adjustments (PVA) In R$ million 06/30/2021 Equity Interest rates FX Credit Commodities Total Of which: In Of which: In the trading the banking book book 42 1 41 42 39 39 1 38 3 3 3 21 1 20 108 41 185 40 183 77 2 Closeout uncertainty, of which: Closeout cost Concentration Early termination Model risk Operational risk Investing and funding costs Uneamed credit spreads Future administrative costs Other Total adjustment 128 140 268 4 264

Risk and Capital Management - Pillar 3 Country (1) Institutions that comprise only the Financial Statements Itaú Vida e Previdência S.A. Itauseg Participações S.A. Itauseg Saúde S.A. Itauseg Seguradora S.A. ITB Holding Brasil Participações Ltda. IU Corretora de Seguros Ltda. Karen International Limited Kinea Investimentos Ltda. Itaú Unibanco Comercializadora de Energia Ltda. 2) Maxipago Serviços de Internet Ltda. MCC Asesorĺas SpA Mundostar S.A Proserv - Promociones y Servicios, S.A. de C.V. Provar Negócios de Varejo Ltda. Recaudaciones y Cobranzas Limitada Recovery do Brasil Consultoria S.A. RT Alm 5 Fundo de Investimento Renda Fixa RT Alm Soberano 2 Fundo de Investimento Renda Fixa RT Defiant Multimercado - Fundo de Investimento RT Endeavour Renda Fixa Crédito Privado - Fundo de Investimento RT Multigestor 4 Fundo de Investimento em Cotas de Fundos de Investimento Multimercado RT Nation Renda Fixa - Fundo de Investimento RT Valiant Renda Fixa - Fundo de Investimento SAGA II SPA SAGA III SPA Topaz Holding Ltd. Tulipa S.A Uni-Investment International Corporation Unión Capital AFAP S.A. Zup I.T. Soluções em Informatica LTDA Brazil Brazil Brazil Brazil Brazil Brazil Bahamas Brazil Brazil Brazil Chile Uruguay Mexico Brazil Chile Brazil Brazil Brazil Brazil Brazil Brazil Brazil Brazil Chile Chile Cayman Islands Brazil Cayman Islands Uruguay Brazil % Equity share on capital 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 80.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 39.22% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 52.96% 1) The institutions operate in their respective countries of origin. 2) Current denomination of Linear Comercializadora de Energia Ltda. The institutions presented in the tables above represent the total scope of companies of Itaú Unibanco Holding. Non Consolidated Institutions Country (2) Non consolidated Institutions (1) BSF Holding S.A Compañia Uruguaya de Medios de Procesamiento S.A. Conectcar Soluções de Mobilidade Eletrônica S.A. Gestora de Inteligência de Crédito S.A. Kinea Private Equity Investimentos S.A. Olimpia Promoção e Serviços S.A. Porto Seguro Itaú Unibanco Participações S.A. Pravaler S.A Rias Redbanc S.A Tecnologia Bancária S.A. Brazil Uruguay Brazil Brazil Brazil Brazil Brazil Brazil Uruguay Brazil % Equity share on capital 49.00% 31.47% 50.00% 20.00% 80.00% 50.00% 42.93% 52.64% 25.00% 28.05% 1) XP Cayman Company was spun off to XP Part on 05/31/2021. 2) The institutions operate in their respective countries of origin.

Risk and Capital Management - Pillar 3 Institutions that comprise the financial statements and the Prudential Consolidation 1) Itaú Distribuidora de Tĺtulos e Valores Mobiliários S.A. Itaú EU Lux-Itaú Latin America Equity Fund Itaú International Securities Inc. Country (2) Brazil Luxembourg United States % Equity share on capital 100.00% 95.15% 100.00% Itaú Invest Casa de Bolsa S.A. Paraguay 100.00% Itaú Kinea Private Equity Multimercado Fundo de Investimento em Cotas de Fundos de Investimento Crédito Privado Brazil 100.00% Brazil 75.08% 34.44% 100.00% 100.00% Colombia Brazil Cayman Islands Brazil Cayman Islands United States Bahamas Brazil Argentina Brazil Cayman Islands Brazil Brazil Brazil Brazil 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% Itaú OT Tĺtulos Públicos Renda Fixa Referenciado Di Fundo de Investimento em Cotas de Fundos de Investimento Itaú Securities Services Colombia S.A. Sociedad Fiduciaria Itaú Unibanco Holding S.A. Itaú Unibanco Holding S.A., Grand Cayman Branch Itaú Unibanco S.A. Itaú Unibanco S.A., Grand Cayman Branch Itaú Unibanco S.A., Miami Branch Itaú Unibanco S.A., Nassau Branch Itaú Unibanco Veĺculos Administradora de Consórcios Ltda Itaú Valores S.A Itauvest Distribuidora de Tĺtulos e Val. Mobiliários S.A ITB Holding Ltd. Kinea Ações Fundo de Investimento em Ações Kinea CO-investimento Fundo de Investimento Imobiliario Kinea Private Equity FIP Multiestrategia Kinea KP Fundo de Investimento Multimercado Crédito Privado Kinea Ventures FIP Licania Fund Limited Luizacred S.A. Sociedade de Crédito, Financiamento e Investimento MCC S.A. Corredores de Bolsa Microinvest S.A. Soc. de Crédito a Microempreendedor OCA Dinero Electrónico S.A. OCA S.A. Oiti Fundo de Investimento Multimercado Crédito Privado Investimento no Exterior Redecard Instituição de Pagamento S.A. RT Itaú DJ Tĺtulos Públicos Fundo de Investimento Renda Fixa Referenciado DI RT Scala Renda Fixa - Fundo de Investimento em Cotas de Fundos de Investimento RT Voyager Renda Fixa Crédito Privado - Fundo de Investimento Taruma Fundo Incentivado de Investimento em Debentures de Infraestrutura Renda Fixa Crédito Privado 100.00% 100.00% 100.00% 99.90% 99.64% 100.00% 100.00% Brazil Cayman Islands Brazil Chile 100.00% 50.00% 100.00% 100.00% 100.00% Brazil Uruguay Uruguay Brazil 100.00% 100.00% Brazil 100.00% 100.00% Brazil Brazil Brazil Brazil 100.00% 100.00% 100.00% 1) As of December 2019, the funds Crédito Universitário FIDC I and Crédito Universitário FIDC II were consolidated in the Itaú Unibanco Holding S. A Prudential Conglomerate. 2) The institutions operate in their respective countries of origin.

Risk and Capital Management - Pillar 3 Institutions that comprise the Financial Statements of Itaú Unibanco Holding Institutions that comprise only the Financial Statements Aj ll Tĺtulos Públicos Fundo de Investimento Renda Fixa Referenciado DI Albarus S.A. Ank Platform S.A. BICSA Holdings, Ltd. Borsen Renda Fixa Crédito Privado - Fundo de Investimento CGB II SPA CGB III SPA Cia. Itaú de Capitalização Estrel Serviços Administrativos S.A. FC Recovery S.A.U. FIC Promotora de Vendas Ltda. iCarros Ltda. IGA Participações S.A. Investimentos Bemge S.A. Itaú Administradora General de Fondos S.A. Itaú Asesorĺas Financieras Limitada Itaú Asia Limited Itaú Asset Management S.A. Sociedad Gerente de Fondos Comunes de Inversión Itaú Bahamas Directors Ltd. Itaú Bahamas Nominees Ltd. Itaú BBA International (Cayman) Ltd. Itaú BBA México, S.A. de C.V. (2) Itaú BBA Trading S.A. Itaú Chile Inversiones, Servicios y Administracion S.A. Itaú Consultoria de Valores Mobiliários e Participações S.A. Itaú Corredor de Seguros Colombia S.A. Itaú Corredores de Seguros S.A. Itaú Corretora de Seguros S.A. Itaú Europa Luxembourg S.A. Beta Correspondente e Tecnologia Ltda. (3) Itaú Institucional Renda Fixa Fundo de Investimento Itaú International Holding Limited Itaú Participação Ltda. Itaú Rent Administração e Participações Ltda. Itaú Seguros Paraguay S.A. (*) Itaú Seguros S.A. Itaú Unibanco Asset Management Ltda. Itaú USA Asset Management Inc. 1) The institutions operate in their respective countries of origin. 2) The company is transferring its location from Mexico to Uruguay. Awaiting local approvals. 3) Current denomination of Itaú Gestão de Vendas Ltda. 4) Current denomination of Providencia S.A. de Seguros Country(1) Brazil Paraguay Argentina Cayman Islands Brazil Chile Chile Brazil Brazil Argentina Brazil Brazil Brazil Brazil Chile Chile Hong Kong Argentina Bahamas Bahamas Cayman Islands Uruguay Brazil Chile Brazil Colombia Chile % Equity share on capital 57.96% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 50.00% 100.00% 100.00% 86.81% 39.22% 39.22% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 31.37% 39.22% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% Brazil Luxembourg Brazil Brazil United Kingdom Brazil Brazil Paraguay Brazil Brazil United States

Institutions that comprise the Financial Statements of Itaú Unibanco Holding The lists below provide the institutions that comprise the financial statements and the Prudential Consolidation of Itaú Unibanco Holding S.A.. Institutions that comprise the financial statements and the Prudential Consolidation (1) A1 Hedge Orange Master Fundo de Investimento Multimercado Aj Tĺtulos Públicos Fundo de Investimento Renda Fixa Referenciado DI Banco Investored Unibanco S.A. Banco Itaú (Suisse) S.A. Banco Itaú Argentina S.A Banco Itaú BBA S.A Banco Itaú Consignado S.A Banco Itaú International Banco Itaú Paraguay S.A. Banco Itaú Uruguay S/A Banco Itaú Veĺculos S.A. Banco ItauBank S.A. Banco Itaucard S.A. Banco Itauleasing S.A. Dibens Leasing S.A. - Arrendamento Mercantil Financeira Itaú CBD S.A. Crédito, Financiamento e Investimento Fundo A1 Hedge Orange Fundo de Investimento em Cotas de Fundos de Investimento Multimercado Fundo De Invest Dir Creditórios Não Padron NPL II Fundo de Investimento em Direitos Creditórios Não-Padronizados Barzel Fundo de Investimento em Direitos Creditórios Rede Fundo em Direitos Creditórios Cielo Emissores Fundo Fortaleza de Investimento Imobiliário Fundo Kinea Ações Goal Performance Goal Performance | Hipercard Banco Múltiplo S.A Intrag Distribuidora de Tĺtulos e Valores Mobiliários Ltda. Tresolve Companhia Securitizadora de Créditos Financeiros S.A. Itaú (Panama) S.A Itaú Administradora de Consórcios Ltda. Itaú Asset Management Colombia S.A. Sociedad Fiduciaria Itaú Bank & Trust Bahamas Ltd. Itaú Bank & Trust Cayman Ltd. Itaú Bank, Ltd. Itaú BBA Europe S.A Itaú BBA International Plc. Itaú BBA USA Securities Inc. Itaú Cia. Securitizadora de Créditos Financeiros Itaú Comisionista de Bolsa Colombia S.A. Itaú CorpBanca Itaú CorpBanca Colombia S.A Itaú CorpBanca New York Branch Itaú Corredores de Bolsa Limitada Itaú Corretora de Valores S.A. Country (2) Brazil Brazil Brazil Switzerland Argentina Brazil Brazil United States Paraguay Uruguay Brazil Brazil Brazil Brazil Brazil Brazil Brazil Brazil Brazil Brazil Brazil Brazil Brazil Argentina Argentina Brazil Brazil Brazil Panama Brazil Colombia Bahamas Cayman Islands Cayman Islands Portugal United Kingdom United States Brazil Colombia Chile Colombia United States Chile Brazil % Equity share on capital 100.00% 98.34% 50.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 50.00% 100.00% 100.00% 100.00% 100.00% 89.98% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 34.16% 100.00% 34.15% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 34.27% 39.22% 34.16% 39.22% 39.22% 100.00% 1) As of December 2019, the funds Crédito Universitário FIDC I and Crédito Universitário FIDC II were consolidated in the Itaú Unibanco Holding S. A Prudential Conglomerate. 2) The institutions operate in their respective countries of origin. Risk and Capital Management - Pillar 3

Risk and Capital Management - Pillar 3 Material entities Total assets, stockholders' equity, country and the activities of the material entities, including those subject to the risk weight for the purpose of capital requirements are as follows: R$ million Institutions Country Activity Cia. Itaú de Capitalização Brazil Premium bonds Itaú Consultoria de Valores Mobiliários e Participações S.A. Brazil Financial institution holding company Itaú Corretora de Seguros S.A. Brazil Insurance, pension plans and health brokers Itaú Seguros S.A. Brazil Insurance Itaú Vida e Previdência S.A Brazil Pension plan Itauseg Participações SA Brazil Non financial institution holding company ITB Holding Brasil Participações Ltda. Brazil Financial institution holding company Provar Negócios de Varejo Ltda. Brazil Other auxiliary activities for financial services 06/30/2021 03/31/2021 Total Assets Equity Total Assets Equity 3,907 356 3,912 398 1,389 1,337 2,321 2,270 1,272 646 2,661 1,974 6,045 1,568 6,057 1,866 219,265 3,464 217,210 2,949 10,342 10,332 10,695 10,690 23,379 22,522 30,115 29,354 2,303 2,254 2,524 2,474 Composition of Capital CCA: Main features of regulatory capital instruments The authorized regulatory capital instruments may be extinguished according to the criteria established in Resolution nº 4,192 in articles 17, item XV, or 20, item X, such as non-compliance with the minimum regulatory ratios, decree of temporary special administration regime or intervention, application of public resources or upon the Central Bank of Brazil determination. Should any criteria for the extinction of subordinated instruments be triggered, the area responsible for Itaú Unibanco's Capital management will activate the areas involved to execute the following action plan: The treasury, through the payment agent of the subordinated instruments or straight through the central depository, will notify its holders and take actions to ensure that Itaú Unibanco's trading desks cease to trade such instruments; The operational and accounting areas will carry out the necessary procedures for the proper treatment of the extinction; and The Investor Relations area will communicate the market of the extinction of the subordinated instruments. The table CCA-Main features of regulatory capital instruments, is available at www.itau.com.br/investor-relations, section 'Results and Reports', 'Regulatory Reports', 'Pillar 3'. Itaú Unibanco

Risk and Capital Management - Pillar 3 CC1-Composition of regulatory capital Common Equity Tier 1: instruments and reserves 1 Instruments Eligible for the Common Equity Tier I 2 Revenue reserves 3 Other revenue and other reserve 5 Common share capital issued by subsidiaries and held by third parties (amount allowed in group CET1 capital) 6 Common Equity Tier I before regulatory adjustments Common Equity Tier 1: prudential adjustments 7 Prudential adjustments related to the pricing of financial instruments 8 Goodwill (net of related tax liability) 9 Intangible assets 10 Tax credits arising from income tax losses and social contribution tax loss carryfowards and those originating from this contribution related to determination periods ended until December 31 , 1998 Adjustments related to the marl (e) (h) I (i) (b) (d) (n) (g) (i) Itaú Unibanco

Risk and Capital Management - Pillar 3 41 42 Additional Tier I Capital: regulatory adjustments 37 Shares or other instruments issued by the bank authorized to compose the Additional Tier | Capital, acquired directly, indirectly or synthetically 38 Reciprocal cross-holdings in additional Tier 1 instruments Total value of adjustments related to net non-significant investments in the Additional Tier | Capital of institutions authorized to operate by 39 the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation Total value of adjustments related to net significant investments in the Additional Tier I Capital of institutions authorized to operate by the 40 Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation National specific regulatory adjustments 41.b Non-controlling interest in Additional Tier Capital 41.c Other residual differences concering the Additional Tier I Capital calculation methodology for regulatory purposes Regulatory adjustments applied to the Additional Tier Capital due to the insufficient Tier II Capital to cover deductions 43 Total regulatory deductions from the Additional Tier 1 Capital 44 Additional Tier I Capital (AT1) 45 Tier1 Tier II: instruments Instruments eligible for Tier II 47 Instruments that are authorized to compose Tier II before Resolution No. 4,192 of 2013 comes into effect 48 Tier 2 instruments issued by subsidiaries and held by third parties (amount allowed in group Tier 2) 49 Of which: instruments issued by subsidiaries before Resolution No. 4, 192 of 2013 comes into effect 51 Tier Il before regulatory adjustments Tier II: regulatory adjustments 52 Shares or other instruments issued by the bank authorized to compose Tier II, acquired directly, indirectly or synthetically 53 Reciprocal cross-holdings in Tier 2 instruments Total value of adjustments related to net non-significant investments in the Tier II and other TLAC liabilities of institutions authorized to 54 operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation 16,710,028 141,674,364 46 10,842,591 3,944,513 99,927 14,887,031 14,887,031 156,561,395 1,048,627,694 Total value of adjustments related to net significant investments in the Tier II and other TLAC liabilities of institutions authorized to operate 55 by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation 56 National specific regulatory adjustments 56.b Non-controlling interest in Tier II 56.c Other residual differences concerning Tier II calculation methodology for regulatory purposes 57 Total regulatory deductions from Tier Il Capital 58 Tier 11 59 Referential Equity (Tier I + Tier II) 60 Total risk-weighted assets BIS Ratios and Additional Capital Buffers 61 Common Equity Tier I Ratio 62 Tier I Ratio 63 BIS Ratio 64 Additional Capital Buffers (% of RWA) 65 Of which: capital conservation buffer requirement 66 Of which: bank-specific countercyclical buffer requirement 67 Of which: capital buffer for institutions that are systemically important at global level (G-SIB) 68 Common Equity Tier 1 capital available after meeting the bank's minimum capital requirements (% of RWA) Amounts below the limit for deduction (non-weighted by risk) 11.9% 13.5% 14.9% 2.625% 1.625% 1.0% 4.2% Total value, subject to risk weighting, of non-significant investments in the Common Equity Tier I of institutions authorized to operate by the Central Bank of Brazil, non-consolidated overseas financial institutions, companies that are similar to non-consolidated financial institutions, 72 insurance companies, reinsurance companies, capitalization companies and open ended pension entities, as well as non-significant investments in the Additional Tier I, Tier II and other TLAC liabilities of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation 1,613,290 73 Total value, subject to risk weighting, of significant investments in the Common Equity Tier I of institutions authorized to operate by the Central Bank of Brazil, non-consolidated overseas financial institutions, companies that are similar to non-consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and sponsored pension fund entities 8,134,171 (f)/(a) 17,973,166 (c) 75 Tax credits arising from temporary differences, not deducted from the Common Equity Tier I Instruments authorized to compose the Referential Equity before Resolution No. 4,192 of 2013 comes into effect (applicable between October 1, 2013 and January 1, 2022) 82 Instruments that are authorized to compose the Additional Tier I Capital before Resolution No. 4,192 of 2013 comes into effect 83 Amount excluded from the Additional Tier I Capital due to the line 82 limit Instruments that are authorized to compose Tier II before Resolution No. 4,192 of 2013 comes into effect 85 Amount excluded from Tier II due to the line 84 limit 84 3,944,513 35,500,614

Risk and Capital Management - Pillar 3 CC2: Reconciliation of regulatory capital to balance sheet R$ million, at the end of the period 1 Consolidated Balance Sheetl 1 Assets(2) Current assets and Long-term receivables Cash Interbank investments Securities and derivative financial instruments Interbank accounts I nterbranch accounts Loan, lease and other credit operations Other receivables Deferred tax assets Sundry Other assets Permanent assets Investments Real estate Goodwill and Intangible assets Goodwill Intangible assets Other Total assets Liabilities Current and Long-term Liabilities Depos its Deposits received under securities repurchase agreements Funds from acceptances and issuance of securities Interbank accounts lnterbranch accounts Borrowings and onlending Derivative financial instruments Technical provision for insurance, pension plan and capitalization Provisions Allowance for financial guarantees provided Other liabilities Deferred tax liabilities Sundry Deferred income Non-controlling interest in s ubsidiaries Stockholders' equity Capital Other Revenues and Other Reserves Revenue reserves (Treasury shares) Total liabilities and stockholders' equity Balance Sheet as in published financial statements 2,039,237 39,837 218,463 728,483 152,134 262 676,749 220,196 3,113 26,507 6,829 6,253 13,425 2,065,744 1,915,895 793,501 250,190 127,625 63,788 10,463 85,777 65,701 221 ,664 17,160 742 279,284 3,207 10,617 136,025 90,729 (1,294) 47,118 (528) 2,065,744 Under regulatory scope of consolidation 1,807,186 39,749 215,220 504,408 152,134 262 677,592 214,791 58,763 156,028 3,030 43,498 25,049 5,764 12,685 3,176 9 ,408 101(j) 1,850,684 1,700,804 796,672 250,248 127,625 63,788 10,466 85,777 65,713 16,737 742 283,036 2,660 280,376 3,249 10,501 136,130 90,729 (49) 45,978 (528) 1,850,684 06/30/2021 Reference Ill (b) I (c) (b) / (d ) (a) / (e) / (f) (e) (h) I (i) (b) I (c) (d) (k) (m) (I) (n) 1) Differences are mainly due to non-consolidation of non financial companies (highlighting the following companies: Insurance, Pension Plan and Premium Bonds) within the Prudencial Conglomerate and also by the eliminations of transactions with related parties. 2) Prudential information that is presented in the Tem plate CC1 of this document. Itaú Unibanco

Risk and Capital Management - Pillar 3 Macroprudential Indicators CCyB1: Geographical distribution of credit risk exposures considered in the calculation of the Countercyclical Capital Buffer The following table details the geographic distribution of credit risk exposures considered in the calculation of the Countercyclical Capital Buffer, according to Circular 3,769 of 29 October 2015: R$ million 06/30/2021 Geographical breakdown Countercyclical capital buffer rate Exposure values and/or risk-weighted assets (RWA) used in the computation of the countercyclical capital buffer Amount of credit risk exposure to the non-banking private RWACP/NB sector Bank-specific countercyclical capital buffer rate Countercyclical capital buffer amount) Brazil 1,442,082 602.900 0.50% 1,796 996 Luxembourg Norway Hong Kong 1.00% 338 236 1.00% 105 105 1,444,321 604,237 Sum (1) Total (2) 1,760,418 811,899 1) Sum of RWACP/NBi portions related to credit risk exposures to the non-banking private sector in Brazil and jurisdictions with a percentage of the countercyclical buffer with values greater than zero. 2) Total of RWA for non-bank private credit risk exposures to all jurisdictions in which the bank has exposure, including jurisdictions with no countercyclical buffer percentage applied or with a countercyclical percentage equal to zero. 3) Calculated according to Circular 3.769, employing the discretionary exclusion of jurisdiction. GSIB1: Disclosure of G-SIB indicators The GSIB1 table, disclosure of global systemically important bank (G-SIB) indicators, will be available on the website www.itau.com.br/investor-relations, section 'Reports', 'Pillar 3 and Global Systemically Important Banks', within the period stipulated by BACEN Circular 3.751/15. Leverage Ratio The Leverage Ratio is defined as the ratio between Tier | Capital and Total Exposure, calculated according to BACEN Circular 3,748. The ratio is intended to be a simple measure of non-risk-sensitive leverage, and so it does not take into account risk we or risk mitigation As required by BACEN Circular Letter 3,706, Itaú Unibanco monthly reports to BACEN the Leverage Ratio, which minimum requirement is of 3%. The following information is based on the methodology and standard format introduced by BACEN Circular 3,748.

Risk and Capital Management - Pillar 3 LR1: Summary comparison of accounting assets vs leverage ratio exposure measure (RA) R$ million Total consolidated assets as published financial statements Adjustment from differences of consolidation Total assets of the individual balance sheet or of the regulatory consolidation in the case of Leverage Ratio on a consolidated basis Adjustments for derivative financial instruments Adjustment for securities financing transactions (ie repos and similar secured lending) Adjustment for off-balance sheet items (le conversion to credit equivalent amounts of off-balance sheet exposures) Other adjustments Total Exposure 06/30/2021 2,065,744 (215,060) 03/31/2021 2,124,817 (207,694) 1,850,684 1,917,123 29,603 14,151 140,071 (151,121) 1,883,388 27 259 15,668 138,588 (180,407 1,918,231 LR2: Leverage ratio common disclosure R$ million Items shown in the Balance Sheet Balance sheet ters except derivative fnancial instruments, securities received on loan and resales for settlement under repurchase transactions Adjustments for equity items deducted in the calculation of Tier Total exposure shown in the Balance Sheet Transactions using Derivative Financial Instruments Replacement value for derivatives transactions Potential future gains from derivatives transactions Adjustment for collateral in derivatives transactions Adjustment related to the deduction of the exposure because of the qualified central counterparty (OCCP) in derivative transactions on behalf of clients in which there is no contractual obligation to reimburse due to bankruptcy or defaut of the entities responsible for the settlement and compensation of transactions Reference value for credil derivatives Adjustment of reference value calculated for credit derivatives Total exposure for derivative financial instruments Repurchase Transactions and Securities Lending (TVM) Investments in repurchase transactions and securities lending Adjustment for repurchases for settlement and creditors of securities lending Amount of counterparty credit risk Amount of counterparty credit risk in transactions as intermediary Total exposure for repurchase transactions and securities lending Orr-balance sheet items Reference value of off-balance sheet transactions Adjustment for application of FCC specific to off-balance sheet transactions Total off-balance sheet exposure Capital and Total Exposure Tieri Total Exposure Leverage Ratio Basel Leverage Ratio 06/30/2021 03/31/2021 1,493,401 1,541,514 (23.770) 1,469,631 (38,263) 1,503,251 48,564 15,591 35,580 13,426 (9,384) (6,838) 23,718 (3,960) 74,529 22,195 (3,996) 60,367 159,040 178,058 14,151 25,966 199,157 15,667 22,300 216,025 435 217 (295, 146) 140,071 427,756 (289,168) 138,588 139,552 141,674 1,883,388 1,918,231 7.5% 7.3% Itaú Unibanco

Risk and Capital Management - Pillar 3 Liquidity Ratios LIQA: Liquidity Risk Management Information Framework and Treatment Liquidity risk is defined as the likelihood of the institution not being able to effectively honor its expected and unexpected obligations, current and future, including those from guarantees commitment, without affecting its daily operations or incurring in significant losses. In line with the fundraising strategy, Itaú Unibanco has diversified and stable sources of funding available, monitored through concentration and maturity indicators, in order to mitigate liquidity risks, in accordance with the institution's risk appetite. The governance of the liquidity risk management is based on advisory boards, subordinated to the Board of Directors or the executive structure of Itaú Unibanco. Such boards establish the institution's risk appetites, define the limits related to the liquidity control and monitor the liquidity indicators. The control of the liquidity risk is carried out by an area that is independent of the business areas, responsible for defining the composition of the reserve, estimating the cash flow and the exposure to liquidity risk in different time horizons and monitoring short and long term liquidity indicators (LCR and NSFR respectively). In addition, it proposes minimum limits to absorb losses in stress scenarios for each country where Itaú Unibanco operates and reports any non-compliance to the competent authorities. All activities are subject to verification by the independent validation, internal controls and audit departments. Additionally, and pursuant to the requirements of Resolution 4,557, BACEN Circular 3,749 and Circular 3,869, the Liquidity Risk Statement (DRL-LCR) and the Long Term Liquidity Statement (DLP-NSFR) are monthly sent to BACEN. Finally, the following items are periodically prepared and submitted to senior management for monitoring and decision support: Stress of liquidity indicators based on macroeconomic scenarios, simulation of reverse stress based on risk appetite, and projection of the main liquidity indicators to support decisions; Contingency and recovery plans for crisis situations, with actions that provide for a gradation according to the level of criticality determined by the easiness of implementation, taking into account the characteristics of the local market in which it operates, seeking a rapid restoration of liquidity indicators; Reports and graphs that describe risk positions; Concentration indicators of funding providers and time. The document that details the liquidity risk control institutional policy is on the Investor Relations website https://www.itau.com.br/investor-relations, section 'Itaú Unibanco', under 'Corporate Governance', 'Rules and Policies, Reports'. Itaú Unibanco

Risk and Capital Management - Pillar 3 LIQ1: Liquidity Coverage Ratio (LCR) 06/30/2021(1) 03/31/2021 Total unweighted value (In thousand R$)(2) Total weighted value (In thousand R$)) Total unweighted value (In thousand R$)(2) Total weighted value (In thousand R$)) High Quality Liquidity Assets (HQLA) Total High Quality Liquid Assets (HQLA) Cash Outflows (4) 324,439,861 356,221,955 Retail deposits and deposits from small business customers, of which: 449,155,165 39,851,660 437,630,944 38,379,043 231,699,402 217,455,763 294,191,317 4,225,785 288,992,011 973,521 225, 272,797 212,358,147 312,048,042 1,087,942 308,830,829 2,129,271 Stable deposits Less stable deposits Unsecured wholesale funding, of which: Operational deposits (all counterparties) and deposits in networks of cooperative banks Non-operational deposits all counterparties) Unsecured debt Secured wholesale funding Additional requirements, of which: Outflows related to derivative exposures and other collateral requirements Outflows related to loss of funding on debt products Credit and liquidity facilities Other contractual funding obligations Other contingent funding obligations Total Cash Outflows Cash Inflows (4) Secured lending (eg reverse repos) Inflows from fully performing exposures Other cash inflows Total Cash Inflows 11,584,970 28,266,690 128,861,456 883,301 127,004,634 973,521 19,272,569 34,116,228 16,828,182 874,988 16,413,058 69,263,858 22,057,334 313,423,105 11,263,640 27,115,403 137,819,582 54,397 135,635,914 2,129,271 19,532,903 32,865,519 16,996,734 1,081,317 14,787,468 71,657,640 22,194,867 322,449,554 263,405,481 36,302,252 279,804,945 36,908,048 874 988 242,021,909 1,081,317 226,021,912 71,657,640 127,602,820 69,263,858 131,236,223 177,069,032 36,675,413 122,623,573 336,368,018 924,418 23,573,123 109,603,625 134,101,166 186,142,060 35,767,315 126,163 864 348,073,239 1,237,499 22,824,152 111,875,114 135,936,765 Total Adjusted Total Adjusted Value 5) Value (5) Total HQLA Total net cash outflows Liquidity Coverage Ratio (%) 324,439,861 179,321,939 180.9% 356,221,955 186,512,789 191.0% 1) Corresponds to 62 daily average observations at 2021 and 61 daily at 1Q21. 2) Total balance off the cash inflows or outflows. 3) After aplication of weighting factors. 4) Potential cash outflows (Outflows e) and inflows (inflows e). 5) Amount calculated after applying weighting factors and limits set by BACEN Circular 3,749. Itaú Unibanco has High Quality Liquidity Assets (HQLA) that amounted to R$ 324.4 billion on average for the quarter, mainly composed of Sovereign Securities, Central Bank Reserves and Cash. Net Cash Outflows amounted to R$ 179.3 billion on average for the quarter, which are mostly comprised of Retail Funding, Wholesale, Additional Requirements, Contractual and Contingent Obligations, offset by Cash inflows from loans and other Cash inflows. The table shows that the average LCR in the quarter is 180.9%, above the limit of 100% and therefore the institution has high quality liquidity resources comfortably available to support the losses in the standardized stress scenario for the LCR. Itaú Unibanco 24

Risk and Capital Management - Pillar 3 Value per residual effective maturity term (RS thousand) Lower than six Greater than or equal Greater than or equal Weighted Value to six months, and (In thousand lower than 1 year' to 1 year 06/30/2021 No Maturity months (1) RS) 2) 207,196,818 127,210,525 79,986,293 65,415,161 11,737,987 53,677,174 251,111,885 108,799 268 142.312.617 552,258,229 2,194,361 107,912 2,086 449 53,796,604 Available Stable Funding (ASF) Capital Reference Equity, gross of regulatory deductions Other capital instruments not included in line 2 Retail Funding: Stable Funding Less Stable Funding Wholesale Funding: Operational deposits and deposits of member cooperatives Other Wholesale Funding Operations in which the institution acts exclusively as intermediary, not undertaking any rights or obligations, even if contingent Other liabilities, in which: Derivatives whose replacement values are lower than zero Other liability or equity elements not included above Total Available Stable Funding (ASF) Required Stable Funding (RSF) Total NSFR high quality liquid assets (HQLA) Operational deposits held at other financial institutions 196,372,160 146,854,484 49,517,676 22,251,703 155,949 22,095,754 115,310,016 196,372,160 146,854,484 49,517,676 448,510,345 224,467.768 224,042,577 301,956,171 5,868,993 296,087,178 552 258 229 53.796,604 115,310,016 84,229,148 9,711,812 753,723 94,292,250 233,027 2,855,748 2,972,262 137,201,814 17,435,585 119.766 229 94 292 250 233,027 2,855,748 2.972 262 949,810,938 22,909,446 Performing loans and securities (financial institutions, corporates and central banks) 2,701,991 355,674,072 97,242,754 464,398,821 543,638,442 43,479,337 79,731 4,427,665 Performing loans to financial institutions secured by Level 1 HQLA Performing loans to financial institutions secured by non-Level 1 HQLA and unsecured performing loans to financial institutions Performing loans to non-financial corporate clients, loans to retail and small business customers, and loans to Sovereigns, central banks, of which 2,570,055 32.640,763 5,996.754 38,064,289 46,428,627 131,936 243,041,002 66 363 607 239,126,431 310,610,265 With a risk weight of less than or equal to 35%, approach for credit risk, according to Circular 3,644. 4,176,131 2,714 485 17.027,316 14.858.156 77,026,315 61,393,716 110,102,056 73.412.594 47,166,575 108,759 291 10,024,237 Performing residential mortgages, of which Which are in accordance to Circular 3,644, 2013, art. 22 Securities that are not in default and do not qualify as HQLA, including exchange-traded equities Operations in which the institution acts exclusively as intermediary, not undertaking any rights or obligations, even if contingent Other assets, which: 19,485,654 90,029,164 8,473,930 1,237,568 70.982.550 167,074,454 8,114,480 88,324,225 187,989,555 Transactions with gold and commodities, including those with expected physical settlement Assets posted as initial margin for derivatives contracts and participation in mutual guarantee funds of clearinghouses or providers of clearing and settlement services which acts as central counterparty 21,915,990 18,628,591 21.002.694 1,486,905 1.486.906 1,047,085 1,047,085 Derivatives whose replacement values are higher than or equal to zero Derivatives whose replacement values are less than zero, gross of the deduction of any collateral provided as a result of deposit variation margin Al other assets not included in the above categories Off-balance sheet transactions Total Required Stable Funding (RSF) NSFR (%) 8,114,480 63,874,245 70,982,550 498,417,760 146,071,760 6,100.839 166,826,973 19,627,402 774, 164,845 122.7% 1) Corresponds to the total amount of Available Stable Funding (ASF) or Required Stable funding (RSF). 2) Corresponds to the amount after application of weighting factors. 3) Corresponds to the Available Stable Funding (ASF) or Required Stable Funding (RSF). Total Adjusted Value (1) 06/30/2021 03/31/2021 R$ thousand Total Available Stable Funding (ASF) 949,810,938 990,197,209 Total Required Stable Funding (RSF) 774,164,845 792,198,656 NSFR (%) 122.7% 125.0% 1) Corresponds to the amount calculated after application of the weighting factors and limits set forth in BACEN Circular 3,869 Itaú Unibanco has High Quality Liquidity Assets (HQLA) that amounted to R$ 949.8 billion on average for the quarter, mainly composed of Sovereign Securities, Central Bank Reserves and Cash. Net Cash Outflows amounted to R$ 774.2 billion on average for the quarter, which are mostly comprised of Retail Funding, Wholesale, Additional Requirements, Contractual and Contingent Obligations, offset by Cash inflows from loans and other Cash inflows.

Risk and Capital Management - Pillar 3 The table shows that the average LCR in the quarter is 122.7%, above the limit of 100%, and therefore the institution has high quality liquidity resources comfortably available to support the losses in the standardized stress scenario for the LCR. Credit Risk CRA: Qualitative information on credit risk management Itaú Unibanco defines credit risk as the risk of loss associated with: failure by a borrower, issuer or counterparty to fulfill their respective financial obligations as defined in the contracts; value loss of credit agreements resulting from deterioration of the borrower's, issuer's or counterparty's credit rating; reduction of profits or income; benefits granted upon subsequent renegotiations; or debt recovery costs. The management of credit risk is intended to preserve the quality of the loan portfolio at levels compatible with the institution's risk appetite for each market segment in which Itaú Unibanco operates. The governance of credit risk is managed through corporate bodies, which report to the Board of Directors or to the Itaú Unibanco executive structure. Such corporate bodies act primarily by assessing the competitive market conditions, setting the credit limits for the institution, reviewing control practices and policies, and approving these actions at the respective authority levels. The risk communication and reporting process, including disclosure of institutional and supplementary policies on credit risk management, are also function of this structure. Itaú Unibanco manages the credit risk to which it is exposed during the entire credit cycle, from before approval, during the monitoring process and up to the collection or recovery phase, with the periodic monitoring of troubled assets, which are defined as: Overdue Transactions for more than 90 days; Restructured Operations for Troubled Assets; Counterparties that present inability to pay, whether by legal measures, bankruptcy, loss, among others; Significant deterioration in credit quality, which can be identified by deterioration in internal rating metrics, guarantees honored, overdue exposure, among others. Additionally, if it is identified that a CNPJ may contaminate the counterparties, they may be marked as Troubled Assets. The monitoring contains information on significant exposures, including recovery history and prospects, as well as restructuring information. These analyzes are generated monthly for executives and quarterly for the Board of Directors through the Risk and Capital Management Committee (CGRC). There is a credit risk management and control structure, centralized and independent of the business units which defines operational limits, risk mitigation mechanisms and processes, and instruments to measure, monitor and control the credit risk inherent to all products, portfolio concentrations and impacts to potential changes in the economic environment. Such structure is subjected to internal and external auditing processes. The credit's portfolio, policies and strategies are continuously monitored so as to ensure compliance with the rules and laws in effect in each country. The key assignments of the business units are (i) monitoring of the portfolios under their responsibility, (ii) granting of credit, taking into account current approval levels, market conditions, the macroeconomic prospects and changes in markets and products, and (iii) credit risk management aimed at making the business sustainable. Itaú Unibanco's credit policy is based on internal factors, such as: client rating criteria, performance and evolution of the portfolio, default levels, return rates and allocated economic capital, among others; and also take into account external factors such as: interest rates, market default indicators, inflation and changes in consumption, among others. Itaú Unibanco 26

Risk and Capital Management - Pillar 3 With respect to individuals, small and medium companies, retail public, the credit ratings are assigned based on statistical application (in the early stages of relationship with a customer) and behavior score (used for customers with whom Itaú Unibanco already has a relationship) models. For wholesale public, the classification is based on information such as the counterparty's economic and financial situation, its cash-generating capacity, and the business group to which it belongs, the current and prospective situation of the economic sector in which it operates. Credit proposals are analyzed on a case-by-case basis through the approval governance. The concentrations are monitored continuously for economic sectors and largest debtors, allowing preventive measures to be taken to avoid the violation of the established limits. Itaú Unibanco also strictly controls credit exposure to clients and counterparties, acting to reverse occasional limit breaches. In this sense, contractual covenants may be used, such as the right to demand early payment or require additional collateral. To measure credit risk, Itaú Unibanco takes into account the probability of default by the borrower, issuer or counterparty, the estimated amount of exposure in the event of default, past losses from default and concentration of borrowers. Quantifying these risk components is part of the lending process, portfolio management and definition of limits. The models used by Itaú Unibanco are independently validated, to ensure that the databases used in constructing the models are complete and accurate, and that the method of estimating parameters is adequate. Itaú Unibanco also has a specific structure and processes aimed at ensuring that other aspects of credit risk, such as country risk, are managed and controlled, described in the item 'Other Risks'. In compliance with CMN Resolution 4,557, the document 'Public Access Report-Credit Risk,' which describes the guidelines established in the institutional ruling on credit risk control, can be viewed on the website www.itau.com.br/investor-relations, section 'Itaú Unibanco', under 'Corporate Governance', 'Rules and Policies', 'Reports'. CR1: Credit Quality of Asset R$ million Loans Debt Securities in which: Sovereigns in which: Other Debts Off-balance sheet exposures Total 06/30/2021 Gross carrying values of Defaulted exposures (a) Allowances, Unearned Revenues and ECL accounting provision (c) Non-defaulted exposures (b) Net values (a+b-c) 24,588 804,696 128,769 700,516 291 418,674 422,835 250,638 172,197 431,397 1,658,928 4,452 675 3,777 742 291 249,963 168,711 430,654 24,879 133,963 1,549,844 Itaú Unibanco

Risk and Capital Management - Pillar 3 CR2: Changes in Stock of defaulted loans and debts securities R$ million Defaulted loans and debt securities at end of the previous reporting period (03/31/2021) Loans and debt securities that have defaulted since the last reporting period Amount returned to non-defaulted status Amount written off Other changes Defaulted loans and debt securities at end of the reporting period (06/30/2021) Total 25,032 17,777 (854) (13,795) (3,281) 24,879 CRB: Additional disclosure related to the credit quality of assets The tables below contain additional disclosure related to the credit quality exposures reported in the table CR1. Where is informed breakdown of exposures by geographical area, industry and defaulted exposures. In addition, the total exposures by residual maturity by delay range, the total of restructured exposures and the percentage of the ten and one hundred largest exposures are reported. Itaú Unibanco

Risk and Capital Management - Pillar 3 Exposure by industry Total Exposure R$ million 06/30/202 Portfolio Total Exposure (Net Total Exposure values] Gross values) Companies Public sector Energy Petrochemical and Chemical Sundry Private sector Sugar and Alcohol Agribusiness and Fertilizers Food and Beverage Banks and Other Financial Institutions Capital Assets Pulp and Paper Electronic and IT Packaging Energy and Sewage Education Pharmaceuticals and Cosmetics Real Estate Agents Entertainment and Tourism Wood and Furniture Construction Material Steel and Metalurgy Media Mining Infrastructure Work Oil and Gas Petrochemical and Chemical Health Care Insurance and Reinsurance and Pension Plans Telecommunications Clothing and Footwear Trading Transportation Domestic Appliances Vehicles and Autoparts Third Sector Publishing and Printing Commerce. Sundry Industry - Sundry Sundry Services Sundry Individuals Total 949,986 308,916 48 4.356 304,512 641,069 9,397 27,152 31,217 63,452 10,005 4,209 14,995 5,322 42,080 6,527 18,352 42,869 11,476 6,911 9,387 12,738 1,006 9,514 14,059 13,018 17,185 10,050 211 11,276 7,063 3,313 37,363 4,562 24,034 3,837 3,077 47.443 11,530 58,713 47,616 599,859 1,549,844 988,903 310,051 48 4,062 305,941 678,852 9,824 27,978 32,473 64,137 10,484 4,305 15,704 5,566 42,662 6,918 18,850 45,851 14,061 7.475 10,104 13,481 1,106 9,916 14,947 13,630 17,585 10,476 214 11,533 7,843 3,442 40,081 4,644 25,248 3,899 3,443 50,990 11,635 66,838 51,347 694,004 1,683,807 R$ milion 710024 Portfolio Expected Credit Loss Expos 7,520 3,673 3,673 9 7,520 25 184 341 37 79 10 231 11 9 113 175 27 45 6 38 4 102 143 Companies Public sector Energy Petrochemical and Chemical Sundry Private sector Sugar and Alcohol Agribusiness and Fertilizers Food and Beverage Banks and Other Financial Institutions Capital Assets Pulp and Paper Electronic and IT Packaging Energy and Sewage Education Pharmaceuticals and Cosmetics Real Estate Agents Entertainment and Tourism Wood and Furniture Construction Material Steel and Metallurgy Media Mining Infrastructure Work Oil and Gas Petrochemical and Chemical Health Care Insurance and Reinsurance and Pension Plans Telecommunications Clothing and Footwear Trading Transportation Domestic Appliances Vehicles and Autoparts Third Sector Publishing and Printing Commerce. Sundry Industry - Sundry Sundry Services Sundry Individuals Total 471 832 124 144 216 8 6 105 112 (1) 60 68 296 393 64 72 10 3 5 85 61 39 22 74 42 31 128 21 144 42 225 38 267 25 277 2 133 1,556 25 1,041 583 17.359 24,879 12 133 2 64 712 12 541 279 8.306 12,039 Exposure by remaining maturity 06/30/2021 R$ million Remaining maturities of transactions (Net values(1) up to 6 months 6 to 12 months 1 to 5 years above 5 years 288,568 83.242 519,089 305,748 Total 1,196,847 1) Do not consider the amount of credits to be released. 06/30/2021 R$ million Remaining maturities of transactions (Gross values) (1) up to 6 months 6 to 12 months 1 to 5 years above 5 years 313,618 87,168 576,534 353,091 Total 1,330,411 1) Do not consider the amount of credits to be released. Itaú Unibanco 29

Risk and Capital Management - Pillar 3 Overdue exposures R$ million Less than 30 days 31 to 90 days 91 to 180 days 181 to 365 days above 365 days Total 1) According to Circular Letter 4,068, the table follows the same scope as table CR1. 06/30/2021 Gross portfolio Overdue amounts(1) 7,009 14,673 9,550 13,876 1,452 46,560 Exposure by geographical area in Brazil and by country R$ million Total Exposure 06/30/2021 Portfolio Total Exposure (Net Total Exposure values) (Gross values) Southeast South North Northeast Midwest National territory Brazil Argentina Chile Colombia United States Paraguay United Kingdom Swiss Uruguay Other Foreign Total 700,773 109,056 19.158 87,554 50,583 249,963 1,217,097 6,136 181,031 40,197 19,419 13,994 14,092 3,401 22.506 31,881 332,747 1,549,844 774912 123.472 24.196 103,759 58 275 250 603 1,335217 6,517 188,717 49,634 19,556 14,307 14253 3,401 22,909 32 296 348,590 1,683,807 Total defaulted loans and debt securities RS million 06/30/2021 Portfolio Defaulted Expected Credit Exposures Loss 14,007 2,597 710 3,226 1,452 6,365 1,230 339 1,688 882 Southeast South North Northeast Midwest National territory Brazil Argentina Chile Colombia United States Paraguay United Kingdom Swiss Uruguay Other Foreign Total 21,992 55 2,108 566 10,302 46 1,224 339 84 65 72 7 2,887 24,879 57 6 1,737 12,039 1) Considers only Brazilan treasury bonds. Itaú Unibanco 30

Risk and Capital Management - Pillar 3 Largest debtors exposures R$ million 06/30/2021 Loans, Debt Securities and Off-balance sheet exposures (CR1) (1)) Exposure % of portfolio 10 largest debtors 100 largest debtors 324,363 461,471 21.0% 30.0% 1) According to Circular Letter 4,068, the table follows the same scope as table CR1, in which the exposure value considers sovereign debt securities. Restructured exposures R$ million 06/30/2021 Overdue Others Restructured Exposures 5,065 19,764 CRC: Qualitative disclosure related to Credit Risk Mitigation techniques Itaú Unibanco uses guarantees to increase its recovery capacity in operations subject to credit risk. The guarantees used can be financial, credit derivatives, fiduciary, real, legal structures with mitigation power and offsetting agreements. For these guarantees to be considered as credit risk mitigating instruments, it is necessary that they comply with the requirements and determinations of the that regulate them, whether internal or external, and that they are legally enforceable (effective), enforceable and regularly evaluated. The information regarding the possible concentration associated with the mitigation of credit risk considers these different mitigating instruments, segregating by type and by provider. For reasons of confidentiality, the institution determines the non-disclosure of information beyond the classification of the type of guarantor, but ensuring adherence to the general requirements. Financial Guarantees: the borrower or third party highlights a financial asset (deposits, bonds, shares, shares of low-risk equity, among others), in such a way as to guarantee the creditor's reimbursement in case of default. Fiduciary Guarantees and credit derivatives: a third party assumes the responsibility for fulfilling the obligation contracted by the debtor, which falls on the general equity of that third party. Avals, sureties and CDS are examples of these guarantees. Fiduciary guarantees are segregated into the following providers: Legal Entities; Multilateral Development Entities (EMD); Financial Institutions, Sovereigns, National Treasury or Central Bank. Itaú Unibanco also uses credit derivatives to mitigate the credit risk of its securities portfolios. These instruments are priced based on models that use the fair price of market variables, such as credit spreads, recovery rates, correlations and interest rates. They are also segregated into: Legal Entities; Multilateral Development Entities (EMD); Financial Institutions and Sovereigns. Itaú Unibanco 31

Risk and Capital Management - Pillar 3 Real Guarantees: the borrower himself or a third party highlights an asset or a set of assets, movable or immovable, in such a way as to guarantee the reimbursement of the creditor in case of default. Examples of instruments and assets: mortgages on real estate, pledge of goods, fiduciary sale of real estate, vehicles, machinery and equipment. These guarantees are segregated by type: financial collateral, bilateral contracts and assets. Clearing and Settlement of Obligations Agreement and legal structures with mitigating power: the clearing agreement aims to reduce the risk of credit exposure of one party to the other, resulting from transactions entered into between them, so that, in case of maturity, after offsetting, the net amount owed by the debtor to the creditor is identified. It is commonly used in derivative transactions, but it can also cover other types of financial transactions. In legal structures with mitigation power and compensation agreements, mitigation is based on methodologies established and approved by the business units responsible for credit risk management and by the centralized credit risk control area. Such methodologies consider factors related to the legal enforceability of the guarantees, the costs necessary for such and the expected value in the execution, taking into account the volatility and liquidity of the market. To control the mitigating instruments, there is periodic monitoring that monitors the level of compliance with the use of each instrument when compared to internal measurement policies, even including corrective action plans when there is noncompliance, analyzing concentration, types, providers, formalization. The parameters used are: HE (Haircut of execution) which evaluates the probability of success in executing the guarantee, HV (Volatility Haircut) represents the liquidity of the collateral being offered, and LMM (Maximum Mitigation Limit) which is the mitigation ceiling for real guarantees. CR3: Credit Risk mitigation techniques - overview(1) R$ million 06/30/2021 Exposures secured Exposures secured by by Exposures secured by collateral financial credit derivatives guarantees Unsecured Exposures Secured Exposures Loans 616,880 76,842 8,289 68,553 Debt securities 408,945 806 806 in which: Sovereigns 131.505 3,786 753 3,033 in which: Other Debts 4,077 4,077 353,847 1,511,177 Total 13,925 85,511 505 71,586 460 Of which defaulted 4,848 45 1) The mitigating instruments contemplated in this table are those foreseen in BACEN Circular 3,809. Decrease in credit granting observed for legal entities, partially offset by the increase in real estate and credit card. In debt securities and other operations the main variation comes from exposures to governments and central banks. Itaú Unibanco 32

Risk and Capital Management - Pillar 3 CR4: Standardized Approach - Credit Risk exposure and credit risk mitigation effects R$ R$ million 06/30/2021 RWA and RWA density Exposures before CCF and CRM Exposures post-CCF and CRM Asset classes On-balance sheet Off-balance On-balance Off-balance amount (a) sheet amount (b) sheet amount (c) sheet amount (d) RWA (e) Off-balance sheet amount [e/(c+d)] 14.964 499,635 4,928 322 3% 78% 30 16 3,851 35% 89% Sovereigns and their central banks Non-central government public sector entities Multilateral development banks Banks and other Financial Institutions authorized by Brazil Central Bank Corporates Regulatory retail portfolios Secured by residential property Secured by commercial real estate Equity stake Other assets Total 499,635 4,928 322 117,973 378,821 263,790 95,998 221 19,378 80,331 1,461,397 4,490 121,397 299,233 2,721 164 1,878 66,509 62,805 2,721 117,973 378,821 263,790 95,998 221 19,378 80,331 1,461,397 42.454 395 096 225,570 35,498 193 18,612 81,527 817,765 69% 36% 50% 164 2,402 430,437 1,198 135,291 96% 100% 51% CR5: Standardized Approach - exposures by asset classes and risk weights R$ million $ Risk weight (FPR) ) 06/30/2021 Asset classes 0% 10% 20% 35% 50% 75% 85% 100% Others Total credit exposures amount (post CCF and post-CRM) Sovereigns and their central banks 475,708 1.169 17.470 3,875 1,413 499,635 Non-central government public sector entities 297 308 4.271 68 4,944 Multilateral development banks 322 322 Banks and other Financial Institutions authorized by Brazil Central Bank 1,563 57,376 2,898 56.100 1,914 119.851 Corporates 10,004 14,978 216,563 203,164 621 445,330 Regulatory retail portfolios 8,016 45.488 269,553 3,538 326,595 Secured by residential property 92,519 6,121 79 98,719 Secured by commercial real estate 385 385 66 4,884 14,428 19,378 Equity stake Other assets Total 2 81.527 81,529 1,596,688 495,912 58,545 95,417 140,916 269,553 226,718 304,976 5,651 The decrease in the total exposure in tables CR4 and CR5 occurred mainly in the line Sovereigns and their central banks and was partially offset by the increase in real estate credit and retail exposures.

Risk and Capital Management - Pillar 3 Counterparty Credit Risk (CCR) CCRA: Qualitative disclosure related to CCR Counterparty credit risk is the possibility of noncompliance with obligations related to the settlement of transactions that involve the trading of financial assets with a bilateral risk. It encompasses derivative financial instruments, settlement pending transactions, securities lending and repurchase transactions. Itaú Unibanco has well-defined rules for calculating its managerial and regulatory exposure to this risk, and the models developed are used both for the governance of consumption of limits and management of counterparties sub-limits, as well as for the allocation of capital, respectively. The managerial volatility of the potential credit risk (PCR) of derivatives (interpreted as the amount of potential financial exposure that an operation can reach until its maturity) and the volatility of repurchase agreements and foreign exchange transactions are monitored periodically to maintain the exposure at levels considered acceptable by the institution's management. The risk may be mitigated by the use of margin call, initial margin or other mitigating instrument. Currently, Itaú Unibanco does not have impact in the amount of collateral that the bank would be required to provide given a credit rating downgrade. The regulatory exposures of counterparty credit risk are presented as follows. CCR1: Analysis of CCR exposures by approach R$ million 06/30/2021 Replacement cost Potential future exposure Multiplier applied to the calculation of EAD EAD post mitigation RWA SA-CCR Approach 16,657 8,233 1,4 34,846 27,012 CEM Approach Simple Approach for CCR mitigation (for SFTs and asset loans) Comprehensive Approach for CCR mitigation (for SFTs and asset loans) 429,380 12,548 Total 39,560 CCR3: Standardised approach - CCR exposures by regulatory portfolio and risk weights 06/30/2021 RS million Regulatory portfolio Sovereigns Risk weight (FPR) 75% 85% 10% 20% 50% 100% 150% Others Total 0% 118.875 4 118 879 Non-central government public sector entities 21 4 25 Multilateral development banks 63. 211 420 14,508 14 78,153 231.931 16,581 17,128 265 640 Banks and other Financial Institutions authorized by Brazil Central Bank Corporates Regulatory retail portfolios Other Counterparties Total 480 171 878 1,529 414,497 424 14,679 16,602 18,024 464,226 Itaú Unibanco

Risk and Capital Management - Pillar 3 In the tables CCR1 and CCR3 there was a decrease in the exposure of repo operations mainly in Sovereigns and in Banks and other Financial Institutions authorized by Brazil Central Bank. CCR5: Composition of collateral for CCR exposures R$ million 06/30/2021 Collateral used in derivative transactions Collateral used in SFTs and asset loans Fair value of collateral received Fair value of posted collateral Fair value of Fair value of collateral received posted collateral Segregated Unsegregated Segregated Unsegregated Cash - domestic currency Cash - other currencies Domestic sovereign debt Government agency debt Corporate bonds Equity securities Other collateral Total 4,744 156,227 193,260 227 5,537 2,812 44,547 2,487 210,990 154,374 6,007 1 3,233 2,583 - 1,442 22,240 1,950 487 8 4,744 10,163 5,538 395,989 396,722 CCR6: CCR associated with credit derivatives exposures In R$ million 06/30/2021 Protection sold Protection bought 9,126 Notionals Single-name credit default swaps Index credit default swaps Total retum swaps Total notionals 4,771 350 14,592 23,718 5,121 62 299 Fair values Positive fair value (asset) Negative fair value (liability) 394 92 (30) (95) Itaú Unibanco

Risk and Capital Management - Pillar 3 CCR8: CCR associated with Exposures to central counterparties 06/30/2021 R$ million EAD (post-CRM) RWA 4,016 15,697 398 15,197 388 Exposures to qualifying CCPs (QCCPs total) Exposures for trades at QCCPs (excluding initial margin and default fund contributions), of which (i) over-the-counter (OTC) derivatives (ii) Exchange-traded derivatives (iii) Securities financing transactions (iv) Netting sets where cross-product netting has been approved Segregated initial margin Non-segregated initial margin 487 10 13 10,973 3,583 Pre-funded default fund contributions 71 35 Exposures to non-QCCPs (total) Exposures for trades at non-QCCPs (excluding initial margin and default fund contributions), of which (1) over-the-counter (OTC) derivatives (ii) Exchange-traded derivatives (iii) Securities financing transactions (iv) Netting sets where cross-product netting has been approved Segregated initial margin Non-segregated initial margin Pre-funded default fund contributions Increase in exposures for trades at QCCPs, especially in the line of Exchanged-traded derivatives.

Risk and Capital Management - Pillar 3 Securitisation Exposures SECA: Qualitative disclosure requirements related to securitisation exposures Currently, Itaú Unibanco coordinates and distributes issues of securitized securities in the capital market with or without a firm placement guarantee. In case of exercising the firm guarantee, the bank will assume the risk as an investor in the operation. Itaú Unibanco does not act as a sponsoring counterpart of any specific purpose company with the objective of operating in the securitisation market, nor does it manage entities that acquire securities issued or originated by their own. In relation to accounting, it should be noted that (i) assets representing third-party securitisations are accounted for as well as other assets owned by the Bank, according to the brazilian accounting standards; and (ii) securitisation credits originating from Itaú Unibanco's own portfolio remain accounted for in cases of credit assignment with co-obligation. In 2021, Itaú Unibanco did not carry out the sale of credit assets without substantial risk retention and did not assign exposures with substantial risk retention, which have been honored, repurchased or written off as loss. SEC1: Securitisation exposures in the banking book R$ million 06/30/2021 Bank acts as originator Bank acts as sponsor Banks acts as investor Traditional Synthetic Subtotal Traditional Synthetic Subtotal Traditional Synthetic 2,513 Subtotal 2,513 458 Retail (total) - of which residential mortgage credit card other retail exposures re- securitisation Wholesale (total) - of which 458 2,055 2,055 1,353 1,353 loans to corporates 1,353 1,353 commercial mortgage lease and receivables other wholesale re- securitisation SEC2: Securitisation exposures in the trading book In Itaú Unibanco's current securitization portfolio, there are no exposures to be reported in table SEC2. SEC3: Securitisation exposures in the banking book and associated regulatory capital requirements - bank acting as originator or as sponsor In Itaú Unibanco's current securitization portfolio, there are no exposures to be reported in table SEC3. Itaú Unibanco 37

Risk and Capital Management - Pillar 3 SEC4: Securitisation exposures in the banking book and associated capital requirements - bank acting as investor R$ million Total exposures Traditional securitisation Of which securitisation Of which retail underlying Of which wholesale Of which re- securitisation Synthetic securitisation Of which securitisation Of which retail underlying Of which wholesale Of which re- securitisation 06/30/2021 Capital Requirements Exposure values (by risk weight bands) 20%

Risk and Capital Management - Pillar 3 Market Risk MRA: Qualitative disclosure requirements related to market risk Market risk is the possibility of losses resulting from fluctuations in the market values of positions held by a financial institution, including the risk of operations subject to variations in foreign exchange rates, interest rates, equity and commodity prices, as set forth by CMN. Price Indexes are also treated as a risk factor group. The institutional policy for market risk is in compliance with Resolution 4,557 and establishes the management structure and market risk control, which has the function of: Provide visibility and comfort for all senior management levels that market risks assumed must be in line with Itaú Unibanco risk-return objectives; Provide a disciplined and well informed dialogue on the overall market risk profile and its evolution over time; Increase transparency as to how the business works to optimize results; Provide early warning mechanisms to facilitate effective risk management, without obstructing the business objectives; and Monitoring and avoiding the concentration of risks. Market risk is controlled by an area independent of the business units, which is responsible for the daily activities: (i) measuring and assessing risk, (ii) monitoring stress scenarios, limits and alerts, (iii) applying, analyzing and stress testing scenarios, (iv) reporting risk to the individuals responsible in the business units, in compliance with Itaú Unibanco´s governance, (v) monitoring the measures needed to adjust positions and/or risk levels to make them viable, and (vi) supporting the secure launch of new financial products. The market risk management framework categorizes transactions as part of either the Trading Book or the Baking Book, in accordance with general criteria established by CMN Resolution 4,557 and BACEN Circular 3,354. Trading Book is composed of all trades with financial and commodity instruments (including derivatives) undertaken with the intention of trading. Banking Book is predominantly characterized by portfolios originated from the banking business and operations related to balance sheet management, are intended to be either held to maturity, or sold in the medium and in the long term. The market risk management is based on the following key metrics: Value at Risk (VaR): a statistical metric that quantifies the maximum potential economic loss expected in normal market conditions, considering a defined holding period and confidence interval; Losses in Stress Scenarios (Stress Testing): a simulation technique to evaluate the impact, in the assets, liabilities and derivatives of the portfolio, of various risk factors in extreme market situations (based on prospective and historic scenarios); Stop Loss: metrics that trigger a management review of positions, if the accumulated losses in a given period reach specified levels; Concentration: cumulative exposure of certain financial instrument or risk factor calculated at market value ('MtM - Mark to Market'); and Itaú Unibanco 39

Risk and Capital Management - Pillar 3 Stressed VaR: statistical metric derived from VaR calculation, aimed at capturing the biggest risk in simulations of the current trading portfolio, taking into consideration the observable returns in historical scenarios of extreme volatility. In addition to the risk metrics described above, sensitivity and loss control measures are also analyzed. They include: Gap Analysis: accumulated exposure of the cash flows by risk factor, which are marked-to-market and positioned by settlement dates; Sensitivity (DV01 - Delta Variation Risk): impact on the market value of cash flows when a 1 basis point change is applied to current interest rates or on the index rates; and Sensitivities to Various Risk Factors (Greeks): partial derivatives of a portfolio of options on the prices of the underlying assets, implied volatilities, interest rates and time. In an attempt to fit the transactions into the defined limits, Itaú Unibanco hedges its client transactions and proprietary positions, including investments overseas. Derivatives are the most commonly used instruments for carrying out these hedging activities, and can be characterized as either accounting or economic hedge, both of which are governed by institutional regulations at Itaú Unibanco. The structure of limits and alerts is in alignment with the board of directors' guidelines, being reviewed and approved on an annual basis. This structure extends to specific limits and is aimed at improving the process of risk monitoring and understanding as well as preventing risk concentration. Limits and alerts are calibrated based on projections of future balance sheets, stockholders' equity, liquidity, complexity and market volatility, as well as the Itaú Unibanco's risk appetite. The consumption of market risk limits is monitored and disclosed daily through exposure and sensitivity maps. The market risk area analyzes and controls the adherence of these exposures to limits and alerts and reports them timely to the Treasury desks and other structures foreseen in the governance. Itaú Unibanco uses proprietary systems to measure the consolidated market risk. The processing of these systems takes place in an access-controlled environment, being highly available, which has data safekeeping and recovery processes, and counts on an infrastructure to ensure the continuity of business in contingency (disaster recovery) situations. Itaú Unibanco 40

Risk and Capital Management - Pillar 3 MR1: Market risk under standardized approach R$ million Risk factors Interest Rates Fixed rate denominated in reais (RWAJUR1) Foreign exchange linked interest rate (RWA JUR2) Price index linked interest rate (RWAJUR3) Interest rate linked interest rate (RWAJUR4) Stock prices (RWAACS) Exchange rates (RWACAM) Commodity prices (RWACOM) Total 06/30/2021 RWAmpad 27,922 8,139 10,103 9,680 975 1,074 2,005 31,976 There is a certain stability in the Market Risk-Weighted Assets under the standardized approach (RWAMPAD) (compared to the previous quarter), with a slight reduction as a result of lower interest exposure in external units. MRB: Qualitative disclosures on market risk in the Internal Models Approach (IMA) In the internal models approach, the stressed VaR and VaR models are used. These models are applied to operations in the Trading Book and Banking Book. For the Trading Book, the risk factors considered are: interest rates, inflation rates, exchange rates, stocks and commodities. For the Banking Book, exchange rates and commodities are considered. The VaR and stressed VaR models are used in the companies of the prudential conglomerate that are presented in the following table:

Risk and Capital Management - Pillar 3 Institution A1 Hedge Orange Master Fundo de Investimento Multimercado Aj Tĺtulos Públicos Fundo de Investimento Renda Fixa Referenciado DI Banco Investored Unibanco S.A. Banco Itaú Argentina S.A. Banco Itaú BBA S.A. Banco Itaú Consignado S.A. Banco Itaú Veĺculos S.A. Banco ItauBank S.A. Banco Itaucard S.A. Banco Itauleasing S.A. Dibens Leasing S.A. - Arrendamento Mercantil Financeira Itaú CBD S.A. Crédito, Financiamento e Investimento Fundo A1 Hedge Orange Fundo de Investimento em Cotas de Fundos de Investimento Multimercado Fundo De Invest Dir Creditórios Não Padron NPL II Fundo de Investimento em Direitos Creditórios Não-Padronizados Barzel Fundo de Investimento em Direitos Creditórios Rede Fundo em Direitos Creditórios Cielo Emissores | Fundo Fortaleza de Investimento Imobiliário Fundo Kinea Ações Goal Performance Goal Performance 11 Hipercard Banco Múltiplo S.A. Intrag Distribuidora de Tĺtulos e Valores Mobiliários Ltda. Tresolve Companhia Securitizadora de Créditos Financeiros S.A. Itaú Administradora de Consórcios Ltda. Itaú Bank & Trust Bahamas Ltd. Itaú Bank & Trust Cayman Ltd. Itaú Bank, Ltd. Itaú BBA USA Securities Inc. Itaú Cia. Securitizadora de Créditos Financeiros Itaú Corretora de Valores S.A. Itaú Distribuidora de Tĺtulos e Valores Mobiliários S.A. Itaú Kinea Private Equity Multimercado Fundo de Investimento em Cotas de Fundos de Investimento Crédito Privado Itaú OT Tĺtulos Públicos Renda Fixa Referenciado Di Fundo de Investimento em Cotas de Fundos de Investimento Itaú Unibanco Holding S.A. Itaú Unibanco Holding S.A., Grand Cayman Branch Itaú Unibanco S.A. Itaú Unibanco S.A., Grand Cayman Branch Itaú Unibanco S.A., Nassau Branch Itaú Unibanco Veĺculos Administradora de Consórcios Ltda. Itaú Valores S.A. Itauvest Distribuidora de Tĺtulos e Val. Mobiliários S.A. ITB Holding Ltd. Kinea Ações Fundo de Investimento em Ações Kinea CO-investimento Fundo de Investimento Imobiliario Kinea 1 Private Equity FIP Multiestrategia Kinea KP Fundo de Investimento Multimercado Crédito Privado Kinea Ventures FIP Licania Fund Limited Luizacred S.A. Sociedade de Crédito, Financiamento e Investimento Microinvest S.A. Soc. de Crédito a Microempreendedor Oiti Fundo de Investimento Multimercado Crédito Privado Investimento no Exterior Redecard Instituição de Pagamento S.A. RT Itaú DJ Tĺtulos Públicos Fundo de Investimento Renda Fixa Referenciado DI RT Scala Renda Fixa - Fundo de Investimento em Cotas de Fundos de Investimento RT Voyager Renda Fixa Crédito Privado - Fundo de Investimento Tarumã Fundo Incentivado de Investimento em Debêntures de Infraestrutura Renda Fixa Crédito Privado VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR VaR and Stressed VaR Itaú Unibanco 42

Risk and Capital Management - Pillar 3 Itaú Unibanco, for regulatory purposes, uses the historical simulation methodology to calculate the VaR and Stressed VaR. This methodology uses the returns observed in the past to calculate the gains and losses of a portfolio over time, with a 99% confidence interval and a holding period of at least 10 days. On June 30, 2021, VaR represented 49% of the capital requirement, while the stressed VaR represented 51%. The same methodology is used for management purposes, that is, there are no differences between the managerial and regulatory models. In relation to the VaR model, the historical returns are daily updated. Itaú Unibanco uses in its VaR model both the unweighted approach, in which historical data have the same weight, and the weighted by the volatility of returns. For the calculation of volatilities, the Exponentially Weighted Moving Average method is used. The Historical VaR methodology with 10-day maintenance periods assumes that the expected distribution for possible losses and gains for the portfolio can be estimated from the historical behavior of the returns of the market risk factors to which this portfolio is exposed. The returns observed in the past are applied to current operations, generating a distribution of probability of losses and simulated gains that are used to estimate the Historical VaR, according to the 99% confidence level and using a historical period of 1,000 days. Losses and gains from linear operations are calculated by multiplying mark-to-market by returns, while non-linear operations are recalculated using historical returns. The returns used in simulating the movements of risk factors are relative. Regarding the Stressed VaR model, the calculation is performed for a time horizon of 10 working days, considering the 99% confidence level and simple returns in the historical period of one year. The historical stress period is periodically calculated for the period since 2004 and can be revised whenever deemed necessary. This can occur when the composition of Itaú Unibanco's portfolios changes significantly, when changes are observed in the results of the simulation of historical returns or when a new market crisis occurs. Losses and gains from linear operations are calculated by multiplying mark to market by returns, while non-linear operations are recalculated using historical returns. In addition to the use of VaR, Itaú Unibanco carries out daily risk analysis in extreme scenarios through a diversified framework of stress tests, in order to capture potential significant losses in extreme market situations. The scenarios are based on historical, prospective crises and predetermined shocks in risk factors. One factor that has a great influence on the results of the tests, for example, is the correlation between the assets and the respective risk factors, and this effect is simulated in several ways in the various scenarios tested. In order to identify its greatest risks and assist in the decision-making of treasury and senior management, the results of stress tests are assessed by risk factors, as well as on a consolidated basis. The effectiveness of the VaR model is proven by backtesting techniques, by comparing hypothetical and actual daily losses and gains, with the estimated daily VaR, according to BACEN Circular 3,646. The number of exceptions to the established VaR limits must be compatible, within an acceptable statistical margin, with three different confidence intervals (99%, 97.5% and 95%), in three different historical windows (250, 500 and 750 working days). This includes nine different samples, therefore ensuring the statistical quality of the historical VaR hypothesis. Itaú Unibanco has a set of processes, which are periodically executed by the internal control teams, whose objective is to independently replicate the metrics that influence market risk capital by internal models. In addition to the results of the periodic processes, Itaú Unibanco assesses the process of measuring time horizons by risk factors and the estimate of the stress period for calculating the stressed VaR. The validation of the internal model includes several topics considered essential for the critical analysis of the model, such as, the evaluation of the model's limitations, the adequacy of the parameters used in the volatility estimate and the comprehensiveness and reliability of the input data. Itaú Unibanco

Risk and Capital Management - Pillar 3 MR2: RWA flow statements of market risk exposures under an IMA Exposures subject to market risk The following table presents the exposures subject to market risk in the internal models approach, for calculating the capital requirement.£ R$ million RWAMINT - 03/31/2021 Movement in risk levels Updates/changes to the internal model Methodology and regulation Acquisitions and disposals Foreign exchange movements Other RWA - 06/30/2021 MINT VaR Stressed VaR 7,780 (62) Other 10,906 6,541 Total RWA, MINT 25,227 (394) (332) 475 (769) (1,675) 9,231 (294) (1,675) 22,864 6,684 6,949 The decrease in RWAMINT compared to the previous quarter was mainly due to the increase in the effect of diversification of the positions held by Itaú Unibanco. MR3: IMA values for trading portfolios The following table presents the VaR and stressed VaR values determined by the internal market risk models. 06/30/2021 264 129 37 R$ million VaR (10 days, 99%) Maximum value Average value Minimum value Quarter end Stressed VaR (10 days, 99%) Maximum value Average value Minimum value Quarter end 37 448 191 42 117 VaR and stressed VaR at the end of the quarter decreased from the previous quarter due to the reduction in interest rate exposure. Itaú Unibanco

Risk and Capital Management - Pillar 3 MR4: Comparison of VaR estimates with gains/losses Backtesting The effectiveness of the VaR model is validated by backtesting techniques, comparing daily hypothetical and actual results with the estimated daily VaR. The daily VaR is calculated over a one-day maintenance horizon, according to the 99% confidence level and using a historical period of 1,000 days. The percentage of capital requirement associated with this model is 100%. The backtesting analysis presented below considers the ranges suggested by the Basel Committee on Banking Supervision (BCBS). The ranges are divided into: Green (0 to 4 exceptions): backtesting results that do not suggest any problem with the quality or accuracy of the adopted models; Yellow (5 to 9 exceptions): intermediate range group, which indicates an early warning monitoring and may indicate the need to review the model; and Red (10 or more exceptions): need for improvement actions. The following chart shows the comparison between VaR and actual and hypothetical results: The Backtesting presented zero exceptions in relation to the hypothetical results and zero exceptions in relation to the actual results in the period. This number of exceptions falls within the green range. The actual results do not include fees, brokerage fees and commissions. There are no profit reserves. Itaú Unibanco

Risk and Capital Management - Pillar 3 Total Exposure associated with Derivatives The main purpose of the derivative positions is to manage risks in the Trading Book and in the Banking Book in the corresponding risk factors. Derivatives: Trading and Banking R$ million 06/30/2021 With Central Counterparty Without Central Counterparty Onshore Offshore Onshore Offshore Risk Factors Long Short Long Short Long Short Long Short 255,899 (156,855) 12,961 (17,727) 77,962 (81,440) 66,396 (154,205) Interest Rates Foreign Exchange Equities 176, 174 (171,953) 47,893 (42,837) 39,663 (51,599) 356 859 (343,645) 11,623 (12,246) 512 (333) 25 (4,809) Commodities 1,186 (1,175) 1 43 Itaú Unibanco

Risk and Capital Management - Pillar 3 IRRBBA: IRRBB risk management objectives and policies BACEN's (Central Bank of Brazil) Circular 3,876, published in January 2018, states on methodologies and procedures for evaluation of the capital adequacy, held to cover interest rates risk from instruments held in the banking book. For the purposes of this Circular, are defined: DEVE (Delta Economic Value of Equity) is defined as the difference between the present value of the sum of repricing flows of instruments subject to IRRBB in a base scenario, and the present value of the sum of repricing flows of the same instruments in an interest-rate shocked scenario; DNII (Delta Net Interest Income) is defined as the difference between the result of financial intermediation of instruments subject to IRRBB in a base scenario, and the result of financial intermediation of the same instruments in an interest-rate shocked scenario. The sensibility analysis introduced here are just a static evaluation of the portfolio interest rate exposure, and, therefore, don´t consider the dynamic management of the treasury desk and risk control areas, which hold the responsibility for measures to mitigate risk under an adverse situation, minimizing significant losses. Moreover, it is highlighted, though, the results presented do not translate into accountable or economic results for certain, because this analysis has, only, an interest rate risk disclosure purpose and to demonstrate the principle protection actions, considering the instruments fair value, apart from any accounting practices adopted by Itaú Unibanco. The institution uses an internal model to measure DEVE and DNII. DEVE results do not represent immediate impact in the stockholders' equity. Meanwhile, DNII results indicate potential volatility in the projected interest rates results. In compliance with the circular 3,876, the following demonstrates qualitative and quantitative details of risk management for IRRBB in Itaú Unibanco. Framework and Treatment Interest rate risk in the banking book refers to the potential risk of impact on capital sufficiency and/or on the results of financial intermediation due to adverse movements in interest rates, taking into account the principal flows of instruments held in the banking book. The main point of assets and liabilities management is to maximize the risk-return ratio of positions held in the banking book, taking into account the economic value of these assets/liabilities and the impact on actual and future bank's results. The interest rate risk managing on transactions held in the banking book occurs within the governance and hierarchy of decision-making bodies and under a limits structure and alerts approved specifically for these purpose, which is sensitive due to different levels and classes of market risk. The management structure of IRRBB has it owns risk policies and controls intended to ensure adherence to the bank's risk appetite. The IRRBB framework has granular management limits for several other risk metrics and consolidated limits for DEVE and DNII results, besides the limits associated with stress tests. The asset and liability management unit is responsible for managing timing mismatches between asset and liability flows, and minimizes interest rate risk by through strategies as economic hedge and accounting hedge. All the models associated with IRRBB have a robust independent validation process and are approved by a CTAM (Technical Model Assessment Commission). In addition, all the models and processes are assessed by internal audit. Itaú Unibanco 47

Risk and Capital Management - Pillar 3 The interest rate risk framework in the banking book uses management measurements that are calculated daily for limit control. The DEVE and DNII metrics are calculated according to the risk appetite limits and the other risk metrics in terms of management risk limits. In the process of managing interest rate risk of the banking book, transactions subject to automatic options are calculated according to internal market models which split the products, as far as possible, into linear and non-linear payoffs. The linear payoffs are treated similarly to any other instruments without options, and for non-linear payoffs an additional value is computed and added on the DEVE and DNII metrics. In general terms, transactions subject to behavioral options are classified as deposits with no contractual maturity date defined or products subject to early repayment. Non-maturity deposits are classified according to their nature and stability to guarantee compliance with regulatory limits. A survival analysis model treats the products subject to prepayment, using the historical dataset to calibrate its parameters. The instruments flows with homogeneous characteristics are adjusted by specific models to reflect, in the most appropriate way, the repricing flows of the instruments. The banking book consists of asset and liability transactions originating in different commercial channels (retail and wholesale) of Itaú Unibanco. The market risk exposures inherent in the banking book consists of various risk factors, which are primary components of the market in price formation. IRRBB also includes hedging transactions intended to minimize risks deriving from strong fluctuations of market risk factors and their accounting asymmetries. Market risk generated from structural mismatches is managed by a variety of financial instruments, such as exchange-traded and over-the-counter derivatives. In some cases, operations using derivative financial instruments can be classified as accounting hedges, depending on their risk and cash flow characteristics. In these cases, the supporting documentation is analyzed to enable the effectiveness of the hedge and other changes in the accounting process to be continuously monitored. The accounting and administrative procedures for hedging are defined in BACEN Circular 3,082. The IRRBB model includes a series of premises: DEVE and DNII are measured on the basis of the cash flows of the banking book instruments, broken down into their risk factors to isolate the effect of the interest rate and the spread components; For non-maturity deposits, the models are classified according to their nature and stability and distributed over time considering the regulatory limits; The institution uses survival analysis models to handle credit transactions subject to prepayment, and empirical models for transactions subject to early redemption; The medium-term repricing attributed to non-maturity deposits is defined as 1.95 years; The maximum-term repricing attributed to non-maturity deposits is defined as 31.59 years. The article 39 of the circular defines the need to publish DEVE and DNII, using the standard shock scenarios described in article 11. Itaú Unibanco has opted to an additional disclosure of the metrics above, considering the internal scenarios, because of the understanding that the standard approach shocks and is application are too conservative. The institution understands that is owns internal scenarios, defined by statistical methodologies, which consider the interest rate historical distribution behavior represent in a more appropriate way the potential risk embedded in the interest rates volatility. Additionally, internal model is more adherent with the way Itaú Unibanco manages its own risks. Itaú Unibanco 4

Risk and Capital Management - Pillar 3 The table below are presented the main results due the change in the interest rates over the banking book in the standardized scenarios, and, also, in the internal scenarios. It is important to note that, following the normative rules, the potential losses are represented by positive values and potential gains by negative values (between parentheses). Parallel Up: increasing in the short-term and in the long-term interest rates; Parallel Down: decreasing in the short-term and in the long-term interest rates; Short-term increase: increasing in the short-term interest rates; Short-term reduction: decreasing in the short-term interest rates; Steepener: decreasing in the short-term interest rates and increasing the in the long-term interest rates; Flattener: increasing in the short-term interest rates and decreasing the in the long-term interest rates. IRRBB1 - Quantitative information on IRRBB Potential Loss of Instruments Classified in the Banking Book arising from Interest Rate Variation Scenarios(1) (Losses are represented by positive values, while gains are represented by negative values between parentheses) R$ million 06/30/2021 03/31/2021 AEVE ANII AEVE ANII Scenarios Internal Shocks (3) Internal Standard Shocks (2) Standard Shocks (2) Standard Shocks (2) Internal Shocks (3) Standard Shocks (2) Internal Shocks (3) Shocks (3) Parallel Up Parallel Down Short rate Up Short rate Down Steepener Flattener Maximum Tier1 274 1,329 (1,063) 446 (1,167) 1,469 (1,391) (140) 8.940 (9,985) 6,814 (7,337) (2,072) 3,865 8,940 3,129 (3,622) 2,300 (2,859) (593) 1,631 3,129 141,674 6,942 (7,386) 5,224 (5,602) (1,247) 3,024 6,942 2,465 (1,511) 1,858 (1,327) (461) 903 2,465 1,329 446 1,469 274 139,552 1) Losses in variation measurements are shown as positive values, as per Art. 13 $3° of Circular 3,876. 2) Values are calculated using internal models and standard regulatory shocks, as per Art. 39 $1º Il of Circular 3,876. 3) Values are calculated using internal models and shocks, as per Art. 7° of Circular 3,876. The maximum variation of ?EVE, with internal shocks, was R$ 3,129 million as of June 30, 2021, considering the Parallel Up Scenario shocks, an increase of 27% when compared to March 31, 2021. For the outlier test, the maximum variation of the ?EVE, with standardized shocks was R$ 8,940 million as of June 30, 2021, corresponding to a potential loss of 6% of Tier I, which is less than 15% - percentage that defines the institution as outlier (according to Art. 44 of Circular 3,876). The ?NII, with internal shocks, for a horizon of a year, has maximum loss of R$ 446 million in the Parallel High Scenario. Itaú Unibanco 49

Risk and Capital Management - Pillar 3 Other Risks Insurance products, pension plans and premium bonds risks Products that compose portfolios of insurance companies of Itaú Unibanco are related to life and elementary insurance, as well as pension plans and premium bonds. The main risks inherent in these products are described below and their definitions are given in their respective chapters. Underwriting Risk: possibility of losses arising from insurance products, pension plans and premium bonds that go against institution's expectations, directly or indirectly associated with technical and actuarial bases used for calculating premiums, contributions and technical provisions; Market Risk; Credit Risk; Operational risk; Liquidity risk. In line with domestic and international best practices, Itaú Unibanco has a risk management structure which ensures that risks resulting from insurance, pension and special savings products are properly assessed and reported to the relevant forums. The process of risk management for insurance, pensions and premium bond plans is independent and focus on the special nature of each risk. The aim of Itaú Unibanco is to ensure that assets serving as collateral for long-term products, with guaranteed minimum returns, are managed according to the characteristics of the liabilities, so that they are actuarially balanced and solvent over the long term. Social and Environmental Risk Itaú Unibanco understands social and environmental risk as the risk of potential losses due to exposure to social and environmental events arising from the performance of its activities, according to CMN Resolution 4,327/14. The Social and Environmental Responsibility and Sustainability Policy (PRSA) establishes the guidelines, strategies and main principles for social and environmental management, starting from institutional issues, and addressing, through specific procedures, the most relevant risks to the institution's operation. Mitigation actions on social and environmental risk are carried out through the mapping of processes, risks and controls, the monitoring of new regulations on the subject, and the listing of occurrences in internal databases. In addition to identification, the stages of prioritization, risk response, monitoring and reporting of the assessed risks complement the management of this risk at Itaú Unibanco. The management of this risk is carried out by the first line of defense, business areas that manage it in their daily activities, following the PRSA guidelines, manuals and specific procedures supplemented by the specialized assessment of the dedicated teams of Corporate Compliance, Modeling and Credit Risk and Legal and Institutional department, which work integrated in the management of all the dimensions of Social and Environmental Risk linked to the conglomerate activities. Business units also have the governance for the approval of new products and services, which includes the social and environmental risk assessment, that ensures the compliance in the new products and processes employed by the institution, as well as with specific social and environmental processes applicable to the Itaú Unibanco

Risk and Capital Management - Pillar 3 institution's own operation (equity, branch infrastructure and technology), suppliers, credit, investments and key subsidiaries. The second line of defense, in turn, is represented by Modeling and Credit Risk, Internal Controls, as well as Compliance, through the Social and Environmental Risk Management, which supports and ensures the governance of the activities of the first line. The third line of defense, composed of Internal Audit, acts independently, carrying out the mapping and assessment of the risk's management, controls and governance. The Social and Environmental Risk Governance also includes the Social and Environmental Risk Committee, which is primarily responsible for debating and deciding on institutional and strategic issues, as well as deciding on products, operations, services, among others, that involve Social and Environmental Risk, including Climate Risk. Itaú Unibanco constantly seeks to evolve in the management of social and environmental risk, always attentive to the challenges demands of society. Therefore, among other actions, Itaú Unibanco has assumed and incorporated into Itaú Unibanco's internal processes a number of national and international voluntary commitments and pacts aimed at integrating social, environmental and governance aspects into Itaú Unibanco business. The main ones are the Principles for Responsible Investment (PRI), the Charter for Human Rights - Ethos, the Equator Principles (EP), the Global Pact, the Carbon Disclosure Project (CDP), the Brazilian GHG Protocol Program, the Pacto Nacional para Erradicação do Trabalho Escravo (National Pact for Eradicating Slave Labor), the Task Force on Climate-Related Financial Disclosures (TCFD), among others. Itaú Unibanco efforts to increase the knowledge of the assessment of the social and environmental criteria have been recognized as models in Brazil and abroad, as shown by the recurring presence of the institution in the major sustainability indexes abroad, such as the Dow Jones Sustainability Index, and recently, in Sustainability Index Euronext Vigeo - Emerging 70, and in Brazil, for example in the Corporate Sustainability Index, as well as the numerous prizes which Itaú Unibanco has been awarded. Model Risk The model risk arises from the incorrect development or maintenance of models, such as mistaken assumptions, and inappropriate use or application of the model. The use of models can lead to decisions that are more accurate and therefore it is a major practice in the institution. The models have supported strategic decisions in several contexts, such as credit approval, pricing, volatility curve estimation, calculation of capital, among others. Due to the increasing use of models, driven by the application of new technologies and the expansion of data use, Itaú Unibanco has improved its governance in relation to its development, implantation, use and monitoring, through the definition of guidelines, policies and procedures aimed at assuring the quality and mitigation of the associated risks. Regulatory or Compliance Risk Regulatory or Compliance risk is the risk associated with any nature, financial losses or damage to reputation, arising from non-compliance with external or internal standards, commitments to regulators, or other commitments undertaken voluntarily by adhering codes of self-regulation, methods or codes of conduct related to the activities of the Conglomerate. This risk is managed through a structured process aimed at identifying changes in the regulatory environment, analyzing their impacts on the departments of the institution and monitoring the actions directed at adherence to the regulatory requirements and other commitments mentioned above. This structured process includes the following actions: (i) to understand the changes in the regulatory environment; (ii) to monitor regulatory trends; (iii) to care for the relationship between the institution and the regulator, self-regulatory bodies and the representation entity; (iv) to monitor action plans on regulatory or self-regulatory compliance; (v) to coordinate a program to comply with significant norms, such as Integrity and Ethics; and (vi) to report regulatory issues in Operational and Compliance Risk forums, according to the structure of committees established in internal policies. Itaú Unibanco

Risk and Capital Management - Pillar 3 Reputational Risk Itaú Unibanco understands reputational risk as the risk arising from internal practices and/or external factors that may generate a negative perception of Itaú Unibanco by customers, employees, shareholders, investors, regulatory bodies, government, suppliers, the press and the society in general. It can impact the bank's reputation, the value of its brand and/or result in financial losses. Besides, this can affect the maintenance of existing business relationships, access to sources of fundraising, the attraction of new business and talent to compose the company's staff or even the license to operate. The institution believes that its reputation is extremely important for achieving its long-term goals, which is why it seeks the alignment of the speech, the action and the ethical and transparent practice, essential to raise the confidence of Itaú Unibanco's stakeholders. Itaú Unibanco's reputation depends on its strategy (vision, culture and skills) and derives from direct or indirect experience of the relationship between Itaú Unibanco and its stakeholders. Since the reputational risk directly or indirectly permeates all operations and processes of the institution, Itaú Unibanco's governance is structured in a way to ensure that potential risks are identified, analyzed and managed still in the initial phases of its operations and analysis of new products, including the use of new technologies. The treatment given to reputational risk is structured by means of many processes and internal initiatives, which, in turn, are supported by internal policies, and their main purpose is to provide mechanisms for the monitoring, management, control and mitigation of the main reputational risks. Among them are (i) risk appetite statement; (ii) process for the prevention and fight against unlawful acts; (iii) crisis management process and business continuity; (iv) processes and guidelines of the governmental and institutional relations; (v) corporate communication process; (vi) brand management process; (vii) ombudsman offices initiatives and commitment to customer satisfaction; and (vii) ethics guidelines and prevention of corruption. Financial institutions play a key role in preventing and fighting illegal acts, in particular money laundering, terrorist financing and fraud, in which the challenge is to identify and suppress increasingly sophisticated operations that seek to conceal the origin, location, disposition, ownership and movement of goods and money derived, directly or indirectly, from illegal activities. Itaú Unibanco has introduced a corporate policy in order to prevent its involvement in illegal acts and to protect its reputation and image towards employees, clients, strategic partners, suppliers, service providers, regulators and society, through a governance structure based on transparency, strict compliance with rules and regulations, including BACEN Circular 3,978/20 among others, and cooperation with police and judicial authorities. It also seeks a continuously alignment with local and international best practices for preventing and fighting against illegal acts, through investing and training eligible employees. In compliance with the guidelines of this corporate policy, Itaú Unibanco established a program to prevent and fight against illegal acts based on the following pillars: Policies and Procedures; Client Identification Process; Know Your Customer (KYC) Process; Know Your Partner (KYP) Process; Know Your Supplier (KYS) Process; Know Your Employee (KYE) Process; Itaú Unibanco

Risk and Capital Management - Pillar 3 Assessment of New Products and Services; Compliance with Sanctions; Monitoring, Selection and Analysis of Suspicious Operations or Situations; Reporting Suspicious Transactions to the Regulatory Bodies; and Training. This program applies to the entire institution, including subsidiaries and affiliates in Brazil and abroad. The preventing and combating unlawful acts governance is carried out by the Board of Directors, Audit Committee, Operational Risk Committee, Risk and Capital Management Commitee and Anti-Money Laundering Committees. The document that presents the guidelines established in the corporate program to prevent and combat unlawful acts may be seen on the www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Policies, Corporate Policy for Prevention and Fight Against Illegal Acts. In addition, Itaú Unibanco has been developing various data analysis models to improve customer risk classification, transaction monitoring and KYC methodology to provide greater accuracy in its analysis and to decrease false-positives. Itaú Unibanco has also been innovating its modeling solutions using new methods based on machine learning techniques to identify potentially suspicious activities. Moreover, Itaú Unibanco is committed to protecting corporate information and ensuring client and general public privacy in any transactions. To this end, it has a Corporate Information Security Policy and Cyber Secutity and has a monitoring process and a control structure that covers technology, business areas and international units, adhering to principal regulatory bodies and external audits, and best market practices and certifications. Additionally, a Security Operation Center (SOC) that works 24/7 contributes to the cyber security of Itaú Unibanco's electronic channels and IT infrastructure, to the monitoring of operations and thus the minimization of the risk of a security incident. The Corporate Information Security and Cyber Security Policy can be viewed on the website www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Policies, Corporate Policy on Information Security and Cyber Security. Country Risk The country risk is the risk of losses related to non-compliance with obligations in connection with borrowers, issuers, counterparties or guarantors, as a result of political-economic and social events or actions taken by the government of the country. Itaú Unibanco has a specific structure for the management and control of country risk, consisting of corporate bodies and dedicated teams, with responsibilities defined in policies. The institution has a structured and consistent procedure, including: (i) establishment of country ratings; (ii) determination of limits for countries; (iii) monitoring the use of limits. Business and Strategy Risk Business and strategy risk is the risk of a negative impact on the results or capital as a consequence of a faulty strategic planning, the making of adverse strategic decisions, the inability of Itaú Unibanco to implement the proper strategic plans and/or changes in its business environment. Itaú Unibanco

Risk and Capital Management - Pillar 3 Itaú Unibanco has implemented many mechanisms that ensure that both the business and the strategic decision-making processes follow proper governance standards, have the active participation of executives and the Board of Directors, are based on market, macroeconomic and risk information and are aimed at optimizing the risk-return ratio. Decision-making and the definition of business and strategy guidelines, count on the full engagement of the Board of Directors, primarily through the Strategy Committee, and of the executives, through the Executive Committee. In order to handle risk adequately, Itaú Unibanco has governance and processes to involve the Risk Area in business and strategy decisions, so as to ensure that risk is managed and decisions are sustainable in the long term. They are: (i) qualifications and incentives of board members and executives; (ii) budget process; (iii) product assessment; (iv) evaluation and prospecting of proprietary mergers and acquisitions; and (v) a risk appetite framework which, for example, restricts the concentration of credit and exposure to specific and material risks. Contagion Risk Contagion Risk is the possibility of losses occurring for entities that are part of the Prudential Conglomerate as a result of financial support to unconsolidated entities, in a stressful situation, in the absence or in addition to the obligations provided for in the contract. Itaú Unibanco has a structure for risk management and control, a dedicated team and a policy that defines roles and responsibilities. This structure covers (i) the identification of entities in relation to the potential generation of contagion risk, (ii) the assessment of risks in relationships, (iii) the monitoring, control and mitigation of contagion risk, (iv) the assessment of impact on capital and liquidity and (v) reports. It is part of the scope of contagion risk governance: Related Party audiences, mainly composed of controllers, controlled and related entities (as defined in Res. 4,693 / 18), foundations, investments in non-consolidated entities, suppliers of critical products and services, assigness, buyers and sellers of relevant assets, third parties with products distributed by Itaú Unibanco and third parties to whom Itaú Unibanco distributes products, besides all the analysis of the international Units. Operational Risk Operational risk is defined as the possibility of losses arising from failure, deficiency or inadequacy of internal process, people or systems or from external events that affect the achievement of strategic, tactical or operational objectives. It includes legal risk associated with inadequacy or deficiency in contracts signed by the institution, as well as penalties due to noncompliance with laws and punitive damages to third parties arising from the activities undertaken by the institution. Itaú Unibanco internally classifies its risk events in: Internal fraud; External fraud; Labor claims and deficient security in the workplace; Inadequate practices related to clients, products and services; Damages to own physical assets or assets in use by Itaú Unibanco; Itaú Unibanco

Risk and Capital Management - Pillar 3 Interruption of Itaú Unibanco's activities; Failures in information technology (IT) systems, processes or infrastructure; Failures in the performance, compliance with deadlines and management of activities at Itaú Unibanco. Operational risk management includes conduct risk, which is subject to mitigating procedures to assess product design (suitability) and incentive models. The inspection area is responsible for fraud prevention. Irrespective of their origin, specific cases may be handled by risk committees and integrity and ethics committees. Itaú Unibanco has a governance process that is structured through forums and corporate bodies composed of senior management, which report to the Board of Directors, with well-defined roles and responsibilities in order to segregate the business and management and control activities, ensuring independence between the areas and, consequently, well-balanced decisions with respect to risks. This is reflected in the risk management process carried out on a decentralized basis under the responsibility of the business areas and by a centralized control carried out by the internal control, compliance and operational risk department, by means of methodologies, training courses, certification and monitoring of the control environment in an independent way. The managers of the executive areas use corporate methods constructed and made available by the internal control, compliance and operational risk area. Among the methodologies and tools used are the self-evaluation and the map of the institution's prioritized risks, the approval of processes, products, and system development products and projects, the monitoring of key risk indicators that and the database of operational losses, guaranteeing a single conceptual basis for managing processes, systems, projects and new products and services. Within the governance of the risk management process, regularly, the consolidated reports on risk monitoring, controls, action plans and operational losses are presented to the business area executives. In line with CMN Resolution 4,557, the document 'Public Report - Integrated Management of Operational Risk / Internal Controls/Compliance', summarized version of the institutional operational risk management policy can be found on the website www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Reports. Crisis Management and Business Continuity Itaú Unibanco's Business Continuity Program's purpose is to protect its employees, ensure the continuity of the critical functions of its business lines and sustain both the stability of the markets in which it operates and the confidence of its customers and strategic partners in its provision of services and products. It establishes the Business Continuity Plan (BCP), which consists of modular procedures that are available for use in the event of incidents. The descriptions/characteristics of the existing plans are: Disaster Recovery: it aims to ensure the availability and integrity of Information Technology resources and communication in the event of a failure in the primary Data Center to maintain the processing of critical systems; Workplace Contingency: alternative facilities to perform the activities in the event the administrative buildings become unavailable; Operational Contingency: alternatives to carry out critical processes whether they are systemic, procedural or emergency responses. In order to keep the continuity solutions aligned with the business requirements (processes, minimum resources, legal requirements, etc) the Program applies the following tools to assess the institution: Itaú Unibanco

Risk and Capital Management - Pillar 3 Business Impact Analysis (BIA): evaluates the criticality and resumption requirement of the processes that support the delivery of products and services. Threats and Vulnerabilities Analysis (AVA): identification of threats near to Itaú Unibanco's buildings. Considering the dependence that some processes have on third-party services, the Business Continuity Program conducts an assessment of the risk of unavailability of services provided with a view to resilience to threats of interruption. The institution has a Crisis Management Program, which is aimed at managing business interruption events, natural disasters, impacts of an environmental, social, and infrastructure/operational (including information technology) or of any other nature that jeopardize the image and reputation and/or viability of Itaú Unibanco's processes with its employees, clients, strategic partners and regulators, with timely and integrated responses. The Program establishes a frequent flow of acculturation with the company's senior management, as well as a constant analysis of high-impact scenarios and events to establish response plans in line with current threats. To assess efficiency and identify points for improvement in crisis response plans, tests are carried out at least once a year. Independent Validation of Risk Models Itaú Unibanco validates the processes and risk models independently. This is done by a department which is separate from the business and risk control areas, to ensure that its assessments are independent. The validation method, defined in an internal policy, meets regulatory requirements such as those of BACEN Circulars 3,646 and 3,674 and Resolutions 2,682 and 4,557. The validation stages include: Verification of mathematical and theoretical development of the models; Qualitative and quantitative analysis of the models, including the variables, construction of an independent calculator and the use of appropriate technical; When applicable, comparison with alternative models and international benchmarks; Historical Backtesting of the model; The correct implementation of the models in the systems used. Additionally, the validation area assesses the stress testing program. The performance of the independent validation area and the validation of the processes and models are assessed by Internal Audit and reported to the specific senior management committees. Action plans are prepared to address opportunities identified during the independent validation process, and are monitored by the 3 lines of defense and by senior management until the conclusion. Itaú Unibanco 56

Risk and Capital Management - Pillar 3 Glossary of Acronyms A ASF - Available Stable Funding AT1 - Additional Tier 1 Capital AVA -Avaliação de Vulnerabilidade e Ameaças (Threats and Vulnerabilities Analysis) B BACEN - Banco Central do Brasil (Central Bank of Brazil) BCB - Banco Central do Brasil (Central Bank of Brazil) BCP - Business Continuity Plan BCBS - Basel Committee on Banking Supervision BIA - Business Impact Analysis BIS - Bank for International Settlements C CCF - Credit Conversion Factor CCP - Non-Qualified Central Counterparty CCR - Counterparty Credit Risk CDP - Carbon Disclosure Project CEM - Current Exposure Method CEO - Chief Executive Officer CET 1 - Common Equity Tier I CGRC - Comitê de Gestão de Risco e Capital (Risk and Capital Management Committee) CMN - Conselho Monetário Nacional (National Monetary Council) Comef - Comitê de Estabilidade Financeira (Financial Stability Committee) CRI - Real State Receivables Certificate Itaú Unibanco 57

Risk and Capital Management - Pillar 3 CRM - Credit Risk Mitigation CRO - Chief Risk Officer CTAM -Comissão Técnica de Avaliação de Modelos (Technical Model Assessment Commission) CVA - Credit Valuation Adjustment CVM - Comissão de Valores Mobiliários (Brazilian Securities and Exchange Commission) D DLP - Long- Term Liquidity Statement DRL - Liquidity Risk Statement D-SIB - Domestic Systemically Important Banks DV - Delta Variation E EAD - Exposure at Default ECL - Expected Credit Losses EMD -Entidades Multilaterais de Desenvolvimento (Multilateral Development Entities) EP - Equator Principles EVE - Economic Value of Equity F FIDC - Credit Rights Investment Funds FCC - Credit Conversion Credit FPR - Fator de Ponderação de Risco (Weighting Factor) G GAP - Gap Analysis GDP - Gross Domestic Product GHG - Greenhouse Gas Protocol Itaú Unibanco 58

Risk and Capital Management - Pillar 3 Greeks - Sensitivities to Various Risk Factors G-SIB - Global Systemically Important Banks H HE - Haircut of Execution HQLA - High Quality Liquid Assets HV - Volatility Haircut I ICAAP - Internal Capital Adequacy Assessment Process IMA - Internal Models Approach IPV - Independent Price Verification IRRBB - Interest Rate Risk in the Banking Book IT - Information Technology K KYC - Know your Customer KYP - Know your Partner KYS - Know your Supplier KYE - Know your Employee L LCR - Liquidity Coverage Ratio LMM - Limite de Mitigação Máxima (Maximum Mitigation Limit) M MtM - Mark to Market N NII - Net Interest Income Itaú Unibanco 59

Risk and Capital Management - Pillar 3 NSFR - Net Stable Funding Ratio O OTC - Over-the-Counter P PR -Patrimônio de Referência (Total Capital) PRI - Principles for Responsible Investments PRSA -Política de Sustentabilidade e Responsabilidade Socioambiental (The Social and Environmental Responsability and Sustainability Policy) PCR - Potential Credit Risk PVA - Prudent Valuation Adjustments Q QCCP - Qualified Central Counterparties R RA - Leverage Ratio RAS - Risk Appetite Statement RSF - Required Stable Funding RWA - Risk Weighted Assets RWACPAD - Portion relating to exposures to credit risk RWACPrNB - amount of risk-weighted assets corresponding to credit risk exposures to the non-banking private sector, calculated for jurisdictions whose ACCPi is different from zero RWAMINT - Portion relating to exposures to market risk, using internal approach RWAMPAD - Portion relating to exposures to market risk, calculated using standard approach RWAOPAD - Portion relating to the calculation of operational risk capital requirements S Itaú Unibanco 60

Risk and Capital Management - Pillar 3 SA - Joint-Stock Company SA-CCR - Standardised Approach to Counterparty Credit Risk SFN -Sistema Financeiro Nacional (National Financial System) SFT - Securities Financing Transactions SOC - Security Operation Center T TCFD - Task Force on Climate-Related Financial Disclosures TLAC - Total Loss-Absorbing Capacity TVM - Títulos de valores mobiliários (Securities) V VaR - Value at Risk Itaú Unibanco 61

Risk and Capital Management - Pillar 3 Glossary of Regulations BACEN Circular No. 3,354, of June 27th, 2007 BACEN Circular No. 3,644, of March 4th, 2013 BACEN Circular No. 3,646, of March 04th, 2013 BACEN Circular No. 3,674, of October 31st, 2013 BACEN Circular No. 3,748, of February 26th, 2015 BACEN Circular No. 3,749, of March 05th, 2015 BACEN Circular No. 3,751 of March 19th, 2015 BACEN Circular No. 3,769, of October 29th, 2015 BACEN Circular No. 3,809, of August 25th, 2016 BACEN Circular No. 3,846, of September 13rd, 2017 BACEN Circular No. 3,869, of December 19th, 2017 BACEN Circular Letter No. 3,706 of May 05th, 2015 BACEN Circular Letter No. 3,907 of September 10th, 2018 BACEN Circular Letter No. 4,068 of July 7th, 2020 BACEN Circular Letter No. 3,876 of January 31st, 2018 BACEN Circular Letter No. 3,082 of January 30th, 2012 BACEN Circular Letter No. 3,978 of January 23rd, 2020 BACEN Communication No. 37.219, of June 1st, 2021 BCB Resolution No. 54, of December 16th, 2020 CMN Resolution No. 2,682, of December 22nd, 1999 CMN Resolution No. 4,192, of March 1st, 2013 CMN Resolution No. 4,193, of March 1st, 2013 Itaú Unibanco 62

Risk and Capital Management - Pillar 3 CMN Resolution No. 4,327, of April 25th, 2014 CMN Resolution No. 4,502, of June 30th, 2016 CMN Resolution No. 4,557, of February 23rd, 2017 CMN Resolution No. 4,589, of June 29th, 2017 CMN Resolution No. 4,693, of October 29th, 2018 CMN Resolution No. 4,783, of March 6th, 2020 Itaú Unibanco 63