Itaú Unibanco Holding S.A.

2019

Reference Form

Itaú Unibanco Holding S.A.

REFERENCE FORM

Base Date: 12.31.2019

(in accordance with Attachment 24 to CVM Instruction No. 480 of December 7, 2009 "CVM Instruction No.

480", as amended)

Identification

Head Office

Investor Relations Office

Itaú Unibanco Holding S.A., a corporation enrolled under the National Register of Legal Entities/ Ministry of Finance (CNPJ/MF) under No. 60.872.504/0001-23, with its Articles of Incorporation registered with the Trade Board of the State of São Paulo under NIRE No. 35.3.0001023-0, and registered as a publicly-held company with the Brazilian Securities and Exchange Commission ("CVM") under No. 19348 ("Bank" or "Issuer")

The Issuer's head office is located at Praça Alfredo Egydio de Souza Aranha, 100 - Torre Olavo Setubal, in the City and State of São Paulo, CEP 04344-902.

The Investor Relations department is located at AvenidaEngenheiro Armando de Arruda Pereira, 707 - Torre EudoroVillela - Térreo, in the City and State of São Paulo. The Head of Investor Relations is Mr. AlexsandroBroedel. The Investor Relations Department's telephone number is (0xx11) 2794-3547, fax number is +55 11 5019-8717 ,and email is relacoes.investidores@itau-unibanco.com.br.

Independent Auditors Firm

Bookkeeping Agent

Stockholders Service

Newspapers from which the Company discloses Information

Website

Last update of this Reference Form

PricewaterhouseCoopers AuditoresIndependentes, for the years ended 12/31/2019, 12/31/2018 and 12/31/2017.

Itaú Corretora de Valores S.A.

The Issuer's stockholders' service is carried out at the branches of Itaú Unibanco S.A., the head office of which is located at Praça Alfredo Egydio de Souza Aranha, 100 - Torre Olavo Setubal, in the City and State of São Paulo, CEP 04344-902.

Official Gazette of the State of São Paulo (DiárioOficial do Estado de São Paulo) and O Estado de São Paulo newspaper.

http://www.itau.com.br/relacoes-com-investidores. The information included in the Company's website is not an integral part of this Reference Form.

08/18/2020

Historical resubmission

Version

Reasons for resubmission

Date of update

V2

Update in itens 12.5/6, 12.7/8 and 12.12

07/10/2020

V3

Update in itens 11.1 and 11.2

08/03/2020

V4

Update in itens 12.5/6, 12.7/8 and 12.12

08/18/2020

Index

ITEM 1. IDENTIFICATION OF THE PEOPLE RESPONSIBLE FOR THE CONTENT OF THE FORM

5

ITEM 2. AUDITORS

6

ITEM 3. SELECTED FINANCIAL INFORMATION

9

ITEM 4. RISK FACTORS

17

ITEM 5. RISK MANAGEMENT AND INTERNAL CONTROL POLICY

56

ITEM 6. ISSUER'S HISTORY

88

ITEM 7. ACTIVITIES OF THE ISSUER

89

ITEM 8. EXTRAORDINARY BUSINESS

156

ITEM 9. RELEVANT ASSETS

158

ITEM 10. COMMENTS OF EXECUTIVE OFFICERS

163

ITEM 11. PROJECTIONS

194

ITEM 12. STOCKHOLDERS' MEETINGS AND MANAGEMENT

195

ITEM 13. REMUNERATION OF DIRECTORS

269

ITEM 14. HUMAN RESOURCES

298

ITEM 15. CONTROL AND ECONOMIC GROUP

304

ITEM 16. TRANSACTIONS WITH RELATED PARTIES

382

ITEM 17. CAPITAL

388

ITEM 18. SECURITIES

391

ITEM 19. REPURCHASE PLANS AND TREASURY SECURITIES

435

ITEM 20. SECURITIES TRADING POLICY

437

ITEM 21. INFORMATION DISCLOSURE POLICY

440

REPORT OF INDEPENDENT AUDITORS ON REFERENCE FORM (CVM INSTRUCTION 480)

443

ITEM 1. IDENTIFICATION OF THE PEOPLE RESPONSIBLE FOR THE CONTENT OF THE FORM

1.0 Identification:

Name of the person responsible for the content of the form

Position of the person responsible

Candido Botelho Bracher

Chief Executive Officer

Alexsandro Broedel

Head of Investor Relations

1.1 Chief Executive Officer's Statement:

Name of the person responsible for the content of the form

Position of the person responsible

Candido Botelho Bracher

Chief Executive Officer

The above-qualified officer states that:

a. he has revised the reference form;

b. all information contained in the form is in compliance with the provisions of CVM Instruction No. 480, particularly articles 14 to 19;

c. the information contained in the form is a true, accurate and complete portrait of the Issuer's economic and financial situation and of the risks inherent in its activities and in the securities issued by it.

Signature:

1.2 Head of Investor Relations' statement:

Name of the person responsible for the content of the form

Position of the person responsible

Alexsandro Broedel

Head of Investor Relations

The above-qualified officer states that:

a. he has revised the reference form;

b. all information contained in the form is in compliance with the provisions of CVM Instruction No. 480, particularly articles 14 to 19;

c. the information contained in the form is a true, accurate and complete portrait of the Issuer's economic and financial situation and of the risks inherent in its activities and in the securities issued by it.

Signature:

1.3 Chief Executive Officer's/Head of Investor Relations' Statement:

Name of the person responsible for the content of the form

Position of the person responsible

Candido Botelho Bracher

Chief Executive Officer

Alexsandro Broedel

Head of Investor Relations

The above-qualified officers state that:

a. they have revised the reference form;

b. all information contained in the form is in compliance with the provisions of CVM Instruction No. 480, particularly articles 14 to 19;

c. the information contained in the form is a true, accurate and complete portrait of the Issuer's economic and financial situation and of the risks inherent in its activities and in the securities issued by it.

5

ITEM 2. AUDITORS

Items - 2.1. and 2.2. - Auditors

2019

2018

2017

Is there an auditor? Auditor's Braziflian Securities and Exchange Commission ("CVM") Code Type of auditor Corporate name Corporate Taxpayer's Registry (CNPJ) number Service contracting date Initial date of service provision Final date of service provision

Description of services contracted

YES 2879

Pricewaterhousecoopers Auditores Independentes 61.562.112/0001-20

01/31/2019 01/01/2019

  1. Audit of financial statements, issue of reports required by regulatory authorities, and issue of comfort letters;
  2. Other audit procedures and issue of specific-purpose reports;
  3. Review of inquiries to tax authorities on tax aspects, review of calculations and settlement of taxes and compliance with tax rules;
  4. Other services relating to training, procurement of technical materials and surveys;
  5. Review required by regulatory authorities on studies on impact of new accounting standard.

YES 2879

Pricewaterhousecoopers Auditores Independentes 61.562.112/0001-20

03/01/2018 01/01/2018 12/31/2018

  1. Agreements for audit of financial statements, issue of reports required by regulatory authorities, and issue of comfort letters;
  2. Service agreements for other audit procedures and issue of specific-purpose reports;
  3. Service agreement for review of tax bookeeping, issue of income tax calculation and settlement review report, and review of compliance with transfer pricing policies;
  4. Other services relating to procurement of technical materials and training;
  5. Service agreement for reasonable assurance of fulfilment of commitments entered with government agencies.

YES

2879

Pricewaterhousecoopers Auditores Independentes 61.562.112/0001-20

03/16/2017 01/01/2017 12/31/2017

  1. Agreements for audit of financial statements, issue of reports required by regulatory authorities, and issue of comfort letters;
  2. Service agreements for the preparation of accounting reports, due diligence and other audit procedures, and issue of specific-purpose reports;
  3. Service agreement for review of tax bookeeping, issue of income tax calculation and settlement review report, and review of compliance with transfer pricing policies;
  4. Other services relating t o training, procurement of technical material and surveys.

6

2019

2018

2017

Total amount of the fees of the independent auditors separated by service

The fees of the independent auditors for the last year, ended December 31, 2019, correspond to the amount of R$66,680 thousand that comprise the amounts related to audit services $65,876 thousand and other services R$804 thousand.

Due to the turnover of the auditor in charge, provided for in Article 9 of CVM Instruction No. 3,198/2004, we announce the replacement of Washington Luiz Pereira

Justification for the replacementCavalcanti, enrolled with the Brazilian tax register (CPF) 023.115.418-62, by Emerson Laerte da Silva, CPF 125.160.718-76, for the audit work of the years beginning on January 1, 2019.

Not applicable, because there was no replacement of the independent auditor

Not applicable, because there was no replacement of the independent auditor

Any reasons presented by the auditor

No disagreement of the auditor with the issuer's

Not applicable, because there was no

contrasting with the Issuer's justification for

justification.

replacement of the independent auditor

their replacement

Not applicable, because there was no replacement of the independent auditor

Person in charge

Name of person in charge

Emerson Laerte da Silva

Washington Luiz Pereira Cavalcanti

Washington Luiz Pereira Cavalcanti

Individual Taxpayer's Registry (CPF) number

125.160.718-76

023.115.418-62

023.115.418-62

of the person in charge

Address

Venue

Avenida Francisco Matarazzo, 1400

Avenida Francisco Matarazzo, 1400

Avenida Francisco Matarazzo, 1400

Additional information

09-10º,13-17º andares

09-10º,13-17º andares

09-10º,13-17º andares

District

Água Branca

Água Branca

Água Branca

Zip Code

05001-903

05001-903

05001-903

City Code

11

11

11

Telephone number

3674-3883

3674-3780

3674-3780

City Code (facsimile)

3674-2060

3674-2060

3674-2060

Email

emerson.laerte@pwc.com

washington.cavalcanti@pwc.com

washington.cavalcanti@pwc.com

7

2.3. Supply other information that the issuer may deem relevant

The policy adopted by Itaú Unibanco Holding's Audit Committee to avoid conflicts of interest, loss of independence or objectivity of its independent auditors is to ensure that the independence principles have been observed when services were contracted and provided, including their approval. These responsibilities are formalized in the Audit Committee Regulations and in corporate policies.

Additional information on items 2.1/2.2:

With respect to the Service Period - The service contracting date will be retroactive to January 1 of the year in question, corresponding to the beginning of the legal relationship between the Parties.

With respect to the service provider's period of service - The contracting will be in force until the end of the audit service and the issuance of the respective reports related to the base date of December 31 of the year in question.

8

ITEM 3. SELECTED FINANCIAL INFORMATION

3.1- Financial Information

Company

X

Consolidated

(in R$)

December 31

2019

2018

2017

a. stockholders' equity

149,465,080,000

150,466,628,000

144,355,272,000

b. total assets

1,637,481,124,000

1,552,797,590,000

1,436,238,680,000

c. income (expenses) from financial operations

(1)

64,325,041,000

62,565,045,000

67,311,928,000

d. gross income

98,512,805,000

94,018,075,000

90,557,579,000

e. net income

27,813,299,000

25,638,809,000

23,224,606,000

f.

number of shares, ex treasury shares (units)

(2)

9,745,601,763

9,720,520,922

9,696,945,776

g. book value per share (Brazilian reais/unit)

(2)

15.34

15.48

14.89

h. basic earnings per share (Brazilian reais/unit)

2.78

2.56

2.38

i.

diluted earnings per share (Brazilian reais/unit)

2.77

2.55

2.36

j.

other accounting information selected by the issuer

não há

não há

não há

  1. As a financial institution, the Bank considers interest and similar income (expense) as an indicator of net revenue.
  2. For better comparability, outstanding shares on 12/31/2017 were adjusted by the stock split approved on 10/31/2018.

3.2. If the issuer disclosed in the previous year or if it wishes to disclose in this form non-accounting measures such as EBITDA (earnings before interest, taxes, depreciation and amortization) or EBIT (earnings before interest and taxes), the issuer should:

a) Inform the value of non-accounting measures

No non-accounting measures were disclosed in the previous year in our financial statements under

IFRS.

  1. Perform reconciliation between the amounts disclosed and the amounts in the audited financial statements

Not applicable.

  1. Explain why it believes that such measurement is the most appropriate for the correct understanding of its financial position and the results of its operations

Not applicable.

3.3. Identify and comment on any event subsequent to the most recent financial statements for the year that might significantly change them

Issuance of Senior Notes

In January 2020, Itaú Unibanco Holding priced the issuance of senior notes maturing in January 2023 in the amount of US$1 billion at a fixed rate of 2.90% and senior notes maturing in January 2025 in the amount of US$500 million at a fixed rate of 3.25%.

This issuance is not subject to the registration rules with the U.S. Securities Exchange Commission (SEC), nor is it subject to registration in Brazil with the Brazilian Securities and Exchange Commission (CVM), in accordance with applicable legislation and regulation.

These Notes were offered only to qualified institutional investors and Non-U.S. investors outside the territory of the United States of America.

Itaú Unibanco Holding will use the funds raised by these Notes for general corporate purposes.

9

Issuance of Perpetual Subordinated Notes

In February 2020, Itaú Unibanco Holding priced the issuance of perpetual subordinated notes/AT1 in the amount of US$700 million at a fixed rate of 4.625%, valid up to the fifth anniversary of the issuance date. As of that date, inclusive, the interest rate will be recalculated every five years based on the interest rate of the securities issued by the U.S. Treasury.

Itaú Unibanco Holding will be able to repurchase the notes at the fifth anniversary of the issuance date or at any subsequent interest payment date, subject to approvals from Brazilian authorities, including the Central Bank of Brazil. These notes were approved by the Central Bank of Brazil in April 2020 to make up the Additional Capital of Itaú Unibanco Holding's Referential Equity.

This issuance is not subject to the registration rules with the U.S. Securities Exchange Commission (SEC), nor is it subject to registration in Brazil with the Brazilian Securities and Exchange Commission (CVM), in accordance with applicable legislation and regulation. These Notes were offered only to qualified institutional investors and Non-U.S. investors outside the territory of the United States of America.

Acquisition of Zup I.T. Serviços em Tecnologia e Inovação Ltda.

On October 31, 2019, Itaú Unibanco Holding entered into a purchase and sale agreement for 100% of the capital of Zup I.T. Serviços em Tecnologia e Inovação Ltda. (ZUP). This purchase will be carried out in three phases over four years. In the first phase, Itaú Unibanco Holding acquired 52.96% of ZUP's total voting capital for approximately R$293 million, and now holds the company's control. In the third year, after the operation is closed, Itaú Unibanco Holding will acquire an additional 19.6% interest and the remaining interest will be acquired in the fourth year, so as to achieve 100% of ZUP's capital.

The effective acquisitions and financial settlements occurred on March 31, 2020, after the required regulatory authorizations were obtained.

Covid-19 "Coronavirus" relief efforts

On April 6, 2020, Itaú Unibanco Holding held a conference call with its stockholders and the general market to update the measures it implemented for managing its operations and supporting employees, clients and society in view of the novel Covid-19 pandemic.

Itaú Unibanco Holding has been monitoring the economic effects of the pandemic in Brazil and in other countries where it operates, which may adversely affect the results of its operations. Since the onset of the Covid-19 outbreak in Brazil, Itaú Unibanco has set up an Institutional Crisis Management Committee that monitors the effects of the spread of the pandemic and its impacts on operations on a daily basis, in addition to the government actions, in order to mitigate these effects.

Through the National Monetary Council (CMM) and the Central Bank of Brazil, the Brazilian government has adopted measures to mitigate the impacts of the Covid-19, particularly on loan operations, funding, reducing compulsory deposit, and other capital-related aspects.

Itaú Unibanco Holding proceeds with its operating activities and continues to monitor and assess the impacts of this pandemic on its results, as well as on critical estimates and judgments, including provision for losses and impairment, as this event does not affect its results and financial position for the year ended December 31, 2019.

A R$1 billion donation in connection with novel Coronavirus relief efforts in Brazil

In April 2020, Itaú Unibanco Holding set up the Todos pela Saúde (All for Health) initiative, with a donation worth R$1 billion aimed to fight the novel coronavirus and its effects on Brazilian society. Todos pela Saúde will operate based on four action axes: Informing, Protecting, Caring, and Resuming.

Itaú Unibanco Holding adds the Todos pela Saúde to other initiatives, such as the donation worth approximately R$250 million, which has been allocated to different projects to improve Brazil's hospital infrastructure, in addition to the production and purchase of test kits, protective face masks, health equipment, hygiene kits and food.

10

3.4. Describe the policy on allocation of earnings for the past three years, indicating:

The Board of Directors submits to the Annual General Stockholders' Meeting, together with the financial statements, a proposal for the appropriation of net income for the year, and the main appropriations are:

  1. 5% to the Legal Reserve, which should not exceed 20% of capital stock;
  2. distribution of dividends to stockholders (please see items "b" and "c" below); and
  3. setting up the Statutory Reserve, whose purpose is to guarantee funds for the payment of dividends, including as interest on capital, or advances, to maintain the flow of stockholders' remuneration, and its balance may also be used:
    1. in redemption, reimbursement or own share buyback operations, under current legislation; and
    2. in contribution to capital stock, including by means of new share bonus.

The Statutory Reserve will be comprised of funds:

  1. equivalent to up to 100% of net income for the year, adjusted in accordance with Article 202 of the Brazilian Corporate Law (Law No. 6,404/76) (please see item 3.9), always respecting the stockholders' right to mandatory dividends, under the terms of these Bylaws and applicable legislation;
  2. equivalent to up to 100% of the paid-up portion of the Revaluation Reserves, recorded as retained earnings;
  3. equivalent to up to 100% of the amount of prior-year adjustments, recorded as retained earnings; and
  4. arising from credits corresponding to dividend advances. The balance of this reserve, added to the Legal Reserve, may not exceed capital stock, in accordance with Article 199 of the Brazilian Corporate Law (please see item 3.9).).

2019

2018

2017

a.

Rules on retention of

No changes in the rules

earnings

a.i. Retained earnings

No earnings retained

amounts

a.ii. Percentage of total

Not applicable

declared earnings

b.

Ruled on distribution of

Amount not below 35% of net income calculated for the year

dividends

c.

Frequency of

Monthly - mandatory

distribution of dividends

Half-yearly - supplementary

d.

Any restrictions on the

Not applicable

distribution of dividends

imposed by legislation

or special regulations

applicable to the issuer,

as well as agreements,

court, administrative or

arbitration decisions

e.

Whether the issuer has a

Stockholder Remuneration Policy (dividends and interest on

formally approved policy

capital) approved by the Disclosure and Trading Committee at

on allocation of

the meeting held on April 19, 2018, which may be accessed on

earnings, informing the

the websites of CVM (http://www.cvm.gov.br/ > Companhias >

approving body, date of

Informações Periódicas e Eventuais de Companhias > Itaú

approval and, if the

Unibanco > Política de Dividendos) and of the Investor Relations

issuer discloses the

(www.itau.com.br/investor-relations > Menu > Itaú Unibanco>

policy, where this

Corporate Governance > Rules and Policies)

document can be found

on the web

a) Rules on retention of earnings

No changes were made to the rules on retention of earnings over the past three years. In accordance with Brazilian Corporate Law (please see item 3.9), at an Annual General Stockholders' Meeting and based

11

on a proposal by management, stockholders may resolve on retaining a portion of net income for the year previously approved as part of the capital budget. Additionally, minimum mandatory dividends may not be paid in any year in which management informs the Annual General Stockholders' Meeting that this would be incompatible with the Issuer's financial position.

a.i.) Retained earnings amounts

Over the past three years, no earnings have been retained, and dividends paid by the Issuer have been higher than minimum mandatory dividends (please see item 3.5 below).

b) Rules on distribution of dividends

Stockholders are entitled to receive as a mandatory dividend each year the minimum amount of twenty- five percent (25%) of the net income computed in the same year, adjusted by the addition or deduction of the amounts specified in letters "a" and "b" of item I of Article 202 of the Brazilian Corporate Law (please see item 3.9), and in compliance with items II and III of the same legal provision.

As resolved by the Board of Directors, interest on capital can be paid, including the interest on capital paid or credited in the amount of the mandatory dividend, as provided for in Article 9, paragraph 7 of Law No. 9,249/95 (please see item 3.9). Preferred shares entitle their holders to priority in the payment of an annual minimum dividend of R$0.022 per share, non-cumulative and adjusted for any split or reverse split. After the payment of the priority dividend to preferred stockholders, a dividend will be paid to the holders of common shares at R$0.022 per share, non-cumulative and adjusted for any split or reverse split.

On September 26, 2017 (please see Material Fact in item 3.9), the Company informed that it would continue to pay dividends and interest on capital at 35% of the recurring consolidated net income and exclude the maximum limit previously determined at 45%.

Capital Management and Distribution of Profits

In order to ensure capital strength and availability to support our business growth, regulatory capital levels were kept above those required by the Central Bank of Brazil, as evidenced by the Common Equity Tier I, Tier I, and BIS ratios.

The total amount to be distributed each year will be set by the Board of Directors, considering, among

others:

  1. the Company's capitalization level, according to the rules issued by the Central Bank of Brazil;
  2. the minimum level established by the Board of Directors of 13.5% for Tier 1 Capital;
  3. profitability in the year;
  4. the expectations of capital use based on expected business growth, share buyback programs, mergers and acquisitions, and regulatory changes that may change capital requirement; and
  5. changes in tax legislation.

Therefore, the percentage to be distributed may change every year based on the profitability and capital demands of the Company, always considering the minimum distribution set forth in the Bylaws.

Additionally, management may resolve on the distribution of additional profit whenever it deems convenient for the Issuer and/or its stockholders. Such distributions should not be construed as any future distribution of profits in addition to the minimum mandatory dividend.

Under the implementation of the liquidity requirements set forth by Basel III standards, on March 1, 2013, CMN issued Resolution No. 4,193 (please see item 3.9), establishing that dividends may not be paid if a financial institution fails to comply with the additional capital requirements, required in their entirety as from 2019.

This restriction on dividend payment will be progressively applied, according to the extent of nonconformity with the additional capital requirements.

12

  • Should a financial institution's additional capital be lower than 25% of that established by CMN for that year, no dividends or interest on capital will be distributed accordingly.
  • If the additional capital is between 25% and 50% of the required amount, 80% of the intended dividends and interest on capital will not be distributed.
  • If the additional capital is between 50% and 75% of the required amount, 60% of the intended dividends and interest on capital will not be distributed.
  • If the additional capital is between 75% and 100% of the required amount, 40% of the intended dividends and interest on capital will not be distributed.

At the end of December 2019, the BIS ratio reached 15.8%, of which:

  1. 14.4% related to Tier I Capital, composed of the sum of Core Capital and Additional Capital; and
  2. the amounts of Tier I and Tier II Capital totaled R$128.7 billion and R$11.9 billion, respectively on December 31, 2019.

These indicators provide evidence of our effective capacity of absorbing unexpected losses.

For further information, please see report "Risk and Capital Management - Pillar 3" on our website www.itau.com.br/investor.relations> Menu > Reports > Pillar 3 and Global Systematically Important Banks.

Temporary suspension of distribution of dividends and increase in compensation of officers and board members

In accordance with the provisions of CMN Resolution No. 4,797/2020, Brazilian financial institutions may not: (i) distribute dividends in addition to the minimum amount set by the Brazilian Corporate Law and the bylaws of each institution; (ii) carry out share buybacks (except for some limited cases); (iii) reduce its capital stock; and (iv) increase compensation of its officers and board members. These restrictions will be in force from April 6 to September 20, 2020.

c) Frequency of distribution of dividends

Since July 1980, the Issuer has been remunerating its stockholders with monthly additional payments. These additional payments have historically been made twice a year and are equally distributed to common and preferred stockholders.

Over the past three years, dividends were paid on a monthly basis, as established by our Stockholder Remuneration Policy, approved by the Board of Directors. Such Policy establishes the monthly payment of R$0.015 per share, as a mandatory dividend advance. The date used as reference to determine which stockholders are entitled to receive the monthly dividends is determined based on the stockholding position recorded on the last day of the previous month, and dividends are paid on the first business day of the subsequent month.

The Extraordinary General Stockholders' Meeting of July 27, 2018 approved the Company's share split at 50%. Monthly dividends were kept at R$0.015 per share, so that the total amounts monthly paid by the Company to stockholders were added by fifty percent (50%), after the inclusion of the split shares in the stockholding position. In 2016, our stockholders received free of charge one new share for every ten shares of the same type they held, with the cost attributed to the bonus share, generating tax benefits.

Additionally, over the past three years, supplementary dividends were also paid (half yearly), for which the Board of Directors determines the base date for the stockholding position and payment date. Regarding these half-yearly payments, management verifies the existing profit, determines the amount of dividends that should be distributed as mandatory (please see item "a" above), calculates the monthly amount already declared and, finally, determines the outstanding balance payable of the minimum mandatory dividend. This amount is declared as a dividend "additional" to those paid monthly.

The Stockholders Remuneration Policy is available on our Investor Relations website www.itau.com.br/investor-relations > Menu > Itaú Unibanco> Corporate Governance > Rules and Policies > Policies.

13

For the history of payments by www.itau.com.br/investor-relations> Shares Remuneration of Stockholders.

the Issuer, please access the Investor Relations website and Dividends & Interest on Capital > History of Dividends and

3.5. In a table, please indicate for each of the past three years:

R$ million

2019

2018

2017

a. Adjusted net income for dividend purposes

25,376

20,848

20,053

b. Total distributed dividends

18,777

22,437

17,558

c. Percentage of dividends per adjusted net income

74.0%

107.6%

87.6%

d. Dividend distributed per class and type of shares:

Total common shares

9,551

11,453

8,991

Total preferred shares

9,226

10,984

8,567

Date set at

Date set at

e. Payment date of the minimum mandatory dividend

General

General

Date set at General

Stockholders'

Stockholders'

Stockholders'

Meeting

Meeting

Meeting

f. Return on equity

20.2%

16.6%

16.4%

g. Total retained earnings

7,156

1,102

1,687

Allocation to reserves

7,156

1,102

1,687

Retained earnings

-

-

-

h. Retention approval date

04/28/2020

04/24/2019

04/25/2018

Notes:

o Adjusted net income: Net income (1) (- ) 5% of Legal Reserve.

o Dividend distributed in relaton to the Adjusted net income (%): Total dividend distributed (2) / Adjusted net income.

o Return on equity of issuer (%): Net income (1) / Stockholders' equity (1).

o Total dividend distributed: Interest on capital (3) (+) Dividends - Calculated per year.

o Mandatory dividend: Minimum mandatory dividend (+) Additional dividend (- ) Minimum priority dividend.

o Retained earnings: Legal Reserve (1) (+) Statutory Reserve (1).

  1. Includes Company's information under BRGAAP.
  2. For 2019, dividends distributed charged from the Statutory Revenue Reserve were included.
  3. Net of income tax.

Year

Exercise

Payment

Type of event

Amounts in R$ million (*)

Competence

date

Common share

Preferred share

2019

Complementary

03.07.2020

Complementary

IOC

IOC

2,396

2,313

Complementary

03.07.2020

Complementary

Dividend

Dividend

2,207

2,130

IOC

03.07.2020

IOC

158

153

December

01.02.2020

Dividends

74

72

November

12.02.2019

Dividends

74

72

October

11.01.2019

Dividends

74

72

September

10.01.2019

Dividends

74

72

August

09.02.2019

Dividends

74

72

Complementary

08.23.2019

Complementary

Dividend

Dividend

3,902

3,766

July

08.01.2019

Dividends

74

72

June

07.01.2019

Dividends

74

72

May

06.03.2019

Dividends

74

72

April

05.02.2019

Dividends

74

72

March

04.01.2019

Dividends

74

72

14

February

03.01.2019

Dividends

74

72

January

02.01.2019

Dividends

74

72

2018

Complementary

03. 07.2019

Complementary

IOC

IOC

3,158

3,034

Complementary

03.07.2019

Complementary

Dividend

Dividend

5,210

5,003

IOC

03.07.2019

IOC

45

43

December

01.02.2019

Dividends

74

71

November

12.03.2018

Dividends

51

48

October

11.01.2018

Dividends

50

47

September

10.01.2018

Dividends

50

47

August

09.03.2018

Dividends

50

47

Complementary

08.30.2018

Complementary

Dividend

Dividend

2,063

1,978

IOC

08.30.2018

IOC

352

337

July

08.01.2018

Dividends

50

47

June

07.02.2018

Dividends

50

47

May

06.01.2018

Dividends

50

47

April

05.02.2018

Dividends

50

47

March

04.02.2018

Dividends

50

47

February

03.01.2018

Dividends

50

47

January

02.01.2018

Dividends

50

47

2017

Complementary

03.07.2018

Complementary

IOC

IOC

3,228

3,084

Complementary

03.07.2018

Complementary

Dividend

Dividend

3,186

3,046

Dividends

03.07.2018

Dividends

431

412

IOC

03.07.2018

IOC

410

386

December

01.02.2018

Dividends

50

48

November

12.01.2017

Dividends

50

48

October

11.01.2017

Dividends

50

48

September

10.02.2017

Dividends

50

48

Complementary

08.25.2017

Complementary

IOC

IOC

1,136

1,067

August

09.01.2017

Dividends

50

48

July

08.01.2017

Dividends

50

48

June

07.03.2017

Dividends

50

48

15

May

06.01.2017

Dividends

50

48

April

05.02.2017

Dividends

50

47

March

04.03.2017

Dividends

50

47

February

03.01.2017

Dividends

50

47

January

02.01.2017

Dividends

50

47

(*) Amounts for interest on capital are net of income tax.

3.6. State whether, in the past three years, dividends were declared in retained earnings or reserves were recognized in prior years

Dividends and interest on capital declared and paid out in fiscal year 2019 based on the 2018 income, using Revenue Reserves, totaled R$10,213 million and R$6,192 million, respectively.

Dividends and interest on capital declared and paid out in fiscal year 2018 based on the 2017 income, using Revenue Reserves, totaled R$6,313 million and R$6,231 million, respectively.

Interest on capital declared and paid out in fiscal year 2017 based on the 2016 income, using Revenue Reserves, totaled R$5,050 million.

3.7. In a table, please describe the issuer's indebtedness ratio, indicating:

  1. sum of current and non-current liabilities;
  2. indebtedness ratio (current plus non-current liabilities, divided by stockholders' equity);
  3. if the issuer so wishes, another indebtedness ratio, indicating:
    1. the method used to calculate the ratio;
    2. the reason why the issuer understands that this ratio is appropriate for the correct understanding of its

2019

a. sum of current and non-current liabilities (in R$)

1,488,016,044,000

b. indebtedness ratio (current plus non-current liabilities, divided by stockholders'

9.96

equity)

c. if the issuer so wishes, another indebtedness ratio, indicating:

-

i. the method used to calculate the ratio

-

ii. the reason why the issuer understands that this ratio is appropriate for the

correct understanding of its financial position and indebtedness level

-

3.8. Liabilities by type and maturity (1)

(R$ million)

December 31, 2019

Type of debt

Less than one

One to three

Three to five

More than five

Total

year

years

years

years

Secured debts

14,543

9,226

1,562

193

25,524

Agribusiness credit bills

14,543

4,906

1,562

193

21,204

Guaranteed real state notes

-

4,320

-

-

4,320

Unsecured debts

667,382

137,669

135,516

76,658

1,017,225

Securities sold under repurchase agreements

223,876

7,261

6,048

19,398

256,583

Structured operations certificates

575

494

41

-

1,110

Deposits

334,197

42,937

111,095

18,831

507,060

Subordinated debt

4,098

25,296

8,405

21,663

59,462

Import and export financing

60,530

3,281

96

715

64,622

Financial bills

20,829

44,282

288

34

65,433

Real estate credit bills

6,194

982

421

38

7,635

On-lending - domestic

7,921

2,414

628

685

11,648

Obligations on securities abroad

9,162

10,722

8,494

15,294

43,672

Total

681,925

146,895

137,078

76,851

1,042,749

(1) In accordance with consolidated financial statements under IFRS.

16

3.9. Supply other information that the issuer may deem relevant

The financial information presented in Item 3 (Selected Financial Information) adopts the IFRS accounting standard, except for items 3.5 and 3.6 that comply with BRGAAP accounting standards defined by the Central Bank of Brazil and CMN, since dividends are calculated based on the individual net income under

BRGAAP.

Additional information on item 3.4:

Quoted from:

  • Law No. 6,404/76http://www.normaslegais.com.br/legislacao/contabil/lei6404_1976.htm
  • Brazilian Corporate Lawhttp://www.planalto.gov.br/ccivil_03/LEIS/L6404consol.htm
  • Law No. 9,249/95http://www2.camara.leg.br/legin/fed/lei/1995/lei-9249-26-dezembro-1995-349062- normaatualizada-pl.html
  • Bylaws
    Investor Relations website: www.itau.com.br/investor-relationsItaú Unibanco> Corporate Governance > Regulations and Policies
  • Material Fact - Payout
    Investor Relations website:http://www.itau.com.br/investor-relationsAnnouncements to the Market > Material Fact
  • CMN Resolution No. 4,193https://www.bcb.gov.br/pre/normativos/busca/normativo.asp?tipo=res&ano=2013&numero=4193

ITEM 4. RISK FACTORS

4.1. Describe risk factors that may influence an investment decision, particularly those related to:

This section addresses the risks we consider material to our business and an investment in our securities. Should any of the following risks actually occur, our business and financial condition, as well as the value of any investments made in our securities, will be adversely affected. Accordingly, investors should carefully assess the risk factors described below and the information disclosed in this annual report before making an investment decision. The risks described below are those that we currently believe may adversely affect us. Other risks that we currently deem immaterial or that are currently not known to us may also adversely affect us.

  1. The Issuer
    Credit risk factor

We may incur losses associated with counterparty exposure risks, including the Brazilian federal government.

We routinely conduct transactions with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, mutual and hedge funds and other institutional clients. Like most Brazilian banks, we also invest in debt securities issued by the Brazilian government. As of December 31, 2019, approximately 20% of all our assets and 67.1% of our securities portfolio were comprised of these public debt securities.

We may incur losses if any of our counterparties fail to meet their contractual obligations, due to bankruptcy, lack of liquidity, operational failure or other reasons that are exclusively attributable to our counterparties. As an example, an eventual failure by the Brazilian government to make timely payments under the terms of these securities, or a significant decrease in their market value could negatively affect our results in two ways: directly, through portfolio losses, and indirectly, through instabilities that a default in public debt could cause to the banking system as a whole, particularly since commercial banks' exposure to government debt is high in countries in which we operate. This counterparty risk may also arise from our entering into reinsurance agreements or credit agreements pursuant to which counterparties have obligations to make payments to us and are unable to do so, or from our carrying out transactions in the foreign currency market (or other markets) that fail to be settled at the specified time due to non-delivery by the counterparty, clearing house or other financial intermediary. Their failure to meet their contractual obligations may adversely affect our financial performance.

17

A downgrade of our ratings may adversely affect our funding cost, our access to capital and debt markets, our liquidity and, as a result, our competitive position.

Credit ratings represent the opinions of independent rating agencies regarding our ability to repay our indebtedness, and affect the cost and other terms upon which we are able to obtain funding. Each of the rating agencies reviews its ratings and rating methodologies on a periodic basis and may decide on a grade change at any time, based on factors that affect our financial strength, such as liquidity, capitalization, asset quality and profitability.

Under the criteria utilized by the rating agencies, ratings assigned to Brazilian financial institutions, including Itaú Unibanco are constrained by the grades assigned to the Brazilian sovereign. Events that are not subject to our control, such as economic or political crises, may lead to a downgrade of the Brazilian sovereign rating and a corresponding downgrade of the ratings assigned to Itaú Unibanco.

Credit ratings are essential to our capability to raise capital and funding through the issuance of debt and to the cost of such financing. A downgrade or a potential downgrade in our credit ratings could have an adverse impact on our operations, income and risk weighting. This may affect net earnings, capital requirements and return on capital levels, causing a negative impact on our competitive position. Additionally, if our credit ratings were to be downgraded, rating trigger clauses in our financing agreements with other institutions could result in an immediate need to deliver additional collateral to counterparties or taking other actions under some of our derivative contracts, adversely affecting our interest margins and results of operations. Thus, a failure to maintain favorable ratings and outlooks can affect the cost and availability of our financing through the capital markets and other sources of financing, affecting our interest margins and capacity to operate.

Changes or uncertainty in base interest rates could adversely affect us.

A significant portion of our business is conducted in Brazil, where the Central Bank's Monetary Policy

Committee (Comitê de Política Monetária), or the COPOM, establishes the target base interest rate for the

Brazilian economy (the "SELIC Rate"), and uses changes in this rate as an instrument of monetary policy. The

SELIC Rate is the benchmark interest rate payable to holders of certain securities issued by the Brazilian government and traded on the SELIC System operated by the Central Bank. In recent years, the SELIC Rate, has fluctuated significantly reflecting the corresponding volatility in the macroeconomic scenario and inflationary environment. During 2015 and 2016, as a result of increased prospects of inflation and macroeconomic instability, the COPOM increased the SELIC Rate, reaching 14.25% and 13.75% as of December 31, 2015 and December 31, 2016, respectively. In the following years, as a result of the widespread decline in inflation, due to the high level of idle capacity in the Brazilian economy and anchored inflation expectations, the Central Bank started a monetary easing cycle and the COPOM has reduced the SELIC Rate. As of December 31, 2017, and December 31, 2018, the SELIC Rate was 7.00% and 6.50%, respectively. As of December 31, 2019, the SELIC Rate was 4.5%, reflecting a historical low. As of the date of the filing of this Annual Report on Reference Form, the SELIC rate was 3.0%.

We may face challenges associated with IBOR transition

A significant portion of our income, expenses and liabilities is directly tied to interest rates. Therefore, our results of operations and financial condition are significantly affected by inflation, interest rate fluctuations and related government monetary policies. In addition, various interbank offered rates which are deemed to

be "benchmarks" (the "IBORs", including LIBOR and EURIBOR) are the subject of recent international and

other regulatory guidance and proposals for reform. Some of these reforms are already effective while others are still to be implemented, including the majority of the provisions of the EU Benchmark Regulation

(Regulation (EU) 2016/1011) ("Benchmarks Regulation").

In particular, the U.K. Financial Conduct Authority ("FCA") announced that the FCA will no longer

oblige banks to contribute to the calculation of LIBOR after the end of 2021. This announcement indicates that the continuation of LIBOR on the current basis cannot and will not be guaranteed after 2021, and it appears likely that LIBOR will be discontinued or be declared unrepresentative of the underlying market by 2021. This and other reforms may cause IBORs to perform differently than in the past, or to disappear entirely, or have other consequences, which cannot be fully anticipated, which introduce a number of risks for us including legal risks arising from potential changes required to documentation for new and existing transactions, financial risks

18

arising from any changes in the valuation of financial instruments linked to benchmark rates, pricing risks arising from how changes to benchmark indices could impact pricing mechanisms on some instruments, operational risks arising from the potential requirement to adapt information technology systems, trade reporting infrastructure and operational processes, and commercial risks arising from the potential impact of communication with customers and engagement during the transition period. Accordingly, the implementation of alternative benchmark rates may have a material adverse effect on our business, results of operations, financial condition and prospects.

Operational risk factor

We face risks relating to our operations.

Operational risks, which may arise from errors in the performance of our processes, the conduct of our employees, instability, malfunction or outage of our IT system and infrastructure, or loss of business continuity, or comparable issues with respect to our vendors, may disrupt our businesses and lead to material losses. We face operational risk arising from errors, accidental or premeditated, made in the execution, confirmation or settlement of transactions or from transactions not being properly recorded, evaluated or accounted for. The occurrence of any of these risks may adversely affect our business, financial results and reputations.

We are exposed to failures, deficiency or inadequacy of our internal processes, human error or misconduct and cyberattacks. Additionally, we rely on third-party services. All these factors may adversely affect us.

Due to the high volume of daily processing, we are dependent on technology and management of information, which exposes us to eventual unavailability of systems and infrastructure such as power outages, interruption of telecommunication services, and generalized system failures, as well as internal and external events that may affect third parties with which we do business or that are crucial to our business activities (including stock exchanges, clearing houses, financial dealers or service providers) and events resulting from wider political or social issues, such as cyberattacks or unauthorized disclosures of personal information in our possession. We manage and store certain proprietary information and sensitive or confidential data relating to our clients and to our operations. We may be subject to breaches of the information technology systems we use for these purposes, as well as the theft of technology and intellectual property. Additionally, we operate in many geographic locations and are frequently subject to the occurrence of events outside of our control. Despite the contingency plans we have in place, our ability to conduct business in any of these locations may be adversely impacted by a disruption to the infrastructure that supports our business. We are strongly dependent on technology and thus are vulnerable to viruses, worms and other malicious software, including "bugs" and other problems that could unexpectedly interfere with the operation of our systems and result in data leakage.

Operating failures, including those that result from human error or fraud, not only increase our costs and cause losses, but may also give rise to conflicts with our clients, lawsuits, regulatory fines, sanctions, interventions, reimbursements and other indemnity costs. Ethical misconduct and noncompliance - ethical misconduct or breaches of applicable laws by our businesses or our employees could be damaging to our reputation too, and could result in litigation, regulatory action and penalties. All of which may have a material adverse effect on our business, reputation and results of operations. Operational risk also includes legal risk associated with inadequacy or deficiency in contracts signed by us, as well as penalties due to noncompliance with laws and punitive damages to third parties arising from the activities undertaken by us. Additionally, we have essential other services for the proper functioning of our business and technology infrastructure, such as call centers, networks, internet and systems, among others, provided by external or outsourced companies. Impacts on the provision of these services, caused by these companies due to the lack of supply or the poor quality of the contracted services, can affect the conduct of our business as well as our clients. We also rely in certain limited capacities on third-party data management providers whose possible security problems and security vulnerabilities may have similar effects on us.

As a result of the COVID-19 pandemic, we have rapidly increased the number of employees working remotely. This may cause increases in the unavailability of our systems and infrastructure, interruption of telecommunication services, generalized system failures and heightened vulnerability to cyberattacks. Accordingly, our ability to conduct our business may be adversely impacted.

Failure to protect personal information could adversely affect us.

We manage and hold confidential personal information of clients in the ordinary course of our business. Although we have procedures and controls to safeguard personal information in our possession, unauthorized disclosures or security breaches could subject us to legal action and administrative sanctions as well as

19

damage that could materially and adversely affect our operating results, financial condition and prospects. Further, our business is exposed to risk from potential non-compliance with policies, employee misconduct or negligence and fraud, which could result in regulatory sanctions and reputational or financial harm. In addition, we may be required to report events related to cybersecurity issues, events where client information may be compromised, unauthorized access and other security breaches, to the relevant regulatory authority. Any material disruption or slowdown of our systems could cause information, including data related to client requests, to be lost or to be delivered to our clients with delays or errors, which could reduce demand for our services and products and could materially and adversely affect us.

Failure to adequately protect ourselves against risks relating to cybersecurity could materially and adversely affect us.

We face various cybersecurity risks, including but not limited to: penetration of our information technology systems and platforms, by ill-intentioned third parties, infiltration of malware (such as computer viruses) into our systems, contamination (whether intentional or accidental) of our networks and systems by third parties with whom we exchange data, unauthorized access to confidential client and/or proprietary data by persons inside or outside of our organization, and cyber-attacks causing systems degradation or service unavailability that may result in business losses.

Although we have procedures and controls to safeguard our information technology systems and platforms, we are subject to cybersecurity risks. We have seen in recent years computer systems of companies and organizations being targeted, not only by cyber criminals, but also by activists and rogue states. We define cyberattack as any type of offensive maneuver employed by states, nations, individuals, groups or organizations that targets computer information systems, infrastructure, networks and/or personal devices, using varied means, such as denial of service, malware and phishing, for the purpose of stealing, altering or destroying a specific target by hacking into a technological susceptible system. Cyberattacks can range from the installation of viruses on a personal computer to attempts to destroy the infrastructure of entire nations. We are exposed to this risk over the entire lifecycle of information, from the moment it is collected to its processing, transmission, storage, analysis and destruction.

A successful cyberattack may result in unavailability of our services, leak or compromise of the integrity of information and could give rise to the loss of significant amounts of client data and other sensitive information, as well as significant levels of liquid assets (including cash) as well as damage to our image, directly affecting our customers and partners. In addition, cyberattacks could give rise to the disabling of our information technology systems used to service our clients. As attempted attacks continue to evolve in scope and sophistication, we may incur significant costs in our attempt to modify or enhance our protective measures against such attacks, or to investigate or remediate any vulnerability or resulting breach.

If we fail to effectively manage our cybersecurity risk, for example, by failing to update our systems and processes in response to new threats, this could harm our reputation and adversely affect our operating results, financial condition and prospects through the payment of client compensation, regulatory penalties and fines and/or through the loss of assets. In addition, we may also be subject to cyber-attacks against critical infrastructures of Brazil or of the other countries where we operate. Our information technology systems are dependent on such critical infrastructure and any cyber-attack against such critical infrastructure could negatively affect our ability to service our clients.

According to the CMN Resolution No. 4,658, dated April 26, 2018, financial institutions must comply with new cyber risk management and cloud outsourcing requirements. We are required to be fully compliant by December 31, 2021.

In addition, according to regulation CVM Resolution No. 612, dated August 2019, securities market institutions must be fully compliant by September 2020.

Failure to comply with any of these new regulatory requirements could have an adverse effect on us.

The loss of senior management, or our ability to attract and maintain key personnel, could have a material adverse effect on us.

Our ability to maintain our competitive position and implement our strategy depends on our senior management. The loss of some of the members of our senior management, or our inability to maintain and attract additional personnel, could have a material adverse effect on our operations and our ability to implement our strategy.

20

Our performance and success are largely dependent on the talents and efforts of highly skilled individuals. Talent attraction and retention is one of the key pillars for supporting the results of our organization, which is focused on client satisfaction and sustainable performance. Our ability to attract, develop, motivate and retain the right number of appropriately qualified people is critical to our performance and ability to thrive globally. Concurrently, we face the challenge to provide a new experience to employees, so that we are able to attract and retain highly-qualified professionals who value environments offering equal opportunities and who wish to build up their careers in dynamic, cooperative workplaces, which encourage diversity and meritocracy and are up to date with new work models. Also, our current business scenario demands not only a careful look at traditional careers, but also at new career paths that are indispensable for our future.

Our performance could be adversely affected if we are unable to attract, retain and motivate key talent. As we are highly dependent on the technical skills of our personnel, including successors to crucial leadership positions, as well as their relationships with clients, the loss of key components of our workforce (particularly to emerging competitors, such as start-ups and fintechs), could make it difficult to compete, grow and manage the business. A loss of such expertise could adversely affect our financial performance, future prospects and competitive position.

Misconduct of our employees or representatives may adversely affect us.

Our business is based on institutional principles ("Our Way"), among which are "it's only good for us if it's good for the client" and "ethics are non-negotiable". However, part of the customer relationship depends on direct interaction with our employees or representatives. We cannot assure you that our individual employees will always comply with our internal policies and that our internal procedures will effectively monitor and identify misbehavior. Deviations in behavior such as inappropriate sales practices and improper use of information may occur. These risks can give rise to customer attrition, need of compensation or reimbursements, litigation and, according to its extension, may expose the institution to reputation risk, financial and credibility losses with the market and regulators.

We may not be able to prevent our officers, employees or third parties acting on our behalf from engaging in situations that qualify as corruption in Brazil or in any other jurisdiction, which could expose us to administrative and judicial sanctions, as well as have an adverse effect to us.

We are subject to Brazilian anticorruption legislation, and similarly-focused legislation of the other countries where we have branches and operations, as well as other anticorruption laws and regulatory regimes with a transnational scope. These laws require the adoption of integrity procedures to mitigate the risk that any person acting on our behalf may offer an improper advantage to a public agent in order to obtain benefits of any kind. Applicable transnational legislation, such as the U.S. Foreign Corrupt Practices Act and U.K. Bribery Act, as well as the applicable Brazilian legislation (mainly Brazilian Law No. 12,846/2013 - Lei Anticorrupção Brasileira), require us, among other things, the maintenance of policies and procedures aimed at preventing any illegal or improper activities related to corruption involving government entities and officials in order to secure any business advantage, and require us to maintain accurate books and a system of internal controls to ensure the accuracy of our books and prevent illegal activities. We have policies and procedures designed to prevent bribery and other corrupt practices. Unauthorized actions by our officers, employees or third parties acting on our behalf in breach of our internal policies may qualify as corruption in Brazil or in other jurisdiction and we could be exposed to administrative and judicial sanctions, accounting errors or adjustments, monetary losses and reputational damages or other adverse effects. The perception or allegations that we, our employees, our affiliates or other persons or entities associated with us have engaged in any such improper conduct, even if unsubstantiated, may cause significant reputational harm and other adverse effects.

We operate in international markets which subject us to risks associated with the legislative, judicial, accounting, regulatory, political and economic risks and conditions specific to such markets, which could adversely affect us or our foreign units.

We operate in various jurisdictions outside of Brazil through branches, subsidiaries and affiliates, and we expect to continue to expand our international presence. We face, and expect to continue to face, additional risks in the case of our existing and future international operations, including:

  • political instability, adverse changes in diplomatic relations and unfavorable economic and business conditions in the markets in which we currently have international operations or into which we may expand;
  • more restrictive or inconsistent government regulation of financial services, which could result in increased compliance costs and/or otherwise restrict the manner in which we provide our services;

21

  • difficulties in managing operations and adapting to cultural differences, including issues associated with (i) business practices and customs that are common in certain foreign countries but might be prohibited by Brazilian law and our internal policies and procedures and (ii) management and operational systems and infrastructures, including internal financial control and reporting systems and functions, staffing and managing of foreign operations, which we might not be able to do effectively or cost-efficiently.

As we expand into these and additional markets these risks could be more significant and have the potential to have an adverse impact on us.

Liquidity risk factor

We face risks relating to liquidity of our capital resources.

Liquidity risk, as we understand it, is the risk that we will not have sufficient financial resources to meet our obligations by the respective maturity dates or that we will honor such obligations but at an excessive cost. This risk is inherent in the activities of any commercial or retail bank.

Our capacity and cost of funding may be impacted by a number of factors, such as changes in market conditions (e.g., in interest rates), credit supply, regulatory changes, systemic shocks in the banking sector, and changes in the market's perception of us, among others.

In scenarios where access to funding is scarce and/or becomes too expensive, and the access to capital markets is either not possible or is limited, we may find ourselves obliged to increase the return rate paid to deposits made to attract more clients and/or to settle assets not compromised and/or potentially devalued so that we will be able to meet our obligations. If the market liquidity is reduced, the demand pressure may have a negative impact on prices, since natural buyers may not be immediately available. Should this happen, we may have a significant negative goodwill on assets, which will impact the bank's results and financial position. The persistence or worsening of such adverse market conditions or rises in basic interest rates may have a material adverse impact on our capacity to access capital markets and on our cost of funding.

Market Risk Factor

The value of our securities and derivatives is subject to market fluctuations due to changes in Brazilian or international economic conditions and, as a result, may subject us to material losses.

Market risk is the risk of losses due to movements in financial market prices.

The securities and derivative financial instruments in our portfolio may cause us to record gains and losses, when sold or marked to market (in the case of trading securities), and may fluctuate considerably from period to period due to domestic and international economic conditions. In addition, we may incur losses from fluctuations in the market value of positions held, including risks associated with transactions subject to variations in foreign exchange rates, interest rates, price indexes, equity and commodity prices.

We cannot predict the amount of realized or unrealized gains or losses for any future period. Gains or losses on our investment portfolio may not contribute to our net revenue in the future or may cease to contribute to our net revenue at levels consistent with more recent periods. We may not successfully realize the appreciation or depreciation now existing in our consolidated investment portfolio or in any assets of such portfolio.

Hedge Risk Factor

Our hedge strategy may not be able to prevent losses.

We use diverse instruments and strategies to hedge our exposures to a number of risks associated with our business, but we may incur losses if such hedges are not effective.

We may not be able to hedge our positions, or do so only partially, or we may not have the desired effectiveness to mitigate our exposure to the diverse risks and market in which we are involved. Any of these scenarios may adversely affect our business and financial results.

22

Underwriting Risk Factor

Inadequate pricing methodologies for insurance, pension plan and premium bond products may adversely affect us.

Our insurance and pension plan subsidiaries establish prices and calculations for our insurance and pension products based on actuarial or statistical estimates. The pricing of our insurance and pension plan products is based on models that include a number of assumptions and projections that may prove to be incorrect, since these assumptions and projections involve the exercise of judgment with respect to the levels and timing of receipt or payment of premiums, contributions, provisions, benefits, claims, expenses, interest, investment results, retirement, mortality, morbidity, and persistence. We could suffer losses due to events that are contrary to our expectations directly or indirectly based on incorrect biometric and economic assumptions or faulty actuarial bases used for contribution and provision calculations.

Although the pricing of our insurance and pension plan products and the adequacy of the associated reserves are reassessed on a yearly basis, we cannot accurately determine whether our assets supporting our policy liabilities, together with future premiums and contributions, will be sufficient for the payment of benefits, claims, and expenses. Accordingly, the occurrence of significant deviations from our pricing assumptions could have an adverse effect on the profitability of our insurance and pension products. In addition, if we conclude that our reserves and future premiums are insufficient to cover future policy benefits and claims, we will be required to increase our reserves and record these effects in our financial statements, which may have a material adverse effect on us.

Management Risk Factor

Our policies, procedures and models related to risk control may be ineffective and our results may be adversely affected by unexpected losses.

Our risk management methods, procedures and policies, including our statistical models and tools for risk measurement, such as value at risk, or VaR, for market risk default probability estimation models for credit risk or customer unusual behavior models for fraud detection or money-laundering risk identification, may not be fully effective in mitigating our risk exposure in all economic environments or against all types of risks, including those that we fail to identify or anticipate. Some of our qualitative tools and metrics for managing risk are based on our observations of the historical market behavior. In addition, due to limitations on information available in Brazil, to assess clients' creditworthiness, we rely largely on credit information available from our own databases, on certain publicly available consumer credit information and other sources. We apply statistical and other tools to these observations and data to quantify our risk exposure. These tools and metrics may fail to predict all types of future risk exposures. These risk exposures, for example, could arise from factors we did not anticipate or correctly evaluate in our statistical models. This would limit our ability to manage our risks. Our losses, therefore, could be significantly greater than indicated by historical measures. In addition, our quantified modeling may not take all risks into account. Our qualitative approach to managing those risks could prove insufficient, exposing us to material unexpected losses.

Our results of operations and financial position depend on our ability to evaluate losses associated with risks to which we are exposed and on our ability to build these risks into our pricing policies. We recognize an allowance for loan losses aiming at ensuring an allowance level compatible with the expected loss, according to internal models credit risk measurement. The calculation also involves significant judgment on the part of our management. Those judgments may prove to be incorrect or change in the future depending on information as it becomes available. These factors may adversely affect us.

Strategy Risk Factor

Our business strategy may not provide us the results we expect.

Our strategy and challenges are determined by management based on related assumptions, such as the future economic environment, and the regulatory, political and social scenarios in the regions in which we operate. These assumptions are subject to inaccuracies and risks that might not be identified or anticipated.

Accordingly, the results and consequences arising from any possible inaccurate assumptions may compromise our capacity to fully or partially implement strategies, as well as to achieve the results and benefits expected therefrom, which might give rise to financial losses and reduce the value creation to our stockholders.

Additionally, factors beyond our control, such as, but not limited to, economic and market conditions, changes in laws and regulations, including regulations limiting fees or interest rates and fostering an

23

increasingly competitive scenario, and other risk factors stated in this annual report may make it difficult or impossible to implement fully or partially our business model and also our achieving the results and benefits expected from our business plan.

Adverse changes to the political and economic scenario in Latin America may affect some of the challenges we have taken on, such as the internationalization of our business, since our strategy to strengthen our position in other countries is also dependent on the respective economic performance of these countries.

The integration of acquired or merged businesses involves certain risks that may have a material adverse effect on us.

As part of our growth strategy in the Brazilian and Latin American financial sector, we have engaged in a number of mergers, acquisitions and partnerships with other companies and financial institutions in the past and may pursue further such transactions in the future. Until we have signed a definitive agreement, we usually do not comment publicly on possible acquisitions. When we do announce, our stock price may fall depending on the size of the acquisition. Even though we review the companies we plan to acquire, it is generally not viable for these reviews to be complete in all respects. Any such transactions involve risks, such as the possible incurrence of unanticipated costs as a result of difficulties in integrating systems, finance, accounting and personnel platforms, failure in diligence or the occurrence of unanticipated contingencies, as well as the breach of the transaction agreements by counterparties. In addition, we may not achieve the operating and financial synergies and other benefits that we expected from such transactions in a timely manner, on a cost-effective basis or at all. There is also the risk that antitrust and other regulatory authorities may impose restrictions or limitations on the transactions or on the businesses that arise from certain combinations or impose fines or sanctions due to the interpretation by the authorities of irregularities with respect to a corporate merger, consolidation or acquisition.

If we are unable to take advantage of business growth opportunities, cost savings, operating efficiencies, revenue synergies and other benefits we anticipate from mergers and acquisitions, or if we incur greater integration costs than we have estimated, then we may be adversely affected.

Reputational Risk Factor

Damage to our reputation could harm our business and outlook.

We are highly dependent on our image and credibility to generate business. A number of factors may tarnish our reputation and generate a negative perception of the institution by our clients, counterparties, stockholders, investors, supervisors, commercial partners and other stakeholders, such as noncompliance with legal obligations, making irregular sales to clients, dealing with suppliers with questionable ethics, unauthorized disclosure of client data, inappropriate behavior by our employees, and third-party failures in risk management, among others. In addition, certain significant actions taken by third parties, such as competitors or other market participants, may indirectly damage our reputation with clients, investors and the market in general. If we are unable, or are perceived unable, to properly address these issues we may be subject to penalties, fines, class actions, and regulatory investigations, among others. Damages to our reputation among clients, investors and other stakeholders may have a material adverse effect on our business, financial performance and prospects.

Financial Reporting Risks Factor

We make estimates and assumptions in connection with the preparation of our financial statements, and any changes to those estimates and assumptions could have a material adverse effect on our operating results.

In connection with the preparation of our financial statements, we use certain estimates and assumptions based on historical experience and other factors. While we believe that these estimates and assumptions are reasonable under the circumstances, they are subject to significant uncertainties, some of which are beyond our control. Should any of these estimates and assumptions change or prove to have been incorrect, our reported operating results could be materially adversely affected.

As a result of the inherent limitations in our disclosure and accounting controls, misstatements due to error or fraud may occur and not be detected.

Our disclosure controls and procedures are designed to provide reasonable assurance that information required to be disclosed by us in reports we file with or submit to the SEC under the Exchange Act is accumulated and communicated to management, recorded, processed summarized and reported within the time periods specified in SEC rules and forms. We believe that any disclosure controls and procedures or

24

internal controls and procedures, including related accounting controls, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. These inherent limitations include the realities that judgments in decision making can be faulty and that breakdowns can occur because of simple error or mistake. In addition, controls can be circumvented by the individual acts of some persons, by collusion of two or more people or by an unauthorized override of the controls.

Any failure by us to maintain effective internal control over financial reporting may adversely affect investor confidence in our company and, as a result, the value of investments in our securities.

We are required under the Sarbanes-Oxley Act of 2002 to furnish a report by our management on the effectiveness of our internal control over financial reporting and to include a report by our independent auditors attesting to such effectiveness. Any failure by us to maintain effective internal control over financial reporting could adversely affect our ability to report accurately our financial condition or results of operations. If we are unable to conclude that our internal control over financial reporting is effective, or if our independent auditors determine that we have a material weakness or significant deficiency in our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, the market prices of our shares and ADSs could decline, and we could be subject to sanctions or investigations by the SEC or other regulatory authorities. Failure to remedy any material weakness in our internal control over financial reporting, or to implement or maintain other effective control systems required of public companies subject to SEC regulation, also could restrict our future access to the capital markets.

We adopt Brazilian accounting standards and managerial disclosures that differ from foreign standards, including from the U.S., with which U.S. stockholders are familiar.

For regulatory purposes, we prepare and make available consolidated financial statements under IFRS issued by IASB and under the Brazilian GAAP, which may differ from US GAAP in a number of ways. We use Brazilian generally accepted accounting practices applicable to institutions authorized to operate by the Central Bank ("Brazilian GAAP") for filing with the Brazilian Securities and Exchange Commission ("CVM") and for calculation of payment of dividends and tax liabilities. Furthermore, we disclose quarterly reports on managerial financial information not required in other countries. U.S. investors may be unfamiliar with these different accounting standards and managerial disclosures adopted by us.

Concentration Risk Factor

We face risks related to market concentration.

Concentration risk is the risk associated with potential high financial losses triggered by significant exposure to particular component of risk, whether it be related to a particular counterparty, industry or geographic concentration. Examples of such risks include significant exposure to a single counterparty, to counterparties operating in the same economic sector or geographical region, or to financial instruments that depend on the same index or currency.

We believe that an excessive concentration with respect to a particular risk factor could generate a relevant financial loss for us, especially if the risk is one described in this annual report. We recognize the importance of this risk and the potential impacts that may affect our portfolio and results of operations.

Competition Risk Factor

We face risks associated with the increasingly competitive environment, and recent consolidations in the Brazilian banking industry, as well as competition based on technological alternatives to traditional banking services.

The Brazilian market for financial and banking services is highly competitive. We face significant competition from other Brazilian and international banks, in addition to other non-financial companies competing in certain segments of the banking industry in which we operate. These latter competitors may not be subject to the same regulatory and capital requirements that we are and, therefore, may be able to operate with less stringent regulatory requirements.

Competition has increased as a result of recent consolidations among financial institutions in Brazil and of regulations that (i) increase the ability of clients to switch business between financial institutions, (ii) with the client's permission, grant access to financial and personal information in such institutions, and (iii) establish rules for an instant payment arrangement. Furthermore, digital technologies are changing the ways customers access banking services and the competitive environment with respect to such services. The use of digital channels has risen steadily over the past few years. In this context, new competitors are seeking to

25

disrupt existing business models through technological alternatives to traditional banking services. If we are not successfully able to compete with these disruptive business models and markets, we may lose market share and, consequently, lower our margins and profitability. Such increased competition may also adversely affect us by, among other things, limiting our ability to retain or increase our current client base and to expand our operations, or by impacting the fees and rates we adopt, which could reduce our profit margins on banking and other services and products we offer.

We are subject to Brazilian antitrust legislation and, if any, that of other countries in which we operate or will possibly operate.

We are subject to the Brazilian antitrust laws including No. 12,529/11, which address, particularly, infraction of the economic order. Accordingly, we are subject to penalties from Brazilian antitrust authorities (such as CADE), especially administrative fines and divestiture of assets. Additionally, we are subject to the antitrust legislation in the jurisdictions where we operate, such as the antitrust laws of the U.S. (Sherman Act and Clayton Antitrust Act) and of the European Union (Articles 101 and 102 of the Treaty on the Functioning of the European Union) or, if any, where we will possibly operate. In addition, according to CADE regulations and current understanding, we are given a dominant position in some banking services markets in Brazil by the said body. Consequently, we cannot assure that Brazilian and foreign antitrust regulations will not affect our business in the future.

  1. Its parent company, direct or indirect, or control group Strategy Risk

Our controlling stockholder has the ability to direct our business.

As of December 31, 2019, IUPAR, our controlling stockholder, directly owned 51.7% of our common shares and 26.1% of our total share capital, giving it the power to appoint and remove our directors and officers and determine the outcome of any action requiring stockholder approval, including transactions with related parties, corporate reorganizations and the timing of dividend payments.

In addition, IUPAR is jointly controlled by Itaúsa, which, in turn, is controlled by the Egydio de Souza Aranha family, and by Cia. E. Johnston, which in turn is controlled by the Moreira Salles family. The interests of IUPAR, Itaúsa and the Egydio de Souza Aranha and Moreira Salles families may be different from the interests of our other stockholders.

Certain of our directors are affiliated with IUPAR and circumstances may arise in which the interests of IUPAR and its affiliates conflict with the interests of our other stockholders. To the extent that these and other conflicting interests exist, our stockholders will depend on our directors duly exercising their fiduciary duties as members of our Board of Directors. Notwithstanding, according to Brazilian Corporation Law the controlling stockholders should always vote in the interest of the company. In addition, they are prohibited from voting in cases of conflict of interest in the matter to be decided.

c) Its stockholders

Risk Factors for ADS Holders

The relative price volatility and limited liquidity of the Brazilian capital markets may significantly limit the ability of our investors to sell the preferred shares underlying our ADSs, at the price and time they desire.

The investment in securities traded in emerging markets frequently involves a risk higher than an investment in securities of issuers from the U.S. or other developed countries, and these investments are generally considered more speculative. The Brazilian securities market is smaller, less liquid, more concentrated and can be more volatile than markets in the U.S. and other countries. Thus, an investor's ability to sell preferred shares underlying ADSs at the price and time the investor desires may be substantially limited.

The preferred shares underlying our ADSs do not have voting rights, except in specific circumstances.

Pursuant to our Bylaws, the holders of preferred shares and therefore of our ADSs are not entitled to vote in our general stockholders' meetings, except in specific circumstances. Even in such circumstances, ADS holders may be subject to practical restrictions on their ability to exercise their voting rights due to additional operational steps involved in communicating with these stockholders, as mentioned below.

26

According to the provisions of the ADSs deposit agreement, in the event of a general stockholders' meeting, we will provide notice to the depositary bank, which will, to the extent practicable, send such notice to ADS holders and instructions on how such holders can participate in such general stockholders' meeting, and ADS holders should instruct the depositary bank on how to vote in order to exercise their voting rights. This additional step of instructing the ADS depositary bank may make the process for exercising voting rights longer for ADS holders.

Holders of ADSs may be unable to exercise preemptive rights with respect to our preferred shares.

We may not be able to offer the U.S. holders of our ADSs preemptive rights granted to holders of our preferred shares in the event of an increase of our share capital by issuing preferred shares unless a registration statement relating to such preemptive rights and our preferred shares is effective or an exemption from such registration requirements of the Securities Act is available. As we are not obligated to file a registration statement relating to preemptive rights with respect to our preferred shares, we cannot assure that preemptive rights will be offered to you. In the event such registration statement is not filed (or in case filed, not declared effective) or if the exemption from registration is not available, the U.S. holders of our ADSs may not receive any value from the granting of such preemptive rights and have their interests in us diluted.

The surrender of ADSs may cause the loss of the ability to remit foreign currency abroad and of certain Brazilian tax advantages.

While ADS holders benefit from the electronic certificate of foreign capital registration obtained in Brazil by the custodian for our preferred shares underlying the ADSs, which permits the depositary bank to convert dividends and other distributions with respect to the preferred shares underlying the ADSs into foreign currency and remit the proceeds abroad, the availability and requirements of such electronic certificate may be adversely affected by future legislative changes.

If an ADS holder surrenders the ADSs and, consequently, receives preferred shares underlying the ADSs, such holder will have to register its investment in the preferred shares with the Central Bank either as

  1. a Foreign Direct Investment, subject to Law No. 4,131/62, which will require an electronic certificate of foreign capital registration, the Electronic Declaratory Registration of Foreign Direct Investment (RDE-IED), or
  2. as a Foreign Investment in Portfolio, subject to Resolution CMN No. 4,373/14, which among other requirements, requires the appointment of a financial institution in Brazil as the custodian of the preferred shares and legal representative of the foreign investor in the Electronic Declaratory Registration of Portfolio (RDE - Portfolio). The failure to register the investment in the preferred shares as foreign investment under one of the regimes mentioned above (E.g. RDE - IED or RDE - Portfolio) will impact the ability of the holder to dispose of the preferred shares and to receive dividends. Moreover, upon receipt of the preferred shares underlying the ADSs, Brazilian regulations require the investor to enter into corresponding exchange rate transactions and pay taxes on these exchange rate transactions, as applicable.

The tax treatment for the remittance of dividends and distributions on, and the proceeds from any sale of, our preferred shares is less favorable in case a holder of preferred shares obtains the RDE-IED instead of the RDE-Portfolio. In addition, if a holder of preferred shares attempts to obtain an electronic certificate of foreign capital registration, such holder may incur expenses or suffer delays in the application process, which could impact the investor's ability to receive dividends or distributions relating to our preferred shares or the return of capital on a timely manner.

The holders of ADSs have rights that differ from those of stockholders of companies organized under the laws of the U.S. or other countries.

Our corporate affairs are governed by our Bylaws and Brazilian Corporate Law, which may have legal principles that differ from those that would apply if we were incorporated in the U.S. or in another country. Under Brazilian Corporate Law, the holders of ADSs and the holders of our preferred shares may have different rights with respect to the protection of investor interests, including remedies available to investors in relation to any actions taken by our Board of Directors or the holders of our common shares, which may be different from what is provided in U.S. law or the law of another country.

d) Its subsidiary and affiliated companies

As we are a holding company, the risk factors that may influence the decision to invest in our securities arise essentially from the risk factors to which our subsidiary and affiliated companies are exposed, as described in Item 4.1.

27

  1. Its suppliers Operational risk factor

Some factors include events that are fully or partially beyond our control, such as power outages, interruption of telecommunication services, and generalized system failures, as well as internal and external events that may affect third parties with which we do business or that are crucial to our business activities (including stock exchanges, clearing houses, financial dealers or service providers). We have an ongoing supplier assessment process that mitigates the risk of interruption of the provision of services and materials

and of situations that may impact the bank's image.

f) Its clients

Credit Risks Factor

Past performance of our loan portfolio may not be indicative of future performance, changes in the profile of our business may adversely affect our loan portfolio. In addition, the value of any collateral securing our loans may not be sufficient, and we may be unable to realize the full value of the collateral securing our loan portfolio.

Our historical loan loss experience may not be indicative of our future loan losses. While the quality of our loan portfolio is associated with the default risk in the sectors in which we operate, changes in our business profile may occur due, among other factors, to our organic growth, merger and acquisition activity, changes in local economic and political conditions, a slowdown in customer demand, an increase in market competition, changes in regulation and in the tax regimes applicable to the sectors in which we operate and, to a lesser extent, other related changes in countries in which we operate and in the international economic environment. In addition, the market value of any collateral related to our loan portfolio may fluctuate, from the time we evaluate it at the beginning of the trade to the time such collateral can be executed upon, due to the factors related to changes in economic, political or sectorial factors beyond our control.

For example, when Brazilian banks increased their loan portfolio to consumers, particularly in the automotive sector. However, this increased demand for vehicle loans has been followed by a significant rise in the level of consumer indebtedness, leading to high nonperforming loan rates. As a result, many financial institutions recorded higher loan losses due to an increased volume of provisions and a decrease in loans for vehicle acquisition.

Any changes affecting any of the sectors to which we have significant lending exposure, and changes in the value of the collateral securing our loans, may result in a reduction in the value we realize from collateral and in our loan portfolio.

Consequentially, it may have an adverse impact on our results of operations and financial condition and it could also adversely affect the growth rate and the mix of our loan portfolio.

In addition, if we are unable to recover sums owed to us under secured loans in default through extrajudicial measures such as restructurings, our last recourse with respect to such loans may be to enforce the collateral secured in our favor by the applicable borrower. Depending on the type of collateral granted, we either have to enforce such collateral through the courts or through extrajudicial measures. However, even where the enforcement mechanism is duly established by the law, Brazilian law allows borrowers to challenge the enforcement in the courts, even if such challenge is unfounded, which can delay the realization of value from the collateral. In addition, our secured claims under Brazilian law will in certain cases rank below those of preferred creditors such as employees and tax authorities. As a result, we may not be able to realize value from the collateral, or may only be able to do so to a limited extent or after a significant amount of time, thereby potentially adversely affecting our financial condition and results of operations.

  1. Economic sectors in which the issuer operates Macroeconomic Risks Factor - International Scenario

Changes in economic conditions may adversely affect us.

Our operations are dependent upon the performance of the economies of the countries in which we do business, and Latin American countries in particular. Crises and volatility in the financial markets of

28

countries other than Brazil may affect the global financial markets and the Brazilian economy and may have a negative impact on our operations.

The demand for credit and financial services, as well as our clients' ability to repay, is directly impacted by macroeconomic variables, such as economic growth, income, unemployment rate, inflation, and fluctuations in interest and foreign exchange rates.

Disruptions and volatility in the global financial markets may have significant consequences in the countries in which we operate, such as volatility in the prices of securities, interest rates and foreign exchange rates. Higher uncertainty and volatility may result in a slowdown in the credit market and the economy, which, in turn, could lead to higher unemployment rates and a reduction in the purchasing power of consumers. In addition, such events may significantly impair our clients' ability to perform their obligations and increase overdue or non-performing loans, resulting in an increase in the risk associated with our lending activity.

The economic and market conditions of other countries, including the United States, countries of the European Union, and emerging markets, may affect the credit availability and the volume of foreign investments in Brazil and in the countries in which we do business, to varying degrees.

The new COVID-19 pandemic added a new source of uncertainty to global economic activity. The number of cases has accelerated significantly in early 2020, and authorities around the world have taken measures to try to contain the spread of the disease, since the virus has spread globally. Restrictions will likely remain in place, suppressing activity, if the contagion does not subside. The materialization of these risks has affected global growth and may decrease investors' interest in assets from Brazil and other countries in which we do business, which has adversely affected the market price of our securities, possibly making it more difficult for us to access capital markets and, as a result, to finance our operations in the future.

We are exposed to certain risks that are particular to emerging and other markets.

In conducting our business in Brazil, as well as other emerging markets, we are subject to political, economic, legal, operational and other risks that are inherent to operating in these countries. Banks that operate in countries considered to be emerging markets, including us, may be particularly susceptible to disruptions and reductions in the availability of credit or increases in financing costs, which may have a material adverse impact on our operations. In particular, the availability of credit to financial institutions operating in emerging markets is significantly influenced by an aversion to global risk. In addition, any factor impacting investors' confidence, such as a downgrade in sovereign credit ratings (since the ratings of financial institutions, such as us, tends to be capped to the sovereign's rating) or an intervention by a government or monetary authority in one of such markets, may affect the price or availability of resources for financial institutions in any of these markets, which may affect us.

In Argentina, the new government that took office in December 2019 announced fiscal austerity measures (focusing mostly on higher taxes), while capital controls were reinforced, payments on foreign currency debt under local law were suspended and the outcome of the sovereign debt renegotiation remains uncertain. We expect Argentina's GDP to decrease by 6.4% this year. In Chile, protests led political actors to agree on a referendum process to decide on a new constitution. Recently protest activity was halted due to the COVID-19 pandemic and the referendum was postponed. However, uncertainty over the constitutional process and other reforms will likely continue to curb business confidence and economic growth, despite expansionary fiscal and monetary policies. In Colombia the oil-price shock adds to the COVID-19 pandemic and social unrest, reducing the prospects for fiscal consolidation and risking the country´s investment grade status.

Crises in these countries may decrease investors' interest in Brazilian assets, which may materially and adversely affect the market price of our securities, making it more difficult for us to access capital markets and, as a result, to finance our operations in the future. Global financial crises, in addition to the Brazilian macroeconomic environment, may also affect in a material and adverse way the market price of securities of Brazilian issuers or lead to other negative effects in Brazil and in the countries in which we operate and have a material adverse effect on us.

29

Macroeconomic Risks Factor - Domestic Scenario

Brazilian authorities exercise influence over the Brazilian economy. Changes in fiscal, monetary and foreign exchange policies as well as a deterioration of government fiscal accounts, may adversely affect us.

Our operations are highly dependent upon the performance of the Brazilian economy. The demand for credit and financial services, as well as our clients' ability to make payments when due, is directly impacted by macroeconomic variables, such as economic growth, income, unemployment, inflation, and fluctuations in interest and foreign exchange rates.

From 2004 to 2013, we benefited from Brazil's generally stable economic environment, with average annual GDP growth of approximately 4.0% during that period, which led to increased bank lending and deposits. The following years were less favorable, as GDP growth slowed to 0.5% in 2014 then decreased by 3.5% in 2015 and 3.3% in 2016. From 2017, growth has been improving gradually, as GDP expanded 1.3% in both 2017 and 2018. In 2019, GDP expanded 1.1%. In the long term, growth may be limited by a number of factors, including structural factors, such as inadequate infrastructure, which entail risks of potential energy shortages and deficiencies in the transportation sector, among others, and lack of qualified professionals, which can reduce the country's productivity and efficiency levels. Low levels of national savings require relatively large financial flows from abroad, which may falter if political and fiscal instability is perceived by foreign investors. Depending on their intensity, these factors could lead to decreasing employment rates and to lower income and consumption levels, which could result in increased default rates on loans we grant for individuals and non-financial corporations and, therefore, have a material adverse effect on us.

Brazilian authorities intervene from time to time in the Brazilian economy, through changes in fiscal, monetary, and foreign exchange policies, which may adversely affect us. These changes may impact variables that are crucial for our growth strategy (such as foreign exchange and interest rates, liquidity in the currency market, tax burden, and economic growth), thus limiting our operations in certain markets, affecting our liquidity and our client's ability to pay and, consequently, affecting us.

Fiscal

The Brazilian primary public accounts have deteriorated since 2014. To address the structural fiscal imbalance, the Brazilian Congress approved a ceiling on government spending that will limit primary public expenditure growth to the prior year's inflation for a period of at least ten years, effective as of 2017. Further, Congress approved a comprehensive social security reform and government started an asset sale program, creating conditions to a cyclical decrease of the public debt, while the primary result gradually improves. In order to guarantee that the spending ceiling remains feasible in the years ahead, government has proposed further reforms to Congress, including constitutional amendments to limit public spending and the yet to be presented Administrative Reform. However, these discussions were temporarily put aside because of the COVID-19 pandemic. We expect temporarily larger deficits to pay for measures to mitigate the impacts of coronavirus. Since we do not expect the COVID-19 measures to create permanent expenses, the gradual fiscal adjustment provided by the spending cap can be resumed from 2021 onward. If the government fails to persist on the fiscal adjustment agenda, the local economy would be negatively impacted, with a depreciation of the Brazilian real, an increase in inflation and interest rates and a deceleration of economic growth, thus adversely affecting our business, results of operations and financial condition.

Monetary

Sudden increases in prices and long periods of high inflation may cause, among other effects, loss of purchasing power and distortions in the allocation of resources in the economy. Measures to combat high inflation rates include a tightening of monetary policy, with an increase in the short-term interest rate (SELIC), resulting in restrictions on credit and short-term liquidity, which may have a material adverse effect on us. Changes in interest rates may have a material effect on our net margins, since they impact our funding and credit granting costs. In addition, increases in the SELIC interest rate could reduce demand for credit and

30

increase the costs of our reserves and the risk of default by our clients. Conversely, decreases in the SELIC interest rate could reduce our gains from interest-bearing assets, as well as our net margins.

The Central Bank's Monetary Policy Committee (the "COPOM") was created on June 20, 1996 and is responsible for setting the SELIC interest rate. The COPOM meets eight times a year, every 45 days. The aim in creating the COPOM was to enhance monetary policy transparency and confer adequate regularity to the monetary policy decision-making process. Currently, many central banks around the world follow similar procedures, facilitating the decision-making process, monetary policy transparency and communication with the public.

After reaching 14.25% per annum at the end of 2015, the Central Bank began to cut interest rates in October 2016. The SELIC rate reached 4.50% in December 2019 and 3.0% in May 2020. The widespread decline in inflation, due to the high level of idle capacity in the Brazilian economy, as well as anchored inflation expectations have resulted in the SELIC reaching historically low levels.

COVID-19 or any other pandemic disease and health events could affect the economies of the countries in which we operate, our business operations or our financial condition and results of operations.

Public health crises, or the public perception of the risks of public health crises, such as the outbreak of the COVID-19 pandemic, may negatively impact economic activity in Brazil and in other countries in which we operate. Accordingly, our results of operations or financial condition may be adversely affected.

The outbreak of COVID-19 was first reported on December 31, 2019 in Wuhan, Hubei Province, China. From Wuhan, the disease spread rapidly to other parts of China, as well as other countries, including the countries in which we operate, growing into a global pandemic, as declared by the World Health Organization. Since the outbreak began, countries have responded by taking various measures including imposing mass quarantines, restricting travel, limiting public gatherings and suspending certain economic activities. In addition, concerns related to COVID-19 have lowered equity market valuations, decreased liquidity in fixed income markets and created significant volatility and disruption in global financial markets, resulting in increased volatility of stock prices (including the price of our stock), a trend which may continue. Also, there are other broad and continuing concerns related to the potential effects of COVID-19 on international trade (including supply chain disruptions and export levels), travel, employee productivity, employee illness, increased unemployment levels, securities markets, and other economic activities that may have a destabilizing effect on financial markets and economic activity, including companies in the financial sector. Furthermore, any actions taken by governmental authorities and other third parties in response to the pandemic may negatively impact our business, results of operations and financial condition.

The first case of COVID-19 in Brazil was detected on February 25, 2020. As of the date of this Annual Report on Reference Form, the Brazilian Federal and State governments have taken various measures in order to prepare the country for mass contagion, including partial lockdown for some regions. Further government actions may be imposed according to when and how the peak of contagion will occur.

From a macroeconomic point of view, the impact of COVID-19 in Brazil is uncertain. Our estimates indicate that COVID-19 could result in a decline of 2.5% in Brazilian GDP in 2020, from our prior estimate of an increase of 1.8%. However, it is worth noting that there is a considerable degree of uncertainty about GDP growth forecasts for this year, which stems from uncertainty about (i) the duration of the lockdown / isolation measures and (ii) the pace of recovery in the second half of 2020. It is reasonable to believe that, the longer the duration of the isolation measures, the slower the recovery will be in the second half of this year, since the consequences on the financial condition of corporates and households tend to be more intense, delaying the normalization. Economic stagnation, contraction and increased unemployment levels may affect our cost of funding, the recoverability and value of our assets and could result in higher past-due loans, given the deteriorated financial condition of our customers and, therefore, higher provisions for loans losses, resulting in lower net income.

The COVID-19 pandemic has also resulted in increased volatility in both the local and the international financial markets and economic indicators, such as exchange rates, interest rates and credit spreads. Any

31

shocks or unexpected movements in these market factors could result in financial losses associated with our trading portfolio or financial assets, which could deteriorate our financial condition. Furthermore, market concerns could translate into liquidity constraints and reduced access to funding in both the local and the international markets, negatively affecting our business.

As the COVID-19 pandemic continues to impact economic activity globally, we, our employees, contractors, suppliers, customers and other business partners may be prevented from conducting certain business activities for an indefinite period of time. In addition, preventive measures - either imposed by governments or voluntarily adopted by companies - may lead to our customers being unable to transact business and meet their obligations with us. Consequently, the COVID-19 pandemic may have an adverse effect on our operations. Further, given the uncertainty regarding the extent and timing of contagion, as well as the imposition (or relaxation) of protective measures, we cannot reasonably estimate the impact on our future results of operations, cash flows or financial condition as of the date of this Annual Report on Reference Form.

Ongoing high profile anti-corruption investigations in Brazil may affect the perception of Brazil and domestic growth prospects.

Certain relevant Brazilian companies in the energy, infrastructure and oil and gas sectors are facing investigations by the CVM, the SEC, the U.S. Department of Justice (DOJ), the Brazilian Federal Police and other Brazilian public entities who are responsible for corruption and cartel investigations, in connection with corruption allegations (so called Lava Jato investigations) and, depending on the outcome of such investigations and the time it takes to conclude them, they may face (as some of them already faced) downgrades from credit rating agencies, experience (as some of them already experienced) funding restrictions and have (as some of them already had) a reduction in revenues, among other negative effects. Such negative effects may hinder the ability of those companies to timely honor their financial obligations bringing loses to us as a number of them are our clients. The companies involved in the Lava Jato investigations, a number of which are our clients, may also be (as some of them already have been) prosecuted by investors on the grounds that they were misled by the information released to them, including their financial statements. Moreover, the current corruption investigations have contributed to reduce the value of the securities of several companies. The investment banks (including Itau BBA Securities in NY) that acted as underwriters on public distributions of securities of such investigated companies, and Banco Itau International, private banking vehicle of Itau in Miami, were in the recent past also parties to certain related lawsuits in the U.S., that were either settled or dismissed, and may be parties to other legal proceedings yet to be filed. We cannot predict how long the corruption investigations may continue, or how significant the effects of the corruption investigations may be for the Brazilian economy and for the financial sector that may be investigated for the commercial relationships it may have held with companies and persons involved in Lava Jato investigations. Another high profile investigation, besides Lava Jato, ongoing in Brazil is the so-called Zelotes operation. If the allegations of such investigations are confirmed they may also affect some of our clients and their credit trustworthiness. In March 2016, the Brazilian Internal Revenue Services, or Brazilian IRS, summoned us to account for certain tax proceedings related to BankBoston Brazil which came under investigation in relation to the Zelotes operations. We acquired BankBoston Brazil's operation from Bank of America in 2006. On December 1, 2016, the Brazilian Federal Police conducted searches at Itaú Unibanco's premises, to look for documents related to those proceedings, and documents related to payments made to lawyers and consultants that acted on those proceedings. We clarify that the agreement with Bank of America for the acquisition of BankBoston Brazil's operations included a provision whereby the seller would remain liable and responsible for the conduct of BankBoston's tax proceedings, including with regard to the retention of lawyers and consultants. Therefore, according to such agreement, any and all payments made by Itaú Unibanco to lawyers and consultants were made strictly on behalf of Bank of America. On July 2017, the Brazilian Federal Public Prosecutor indicted some lawyers and public agents regarding this case, based on their potential participation on the scheme. None of them was Itau´s employees or executives. We remain fully available and will cooperate with the authorities should any further clarification be needed. After reviewing our control procedures and our monitoring systems, we believe we are in compliance with the existing standards, especially related to anti-money laundering standards; notwithstanding, due to the size and breadth of our operations and our commercial relationship with investigated companies or persons, and due to the several banks, both publicly and privately owned, that Itaú Unibanco acquired throughout the last fifteen years, we

32

may also come within the scope of investigations, which may ultimately result in reputational damage, civil or criminal liability. Negative effects on a number of companies may also impact the level of investments in infrastructure in Brazil, which may also lead to lower economic growth. It was recently reported by the press that Antonio Palocci Filho and Eike Fuhrken Baptista da Silva, upon entering into plea bargain agreements in connection with investigations conducted by Brazilian criminal prosecution bodies, have mentioned alleged irregularities in election donations and market manipulation, respectively, performed by some Brazilian banks, including Itaú Unibanco and Itaú BBA. It is important to reinforce that neither Itaú Unibanco nor Itaú BBA have had access to the content of such plea bargains nor have they been served with notice of process from any official bodies. Come what may, Itaú Unibanco and Itaú BBA strongly deny the alleged reported facts, reinforcing that they have never made election donations aimed to meet private interests and that all their operations carried out in the capital and credit markets are in accordance with applicable legislation and are overseen by proper authorities.

  1. Regulation of the sectors in which the issuer operates Banking Regulation Risk Factor

We are subject to regulation on a consolidated basis and may be subject to liquidation or intervention on a consolidated basis.

We operate in a number of credit and financial services related sectors through entities under our control. For purposes of regulation and supervision, the Central Bank treats us and our subsidiaries and affiliates as a single financial institution. While our consolidated capital base provides financial strength and flexibility to our subsidiaries and affiliates, their individual activities could indirectly put our capital base at risk. Any investigation or intervention by the Central Bank, particularly in the activities carried out by any of our subsidiaries and affiliates, could have a material adverse impact on our other subsidiaries and affiliates and, ultimately, on us. If we or any of our financial subsidiaries become insolvent, the Central Bank may carry out an intervention or liquidation process on a consolidated basis rather than conduct such procedures for each individual entity. In the event of an intervention or a liquidation process on a consolidated basis, our creditors would have claims on our assets and the assets of our consolidated financial subsidiaries. In this case, claims of creditors of the same nature held against us and our consolidated financial subsidiaries would rank equally in respect of payment. If the Central Bank carries out a liquidation or intervention process with respect to us or any of our financial subsidiaries on an individual basis, our creditors would not have a direct claim on the assets of such financial subsidiaries, and the creditors of such financial subsidiaries would have priority in relation to our creditors in connection with such financial subsidiaries' assets. The Central Bank also has the authority to carry out other corporate reorganizations or transfers of control under an intervention or liquidation process.

Changes in applicable law or regulations may have a material adverse effect on our business.

Changes in the law or regulations applicable to financial institutions in Brazil may affect our ability to grant loans and collect debts in arrears, which may have an adverse effect on us. Our operations could also be adversely affected by other changes, including with respect to restrictions on remittances abroad and other exchange controls as well as by interpretations of the law by courts and agencies in a manner that differs from our legal advisors' opinions.

In the context of economic or financial crises, the Brazilian government may also decide to implement changes to the legal framework applicable to the operation of Brazilian financial institutions. For example, in response to the global financial crisis which began in late 2007, Brazilian national and intergovernmental regulatory entities, such as the BCBS, proposed regulatory reforms aiming to prevent the recurrence of similar crises, which included a new requirement to increase the minimum regulatory capital (Basel III).

Moreover, the Brazilian Congress is considering enacting new legislation that, if signed into law as currently drafted, could have an adverse effect on our activities. In 2019, multiple bills sought to limit interest rates, particularly for credit cards' facilities (rotativo do cartão) and overdrafts facilities (cheque especial) - the latter, with limits that are more restrictive than those recently imposed by the Central Bank. Further caps on

33

interest rates may be adopted. Furthermore, a proposed law to amend the Brazilian consumer protection code would allow courts to modify terms and conditions of credit agreements in certain circumstances, imposing certain difficulties for the collection of amounts from final consumers. Another example is the proposed Private Security Statute that may prohibit foreign capital and participation of financial institutions in cash in transit companies and, as such, limit the number of possible suppliers (security is a relevant part of operating costs). Congress is also discussing a comprehensive tax reform that would unify multiple indirect taxes into a single rate Value Added Tax (VAT). If the VAT were to be applied on interest rates, the amount of indirect taxes paid by borrowers would increase significantly, which could affect the size of the credit market. In 2020, Congress is also expected to put to a vote a bill that will allow the execution of convictions after condemnation in the second instance court, both in the criminal and in the civil spheres, before the exhaustion of all available appeals. If signed into law, the bill may have an impact on the execution of tax debts proceedings of which the bank is part.

In addition, local or state legislatures may from time to time consider bills intending to impose security measures and standards for customer services, such as setting branch opening hours, requiring 24 hour armed guard personnel and specifications on ATM functioning, among others, that, if signed into law, could affect our operations. More recently, certain bills have passed (and others were proposed) in certain Brazilian states or municipalities that affect our ability to evaluate credit risk and collect outstanding debts. For example, legislators often impose, or aim to impose, restrictions on the ability of creditors to include the information about insolvent debtors in the records of credit protection bureaus. These types of restrictions could also adversely affect our ability to collect outstanding credit.

We also have operations outside of Brazil, including, but not limited to, Argentina, the Bahamas, the Cayman Islands, Chile, Colombia, Paraguay, Portugal, Switzerland, the United Kingdom, the United States and Uruguay. Changes in the laws or regulations applicable to our business in the countries where we operate, or the adoption of new laws, and related regulations, may have an adverse effect on us.

Increases in compulsory deposit requirements may have a material adverse effect on us.

Compulsory deposits are reserves that financial institutions are required to maintain with the Central Bank. Compulsory deposits generally do not provide the same returns as other investments and deposits because a portion of these compulsory deposits does not bear interest. The Central Bank has periodically changed the minimum level of compulsory deposits reserves that financial institutions are required to maintain with the Central Bank.

Insurance Regulations

Our insurance operation is subject to regulatory agencies, such as SUSEP and ANS. Therefore, we may be affected negatively by the penalties applied by such regulators.

Insurance companies are subject to SUSEP intervention and/or liquidation. In case of insufficient resources, technical reserves, or poor economic health with respect to a regulated entity, SUSEP may appoint an inspector to act within the relevant company. If such intervention does not remedy the issue, SUSEP will forward to CNSP a proposal to withdraw the applicable insurance license. In addition, insurance companies are subject to pecuniary penalties, warnings, suspension of authorization of activities and disqualification to engage in business activities as set in Law.

Health insurance companies are subject to ANS regulations. With respect to companies that are deemed to have financial imbalances or serious economic, financial or administrative irregularities, ANS may order the disposal of the applicable health insurance company's portfolio, or take other measures, such as fiscal or technical direction regime for a period not exceeding 365 days, or extrajudicial liquidation. The penalties established for violations committed by health insurance companies and their directors and officers are: (i) warnings; (ii) pecuniary penalties; (iii) suspension of company's activities; (iv) temporary disqualification for the exercise of management positions in health insurance companies; (v) permanent disqualification for the exercise of management positions in health insurance companies as well as in open private pension funds,

34

insurance companies, insurance brokers and financial institutions; and (vi) the cancellation of the company's authorization to operate and sale of its portfolio.

In this sense, our insurance operation may be affected negatively by the penalties applied by SUSEP or ANS, as described above.

Capital Market and Tax Regulations

Holders of our shares and ADSs may not receive any dividends.

Corporations in Brazil are legally required to pay their stockholders a minimum mandatory dividend at least on a yearly basis (except in specific cases provided for in applicable law). Our Bylaws determine that we must pay our stockholders at least 25% of our annual net income calculated and adjusted pursuant to Brazilian Corporate Law. Applicable Brazilian legislation also allows corporations to consider the amount of interest on shareholders' equity distributed to their stockholders for purposes of calculating the minimum mandatory dividends. The calculation of net income pursuant to the Brazilian Corporate Law may significantly differ from our net income calculated under IFRS.

Brazilian Corporate Law also allows the suspension of the payment of the mandatory dividends in any particular year if our Board of Directors informs our general stockholders' meeting that such payment would be incompatible with our financial condition. To suspend the dividend payments, our Fiscal Council is required to furnish to the CVM an opinion on the matter along with a statement by our executives. Therefore, upon the occurrence of such event, the holders of our shares and ADSs may not receive any dividends. If this happens, the dividends that were not paid in the particular fiscal year shall be registered as a special reserve and, if not used to cover any losses of subsequent years, the amounts of unpaid dividends still available under such reserve shall be distributed when the financial condition of the corporation allows for such payment.

Furthermore, pursuant to its regulatory powers provided under Brazilian law and banking regulations, the Central Bank may at its sole discretion reduce the dividends or determine that no dividends will be paid by a financial institution if such restriction is necessary to mitigate relevant risks to the Brazilian financial system or the financial institution.

For further details about CMN's capital requirements and dividends and interest on capital see "Note

2.4 - Summary of Main Accounting Practices, q) Dividends and Interest on Capital" and "Note 19 - Stockholders' Equity" to our audited consolidated financial statements.

Tax reforms may adversely affect our operations and profitability.

The Brazilian government regularly amends tax laws and regulations, including by creating new taxes, which can be temporary, and changing tax rates, the basis on which taxes are assessed or the way taxes are calculated, including in respect of tax rates applicable solely to the banking industry.

Currently, the Brazilian Congress is discussing a broad tax reform and there is no clarity as to when such reform may ultimately be enacted. If adopted, any such tax reform may affect our business by increasing our costs, limiting our profitability or having other impacts.

Litigation Risk

Unfavorable court decisions involving material amounts for which we have no or partial provisions or in the event that the losses estimated turn out to be significantly higher than the provisions made, may adversely affect our results and financial condition.

As part of the ordinary course of our business, we are subject to, and party to various civil, tax and labor lawsuits, which involve financial risks. Our audited consolidated financial statements only include reserves for probable losses that can be reasonably estimated and eventual expenses that we incur in connection with litigation or administrative proceedings, or as otherwise required by Brazilian law. It is currently

35

not possible to estimate the amount of all potential costs that we may incur or penalties that may be imposed on us other than those amounts for which we have reserves. In the event of unfavorable court decisions involving material amounts for which we have no or partial provisions, or in the event that the losses estimated turn out to be significantly higher than the provisions made, the aggregate cost of unfavorable decisions, may adversely affect our results and financial condition.

Decisions on lawsuits due to government monetary stabilization plans may have a material adverse effect on us.

We are a defendant in lawsuits for the collection of understated inflation adjustment for savings resulting from the economic plans implemented in the 1980s and 1990s by the Brazilian government as a measure to combat inflation.

Itaú Unibanco Holding is a defendant in lawsuits filed by individuals, as well as class actions filed by

  1. consumer protection associations; and (ii) the public attorneys' office (Ministério Público) on behalf of holders of savings accounts. In connection with these class actions, we established provisions upon service of the individual claim requiring the enforcement of a judgment handed down by the judiciary, using the same criteria used to determine the provisions of individual actions.

The STF has issued a number of decisions in favor of the holders of savings accounts, but has not ruled regarding the constitutionality of economic plans and their applicability to savings accounts. Currently, the appeals on this issue are suspended by order of the STF, until there is a definitive decision by the STF regarding the constitutional issue.

In December 2017, under the mediation of the Advocacia-Geral da União (or AGU), the representative entities of banks and the representative entities of holders of savings accounts entered into an agreement with the objective of ending the litigation related to economic plans against the Brazilian banks. The agreement establishes the conditions for the voluntary adhesion of the holders of savings accounts for the receiving of amounts and closure of processes.

The agreement was ratified at a plenary session of the STF on March 1, 2018 and the holders of savings accounts were able to adhere to its terms for a period of 24 months.

Due to the end of this period, in March 2020, the parties signed an addendum to the agreement instrument to extend the period of adhesion for another 60 months to include a greater number of the holders of savings accounts and consequently increase the closure of processes. For the validity and effects of this additive, the approval of the STF will be necessary, and is expected to occur in the second quarter of 2020.

As such, low adherence to the agreement and an eventual unfavorable judgment by the STF may result in Brazilian banks incurring relevant costs, which could have an adverse effect on our financial position. We are currently working with the courts to encourage adherence.

Tax assessments may adversely affect us.

As part of the normal course of business, we are subject to inspections by federal, municipal and state tax authorities. These inspections, arising from the divergence in the understanding of the application of tax laws may generate tax assessments which, depending on their results, may have an adverse effect on our financial results. Also due to such proceedings and for other reasons we may be thwarted by a court decision to pay dividends and other distributions to our shareholders.

i) Foreign countries in which the issuer operates

The risk factors related to foreign countries that may influence the decision to invest in our securities are described in sub items (a), (g), and (h) of this item 4.1.

36

  1. Environmental and social (E&S) issues Environmental and Social Risk

We may incur financial losses and damages to our reputation from environmental and social risks.

Environmental and social risk is considered a material issue for our business, since it can affect the creation of shared value in the short, medium and long terms, from the standpoint of our organization and our main stakeholders. Further, we understand environmental and social risk as the possibility of losses due to exposure to environmental and social events arising from the performance of our activities.

CMN Resolution 4,327/2014, provides minimum requirements for environmental and social responsibility policies for financial institutions. Accordingly, we are required to assess environmental and social risks and evaluate data from environmental and social related financial losses. The Central Bank is responsible for supervising the implementation of such regulation.

Environmental and social issues may affect our activities and the revenue of our clients, causing delinquency or default, especially in case of relevant environmental and social events.

These risks are more pronounced when we provide financial support for clients and projects, as we could be held indirectly liable for supporting such activity in case of environmental or social damage. To mitigate these risks, we conduct diligence procedures prior to the approval of new financial support.

We also recognize climate risk as an emerging environmental and social risk, given climate change offers relevant risks and opportunities for our business, and consider it in our due diligence processes. Climate change is a risk as it affects our clients, suppliers and our operations, including in administrative buildings, our network of branches and data processing centers.

Finally, our reputation could be affected if we do not fully comply with voluntary commitments, such as Equator Principles, Principles for Responsible Investment and National Pact for the Eradication of Slave Labor among others.

4.2. Describe, on a quantitative and qualitative basis, the main market risks to which the issuer is exposed, including those related to foreign exchange and interest rate risks.

a) Our definition of market risk

Market risk is the possibility of losses resulting from fluctuations in the market value of positions held by a financial institution, including the risk of operations subject to variations in foreign exchange rates, interest rates, price indexes, equity and commodity prices.

b) Our market risk governance

Our policies and general market risk management framework are in line with the principles of CMN Resolution No. 4,557, and its subsequent amendments. These principles guide our approach to market risk control across our Itaú Unibanco Group.

Our market risk management strategy is aimed at balancing corporate business goals, taking into account, among other factors:

  • Political, economic and market conditions;
  • The profile of our portfolio; and
  • Capacity to act in specific markets.

The key principles underlying our market risk control structure are as follows:

37

  • Provide visibility and comfort for all senior management levels that market risks assumed must be in line with our risk-return objectives;
  • Provide disciplined and informed dialogue on the overall market risk profile and its evolution over time;
  • Increase transparency as to how the business works to optimize results;
  • Provide early warning mechanisms to facilitate effective risk management, without obstructing the business objectives; and
  • Monitor and avoid risk concentration.

Market risk is controlled by an area independent of the business units, which is responsible for the daily activities: (i) measuring and assessing risk; (ii) monitoring stress scenarios, limits and alerts; (iii) applying, analyzing and stress testing scenarios; (iv) reporting risk to the individuals responsible in the business units, in compliance with our governance procedures; (v) monitoring the measures needed to adjust positions and/or risk levels to make them viable; and (vi) supporting the secure launch of new financial products.

The CMN has regulations establishing the segregation of market risk exposure at a minimum into risk factors, such as: interest rates, exchange rates, stocks and commodities. Brazilian inflation indexes are also treated as a group of risk factors and follow the same structure.

Our structure of limits and alerts follows the Board of Directors guidelines, which are reviewed and approved by our Board of Directors on an annual basis. This structure extends to specific limits and is aimed at improving the process of risk monitoring and understanding as well as preventing risk concentration. Limits and alerts are calibrated based on projections of future balance sheets, stockholders' equity, liquidity, complexity and market volatility, as well as our risk appetite.

c) Our market risk procedures and metrics

In an attempt to fit the transactions into the defined limits, we hedge transactions with clients and proprietary positions, including investments overseas. Derivatives are the most commonly used instruments for carrying out these hedging activities, and can be characterized as either accounting or economic hedge, both of which are governed by our institutional regulations.

Our market risk framework categorizes transactions as 'Trading Book' or 'Banking Book', in accordance with general criteria established by specific regulation.

Our Trading Book is composed of all trades with financial and commodity instruments (including derivatives) undertaken with the intention of trading.

Our Banking Book is predominantly characterized by portfolios originated from the banking business and operations related to balance sheet management, and intended to be either held to maturity, or sold in the medium or long term.

Market risk management is based on the following key metrics:

  • Value at Risk (VaR): a statistical metric that quantifies the maximum potential economic loss expected in normal market conditions, considering a defined holding period and confidence interval;
  • Losses in Stress Scenarios (Stress Testing): a simulation technique to evaluate the impact, in the assets, liabilities and derivatives of the portfolio, of various risk factors in extreme market situations (based on prospective and historic scenarios);
  • Stop Loss: metrics that trigger a management review of positions, if the accumulated losses in a given period reach specified levels;
  • Concentration: cumulative exposure of certain financial instruments or risk factors calculated at market value (mark to market); and
  • Stressed VaR: a statistical metric derived from VaR calculation, aimed at capturing the biggest risk in simulations of the current portfolio, taking into consideration the observable returns in historical scenarios of extreme volatility.

38

In addition to the risk metrics described above, sensitivity and loss control measures are also analyzed. They include:

  • Gap Analysis: accumulated exposure of cash flows by risk factor, which are marked-to-market and positioned by settlement dates;
  • Sensitivity (DV01 - Delta Variation Risk): impact on the market value of cash flows when a one basis point change is applied to current interest rates or on the index rates; and
  • Sensitivities to Various Risk Factors (Greek): partial derivatives of a portfolio of options on the prices of the underlying assets, implied volatilities, interest rates and time.

Please see "Note 32 - Risk and Capital Management" to our audited consolidated financial statements for further details about market risk.

VaR - Consolidated Itaú Unibanco Holding

Our consolidated VaR is calculated through the Historical Simulation. The assumption underlying Historical Simulation is that the expected distribution for the possible gains and losses (P&Ls-Profit and Loss Statement) for a portfolio over a desired time horizon can be estimated based on the historical behavior of the returns of the market risk factors to which this portfolio is exposed. For the VaR calculation of non-linear instruments, a full re-pricing is carried out (full valuation), without any potential simplifications in the calculation.

The VaR is calculated with a confidence interval of 99%, a historical period of 4 years (1000 working days) and a holding period that varies in accordance with the portfolio's market liquidity, considering a minimum horizon of 10 working days. Also, under a conservative approach, the VaR is calculated on a daily basis with and without volatility weighting, with the final VaR being the most restrictive value between the two methodologies.

As from the third quarter of 2016, we have been calculating VaR for the regulatory portfolio (exposure of the trading portfolio and exposure to foreign currency and commodities of the banking portfolio) according to internal models approved by the Central Bank. The Consolidated Total VaR table provides an analysis of our portfolio exposure to market risk.

Consolidaded VaR

Average

Minimum

Maximum

December

Average

Minimum

Maximum

December

(Historical Simulation approach)

(1)

31, 2019

31, 2018

(In millions of R$)

Group of Risk Factor

Interest rate

815.7

651.6

959.7

813.1

851.4

720.0

1,042.9

898.4

Currencies

27.6

10.9

59.2

10.9

24.7

12.7

45.2

37.3

Equities

30.2

13.5

57.4

29.4

39.2

23.6

58.5

50.1

Commodities

1.8

0.5

4.7

1.0

1.6

0.6

3.1

1.0

Diversification effect (2)

(576.1)

(605.3)

Total

333.7

208.7

471.9

278.3

399.3

294.7

603.6

381.5

  1. Determined in local currency and converted into Brazilian reais at the closing price on the reporting date.
  2. Reduction of risk due to the combination of all risk factors.

As of December 31, 2019, our average global VaR (Historical Simulation) was R$333.7 million, or 0.24% of our consolidated stockholders' equity as of December 31, 2019, compared to R$399.3 million as of December 31, 2018 or 0.26% of our consolidated stockholders' equity as of December 31, 2018.

VaR - Trading Book

The table below presents risks arising from all positions with the intention of trading, following the criteria defined above for our Trading Book. Our total average Trading Book VaR was R$44.0 million as of December 31, 2019, compared to R$48.4 million as of December 31, 2018 and to R$52.0 million as of December 31, 2017.

39

Trading Book VaR(1)

Average

Minimum

Maximum

December

Average

Minimum

Maximum

December

31, 2019

31, 2018

(In millions of R$)

Group of Risk Factor

Interest rate

25.1

11.6

43.8

34.5

38.2

13.8

130.0

20.0

Currencies

21.1

6.4

48.4

6.4

19.9

9.0

41.0

33.1

Equities

21.8

6.0

47.0

14.4

21.8

8.4

42.8

39.2

Commodities

1.9

0.5

6.1

1.0

1.6

0.8

3.1

1.0

Diversification effect (2)

(12.9)

(40.2)

Total

44.0

25.2

84.9

43.4

48.4

21.9

115.7

53.1

  1. Determined in local currency and converted into Brazilian reais at the closing price on the reporting date.
  2. Reduction of risk due to the combination of all risk factors.

Sensitivity Analyses (Trading and Banking Portfolios)

As required by Brazilian regulation, we conduct sensitivity analyses for market risk factors considered important. The highest resulting losses are presented below, with impact on result, by risk factor, in each such scenario and are calculated net of tax effects, providing a view of our exposure under different circumstances.

The sensitivity analyses of the Trading Portfolio and Banking Portfolio presented here are based on a static assessment of the portfolio exposure. Therefore, such analyses do not consider the dynamic response capacity of management (e.g., treasury and market risk control unit) to initiate mitigating measures, whenever a situation of high loss or risk is identified, minimizing the possibility of significant losses. In addition, the analysis is intended to assess risk exposure and the respective protective actions, taking into account the fair value of financial instruments, regardless of whether or not financial instruments are accounted for on an accrual basis.

Trading Portfolio

(1)

Trading and Banking Portfolios

(1)

Exposures

December 31, 2019

December 31, 2019

Risk Factors

Risk of varitions in:

Scenario I

Scenario II

Scenario III

Scenario I

Scenario II

Scenario III

(In thousands of R$)

Interest Rate

Fixed Income Interest Rates in reais

(658)

(86,432)

(214,996)

(11,579)

(1,383,839)

(2,776,926)

Foreign Exchange Linked

Foreign Exchange Linked Interest Rates

(304)

(21,886)

(42,336)

(2,925)

(196,449)

(377,441)

Foreign Exchange Rates

Prices of Foreign Currencies

(282)

80,050

427,563

2,230

47,173

322,325

Price Index Linked

Interest of Inflation coupon

(163)

(2,993)

(4,457)

(6,527)

(460,666)

(868,806)

TR

TR Linked Interest Rates

-

(1)

(1)

493

(65,875)

(159,057)

Equities

Prices of Equities

2,069

2,612

185,005

6,016

(94,531)

(9,281)

Other

Exposures that do not fall under the definitions abov

(15)

(2,184)

(6,869)

(45)

(8,555)

(26,163)

Total

647

(30,834)

343,909

(12,337)

(2,162,742)

(3,895,349)

(1) Amounts net of tax effects.

  • Scenario I: Addition of one basis point to fixed interest rates, currency coupon, inflation and interest rate indexes and one percentage point to currency and equity prices;
  • Scenario II: Shocks of 25% in fixed interest rates, currency coupon, inflation, interest rate indexes and currency and share prices, both for growth and fall, considering the largest resulting losses per risk factor; and
  • Scenario III: Shocks of 50% in fixed interest rates, currency coupon, inflation, interest rate indexes and currency and share prices, both for growth and fall, considering the largest resulting losses per risk factor.

Interest Rate Sensitivity

Interest rate sensitivity is the relationship between market interest rates and net interest income arising from the maturity or the renegotiation of prices of interest-bearing assets and liabilities.

Our strategy for interest rate sensitivity considers the return rates, the underlying risk level and the liquidity requirements, including our minimum regulatory cash reserves, mandatory liquidity ratios, withdrawals and maturity of deposits, capital costs and additional demand for funds.

The pricing structure is matched when equal amounts of these assets or liabilities mature or are renegotiated. Any mismatch of interest-bearing assets and liabilities is known as a gap position. The interest rate sensitivity may vary in the renegotiation periods presented due to the different renegotiation dates within the period. Also, variations among the different currencies in which the interest rate positions are denominated may arise.

40

These relationships are material for a particular date, and significant fluctuations may occur on a daily basis as a result of both market forces and management decisions. Our "CSRML" analyzes Itaú Unibanco Group's gap position on a monthly basis and establishes limits for market risk exposure, interest rate positions and foreign currency positions.

Please see "Note 32 - Risk and Capital Management, 2. Market Risk" of our audited consolidated financial statements for further details about the position of our interest-bearing assets and liabilities as of December 31, 2019. This note provides a snapshot view, and accordingly, does not reflect the interest rate gaps that may exist at other times, due to changing asset and liability positions, and management's actions to manage risk in these changing positions.

LIBOR Transition

In 2018 we assembled a working group to follow up on the international financial markets discussions regarding the replacement of the IBOR rates by new reference rates. The main goal of this working group was, and still is, to support our senior executives in the decision-making process relating to this subject. In order to achieve that, this group is comprised of several areas of the bank, including representatives from Treasury, Risk, Accounting, Legal, Compliance, External Units, etc., and is being led by the Products team at the head office in Brazil.

Among its actions over the past two years, we can highlight the following: (i) assessment of the bank's exposure to IBORs; (ii) the amendment of fallback clauses present in the contracts of assets, liabilities and derivatives transactions indexed to IBORs; (iii) monitoring and active participation in market consultations held by ISDA and the Fed with regards to new replacement rates and its methodologies; (iv) follow up reports for the Senior Management in several committees (Products, Accounting, Audit and Market Risk Committees); (v) analysis of accounting impacts and new procedures to be applied to the transactions in our portfolios, as well as monitoring any announcements of the main global accounting bodies (IASB and FASB) and participation in discussions held in specific international forums; (vi) mapping the operational impact of the transition to the new rates; (vii) communications to clients regarding the discontinuity of IBOR rates, in addition to discussions with foreign banks that are members of the Alternative Reference Rate Committee to further monitor the subject.

Throughout 2020, the working group will continue to follow market guidelines and will act in the implementation of previously defined action plans, including systems changes to the new rate methodologies for both new transactions and for the current portfolio as well. The Group will further analyze the bank's adherence to ISDA protocols and the amendment of clauses for assets and liabilities. In that same sense, the Group will keep up with the periodic reports to Senior Management and clients whenever it deems necessary.

Backtesting

The effectiveness of the VaR model is validated by the use of backtesting techniques that compare hypothetical and effective daily results with the estimated daily VaR. The number of exceptions to the VaR pre-established limits should be consistent, within an acceptable margin, with the hypothesis of 99% confidence level considering a period of 250 business days. Confidence levels of 97.5% and 95%, and periods of 500 and 750 business days are also considered. The backtesting analysis presented below considers the ranges suggested by the Basel Committee on Banking Supervision. The ranges are divided into:

  • Green (0 to 4 exceptions): corresponds to backtesting results that do not suggest any problems with the quality or accuracy of the adopted models;
  • Yellow (5 to 9 exceptions): refers to an intermediate range group, which indicates an early warning and/or monitoring and may indicate the need to review the model; and
  • Red (10 or more exceptions): demonstrates the need for improvement action.

According to Central Bank Circular No. 3,646, hypothetical testing consists of applying market price variations for a specific day to the portfolio balance at the end of the preceding business day. The effective test is the variation in the portfolio value up to the end of the day, including intraday transactions and excluding amounts not related to market price variations, such as fees, brokerage fees and commissions.

The regulatory VaR model had one backtesting exception in the 250 business days ended December 31, 2019.

41

4.3. Describe the legal, administrative or arbitration proceedings to which the issuer or its subsidiaries are a party, specifying labor, tax and civil claims, among others: (i) that are not confidential, and (ii) that are relevant for the business of the issuer or its subsidiaries, indicating:

For purposes of this item, we adopted as materiality criterion operations involving amounts higher than R$747.3 million, which accounts for 0.5% of Itaú Unibanco Holding's stockholders' equity under IFRS (R$149,465 million on December 31, 2019).

Civil, tax, and labor contingencies are provided for whenever a loss is assessed as probable. Provisions are also recorded, irrespective of the event of an unfavorable outcome to the company, for tax contingencies in which the outcome of the case is dependent on the recognition of the unconstitutionality of legislation in force.

Management believes that the provisions for legal and administrative contingencies in place are sufficient to cover probable losses and that these may be reasonably estimated. We believe that any losses arising from other administrative or legal contingencies will not have a material adverse effect on our business, financial position or results.

Civil Proceedings

Case No. 2007.51.01.001894-7

  1. Court: 22th Federal Court of the Judicial District of Rio de Janeiro (State of Rio de Janeiro)
  2. Jurisdiction: Appellate court - Court of Appeals of the State of Rio de Janeiro (TJRJ)
  3. Filing date: 02/05/2007
  4. Parties to the proceedings: Association of Minority Shareholders of Publicly-Held Companies (Associação dos Acionistas Minoritários em Cia. de Capital Aberto) vs. Banco Banerj S.A. ("Banerj"), Banco do Estado do Rio de Janeiro S.A. ("Berj"), State of Rio de Janeiro and Central Bank of Brazil
  5. Amounts, rights or rights involved: R$ 4,741,452,260.00 (originally claimed amount)
  6. Main facts: This public-interest civil action filed by the Association of Minority Shareholders of Publicly-Held Companies against Banco do Estado do Rio de Janeiro - BERJ, the State of Rio de Janeiro, the Central Bank of Brazil, and Banco Banerj S.A., is aimed at annulling a series of acts carried out under the scope of the special administration regime and the extrajudicial liquidation of Banco do Estado do Rio de Janeiro, as well as at getting a refund for alleged financial losses arising from these acts accordingly. The case was dismissed without prejudice, as set forth by Article 267, IV, of the Code of Civil Procedure (CPC). The appeal filed by the plaintiff was denied. The motion for clarification filed by the Association of Minority Shareholders was denied. The special appeal filed by the Association of Minority Shareholders was denied, and subsequently this party filed an interlocutory appeal, against which the Bank submitted an appellee's brief, which is pending trial.
  7. Chance of loss: Remote.
  8. Analysis of impact in the event of an unfavorable decision: To indemnify the minority shareholders for the alleged losses caused by the measures adopted by the majority shareholder - State of Rio de Janeiro - to the former Banerj.

42

Case No. 2005.70.00.027997-3

  1. Court: 6th Federal Court - Curitiba (State of Paraná)
  2. Jurisdiction: Federal Supreme Court (STF)
  3. Filing date: 10/13/2005
  4. Parties to the proceedings: State of Paraná and Public Prosecution Office of the State of Paraná vs. Federal Government, Central Bank of Brazil, and Itaú Unibanco S.A
  5. Amounts, rights or rights involved: R$ 3,738,621,318.72 (originally claimed amount)
  6. Main facts: Plaintiffs require indemnity for damage allegedly incurred by the State of Paraná as a result of the inaccurate evaluation of tax credits in the privatization process of Banco Banestado S.A. (Banestado), which caused this government institution to take out a loan supposedly greater than necessary to restructure the financial institution in the pre-privatization period. This action was challenged in court on the grounds that tax credits were properly evaluated, and it is awaiting the decision of the Federal Supreme Court, where the matter is being considered as an original lawsuit. It should be noted that, as set forth by law, the privatization of Banestado was carried out through an invitation to bid. Additionally, at the time of the privatization, tax credits were evaluated by independent bank. This action was suspended. Closing arguments were submitted.
  7. Chance of loss: Remote.
  8. Analysis of impact in the event of an unfavorable decision: Payment to the State of Paraná of the amount corresponding to the tax credits.

Case No. 2000.51.01.030509-7

  1. Court: 2nd Federal Court of the Judicial District of Rio de Janeiro (State of Rio de Janeiro)
  2. Jurisdiction: Federal Regional Court (TRF) of the 2nd Region
  3. Filing date: 11/21/2000
  4. Parties to the proceedings: Federal Public Prosecution Office vs. Itaú Unibanco S.A., Banco Banerj S.A.
    ("Banerj"), State of Rio de Janeiro, and Caixa Econômica Federal
  5. Amounts, rights or rights involved: R$ 942,399,095.28 (historical amount of the "B Account" set up on
    June 10, 1997).
  6. Main facts: This is a public-interest civil action involving aspects of Banerj's privatization process. The so- called "B Account" (an escrow account) was set up by means of a bank loan between Caixa Econômica Federal and the State of Rio de Janeiro in the amount of R$942,399,095.28. The purpose of said account is to ensure the refund to the purchaser of Banerj, awarded in lawsuits filed based on events that took place before privatization. In this case, the Federal Public Prosecution Office requires the partial nullity of the agreement that authorized the transfer of said amount to the "B Account", as well as the joint obligation of the defendants to refund amounts unduly withdrawn through allegedly unlawful procedures adopted in the settlements of labor claims filed by Banerj's former employees. The case was dismissed, recognizing the legality of the "B Account" set up and of the settlements signed. Decision of the Federal Regional Court upheld the dismissal of the case. This decision was later annulled because the Public Prosecution Office was not served with notice. The Federal Regional Court would retry the case. After retrying the case, the Federal Regional Court has decided to declare the judgment null due to the failure to serve the Federal Government with notice. Awaiting publication for filing a special appeal.
  7. Chance of loss: Remote.
  8. Analysis of impact in the event of an unfavorable decision: To refund the amounts of the labor settlements, which were paid with funds from the "B Account", and to prevent any new withdrawals from "B
    Account".

43

Case No. 2003.51.01.028514-2

  1. Court: 2nd Federal Court of the Judicial District of Rio de Janeiro (State of Rio de Janeiro)
  2. Jurisdiction: Federal Regional Court (TRF) of the 2nd Region
  3. Filing date: 12/05/2003
  4. Parties to the proceedings: Federal Public Prosecution Office, Public Prosecution Office of the State of
    Rio de Janeiro, and Labor Public Prosecution Office vs. Itaú Unibanco S.A., Banco Banerj S.A. ("Banerj"),
    Mr. Gilberto Carlos Frizão, Mr. Manuel Antonio Granado, and Mr. Otávio Aldo Ronco.
  5. Amounts, rights or rights involved: R$ 942,399,095.28 (historical amount of the "B Account" set up on
    June 10, 1997).
  6. Main facts: This is a public-interest civil action based on alleged administrative improbity involving some aspects of Banerj's privatization process, related to the set up and use of the so-called "B Account" (an escrow account). In this case, plaintiffs claim there were undue withdrawals of funds deposited in the "B Account" through allegedly unlawful procedures adopted in labor claims filed by Banerj's former employees (i.e. the non-filing of applicable appeals), for which reason they seek any withdrawal from the "B Account" to be previously submitted to the Finance Secretary of the State of Rio de Janeiro for approval, and also that the defendants be judged jointly and severally for damages to refund the alleged unduly withdrawn amounts under the penalties set forth in the Brazilian Improbity Law (Law No. 8,429/1992) driven by alleged administrative improbity of the defendant individuals. The case was dismissed, recognizing the legality of the "B Account" set up and of the settlements signed. Decision of the Federal Regional Court upheld the dismissal of the case. This decision was later annulled because the Public Prosecution Office was not served with notice. The Federal Regional Court will retry the case. After retrying the case, the Federal Regional Court has decided to declare the judgment null due to the failure to serve the Federal Government with notice. Awaiting publication for filing a special appeal.
  7. Chance of loss: Remote.
  8. Analysis of impact in the event of an unfavorable decision: To refund the amounts unduly withdrawn from the "B Account".

Case No. 0003056-02.2003.8.26.0200

  1. Court: 2nd Civil Court of Itapira - State of São Paulo
  2. Jurisdiction: Appellate court - Appellate Court of the State of São Paulo (TJSP)
  3. Filing date: 08/06/2003
  4. Parties to the proceedings: KVA Engenharia Elétrica Ltda. vs. Itaú Unibanco
  5. Amounts, rights or rights involved: R$ 9,908,848,213.43 (December 2019)
  6. Main facts: Lawsuit to review current account, loan and renegotiation agreements, in which the bank was ordered in lower court to exclude interest capitalization and refund overpaid amounts, adjusted including interest in the same proportion as it had been charged by the bank. Regarding the calculation of the liquid amount, the lower court, taking into account the capitalized interest criterion, approved the amount of approximately R$7.6 billion to be refunded to the plaintiff. The Appellate Court of the State of São Paulo overturned this judgment and excluded the capitalization, reducing the amount of the award. The plaintiff filed a motion for clarification, which was denied.
  7. Chance of loss: Remote
  8. Analysis of impact in the event of an unfavorable decision: In August 2019, the bank paid the award in effect in the amount of R$5.9 million. The remaining risk of remote loss is R$9,9 billion.

44

Tax claims

Case No. 0204699-55.0500.8.26.0090 (204.699/05)

  1. Court: Municipal Tax Foreclosures of São Paulo
  2. Jurisdiction: Lower court - Municipal Tax Foreclosure Court of São Paulo
  3. Filing date: 11/30/2005
  4. Parties to the proceedings: City of São Paulo vs. Banco Itauleasing S/A (current corporate name of Cia Itauleasing de Arrendamento Mercantil)
  5. Amounts, rights or rights involved: R$ 3,204,937,461.78 (December 2019)
  6. Main facts: Tax foreclosure filed by the City of São Paulo for collection of service tax (ISS) on lease operations. The motion to stay execution filed by the Bank, which challenges the place where the service was provided, the calculation basis, and the fact that amounts due were paid to the municipality in which the Bank has its head office (municipality of Poá/State of São Paulo), was denied. The Appellate Court of the State of São Paulo (TJSP) granted the appeal filed by the Bank to annul the appealed judgment due to the denial of a fair opportunity to be heard. The case was remanded to the original court so that the expert evidence required by the Bank be produced and a new judgment be rendered. Expert evidence is pending completed.
  7. Chance of loss: Remote.
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No. 2008.61.00.014763-1

  1. Court: 11th Civil Court of the Federal Justice of São Paulo
  2. Jurisdiction: Appellate court - Federal Regional Court (TRF) of the 3rd Region
  3. Filing date: 06/23/2008
  4. Parties to the proceedings: Dibens Leasing S.A. Arrendamento Mercantil and Others vs. the Officer of the Financial Institutions of the State of São Paulo
  5. Amounts, rights or rights involved: R$ 1,388,896,234.08 (December 2019)
  6. Main facts: Writ of mandamus filed requiring the suspension of the enforceable increase to 15% from 9% to be levied on the plaintiffs, introduced by Provisional Measure (MP) No. 413/2008. This preliminary injunction was denied. Judgment for defendant. The appeal and the motion for clarification filed by the companies were dismissed. Appeals filed at higher courts were denied. Unappealable judgment unfavorable to the plaintiffs, and we are now awaiting deposits to be converted into income to close the case.
  7. Chance of loss: Probable.
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No.16327.720550/2014-18

  1. Court: Federal Revenue Service
  2. Jurisdiction: Administrative higher court - Higher Chamber of Tax Appeals (CSRF)
  3. Filing date: 06/26/2014
  4. Parties to the proceedings: Federal Revenue Service vs. Itaú Unibanco S/A
  5. Amounts, rights or rights involved: R$1,296,547,748.67 (December 2019)
  6. Main facts: Assessment notice aimed at the collection of social security tax due (employers and third parties) on payments made as profit sharing and bonus in 2009 and 2010. On June 14, 2016, the case was placed on CARF for trial docket, which decided to postpone trial to produce more evidence in connection with the periods under notification. The special appeal filed in view of the unfavorable appellate decision by the Administrative Board of Tax Appeals (CARF) is awaiting trial. The portion of the bonus-related debt is under discussion in connection with an action for annulment.
  7. Chance of loss: Possible (R$1,031,750,751.77) and Probable (R$264,796,996.89)
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged

45

Case No.16327.721108/2014-09

  1. Court: Federal Revenue Service
  2. Jurisdiction: Administrative higher court - Higher Chamber of Tax Appeals (CSRF)
  3. Filing date: 12/05/2014
  4. Parties to the proceedings: Federal Revenue Service vs. Itaú Unibanco S.A.
  5. Amounts, rights or rights involved: R$ 1,289,245,680.47 (December 2019)
  6. Main facts: Tax assessment notice for collection of corporate income tax and social contribution on the grounds that a portion of the goodwill earned on the Itaú Unibanco merger would have been incorrectly amortized on a fiscal basis. A separate fine is being levied on the grounds of the non-payment of monthly estimated amounts. With respect to merits, the action for annulment No. 5013052-25.2019.403.6100 was filed and is currently pending at the 25th Federal Civil Court of São Paulo, secured by a bank guaranty. With respect to the separate fine, after being served with the sentence that dismissed the special appeal, an action challenging its legality was filed.
  7. Chance of loss: Possible.
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No. 16327.721149/2015-78

  1. Court: Federal Revenue Service
  2. Jurisdiction: Administrative higher court - Higher Chamber of Tax Appeals (CSRF)
  3. Filing date: 12/22/2015
  4. Parties to the proceedings: Federal Revenue Service vs. Itaú Unibanco S.A.
  5. Amounts, rights or rights involved: R$ 1,188,960,532.92 (December 2019)
  6. Main facts: Tax assessment notice for collection of corporate income tax and social contribution for calendar years 2010, 2011 and 2012, in view of the disallowance of operating expenses (expenses on interbank deposits related to investments in ID/fixed income made by Unibanco, which funds invested derived from the full subscription of the capital stock increased by Itaú). The voluntary appeal and the mandatory review were denied. With respect to merits, the action for annulment No. 5015701-60.2019.4.03.6100 was filed and is currently pending at the 10th Court of the Federal Justice of São Paulo, with an interlocutory relief granted. The CSFR rendered a judgment unfavorable to the defendant with respect to the separate fine.
  7. Chance of loss: Remote.
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No. 16327.720680/2013-61

  1. Court: Federal Revenue Service
  2. Jurisdiction: Administrative higher court - Higher Chamber of Tax Appeals (CSRF)
  3. Filing date: 06/25/2013
  4. Parties to the proceedings: Federal Revenue Service vs. Itaú Unibanco Holding S/A
  5. Amounts, rights or rights involved: R$ 28,540,778,342.96 (December 2019)
  6. Main facts: Tax assessment notice for collection of corporate income tax and social contribution for fiscal year 2008 resulting from the transaction that led to the merger of Itaú Holding and Unibanco Holdings S.A. On April 10, 2017, CARF rendered a decision favorable to the Company by cancelling the tax assessment notice. The special appeal filed by the Federal Revenue Service was suspended by CARF until the Writ of Mandamus No. 1017987-56.2017.4.01.3400, which was filed against the admissibility of the special appeal filed by the Federal Revenue Service, is tried. The preliminary injunction was granted on December 14, 2017. The Writ of Mandamus was granted on July 18, 2018 recognizing the illegality of the special appeal- related admissibility order. The appeal filed by the Federal Government is awaiting trial. Note: In August 2018, the Request for suspending preliminary injunction/judgment - SLAT No. 1019448-44.2018.4.01.0000, filed by the Federal Government, was granted. Against this decision, an internal interlocutory appeal was filed with a request for relief with suspensive effects, which was entertained by the Federal Regional Court of the 1st Region on October 17, 2018.
  7. Chance of loss: Remote.

46

h. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No. 16327.721300/2013-14

  1. Court: Federal Revenue Service
  2. Jurisdiction: Administrative higher court - Higher Chamber of Tax Appeals (CSRF)
  3. Filing date: 11/14/2013
  4. Parties to the proceedings: Federal Revenue Service vs. Itaú Unibanco S/A
  5. Amounts, rights or rights involved: R$2,892,295,725.75 (December 2019)
  6. Main facts: Corporate income tax and social contribution required on the grounds of alleged capital gain arising from the Itaú and Unibanco merger process. A voluntary appeal was filed by the taxpayer, which was dismissed by CARF. The case was terminated with an unfavorable decision rendered by CSRF, and therefore we filed the action for annulment No. 5026528-67.2018.4.03.6100, which is currently pending at the Federal Court of São Paulo. An interlocutory relief was granted in connection with this action, which is currently at the expert evidence stage.
  7. Chance of loss: Remote
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No. 16327.720004/2018-01

  1. Court: Administrative Proceeding (currently pending before the Federal Revenue Service)
  2. Jurisdiction: Administrative appellate court - Administrative Board of Tax Appeals (CARF)
  3. Filing date: 01/18/2018 (receipt date of the assessment notice)
  4. Parties to the proceedings: Federal Government vs. Banco Itaucard S/A
  5. Amounts, rights or rights involved: R$2,011,273,438.99 (December 2019)
  6. Main facts: Tax assessment notice in connection with PIS/Cofins on the grounds of alleged failure to submit for taxation the economic-financial result of leasing operations carried out and closed in 2012 and 2013, with a 150% fine levied on credits determined, on the grounds of the alleged fraud committed in successive acts that has placed these results under the exemption range of PIS/COFINS according to Article 3 of paragraph 2 of Law 9,718/98. CARF has partially granted the voluntary appeal filed by Banco Itaucard S/A, as it cancelled the aggravated fine and confirmed the expiration of the preemptive period, but upheld the collection with respect to the matter subject to merits. The Bank has not yet been served with such appellate decision.
  7. Chance of loss: Possible.
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No. 16327.720946/2018-81

  1. Court: Federal Revenue Service
  2. Jurisdiction: Administrative appellate court - Administrative Board of Tax Appeals (CARF)
  3. Filing date: 12/21/2018
  4. Parties to the proceedings: Federal Government vs. Banco Itaucard S/A.
  5. Amounts, rights or rights involved: R$ 11,058,254,361.78 (December 2019)
  6. Main facts: Tax assessment notice for collection of corporate income tax, social contribution, PIS and Cofins and fines (2012 to 2015) arising from the disallowance of operating expenses (interbank deposits) related to funds capitalized among the Group companies. The Federal Revenue Service Judgment Office (DRJ) dismissed the objection filed by the company. THE VOLUNTARY APPEAL FILED IS CURRENTLY PENDING TRIAL.
  7. Chance of loss: Remote (R$7,877,023,763.49) and Possible (R$3,181,230,598.29)
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

47

Case No. 16327.720945/2018-36

  1. Court: Federal Revenue Service
  2. Jurisdiction: Administrative appellate court - Administrative Board of Tax Appeals (CARF)
  3. Filing date: 12/21/2018
  4. Parties to the proceedings: Federal Government vs. Itaú Unibanco S/A.
  5. Amounts, rights or rights involved: R$ 1,953,543,165.43 (December 2019)
  6. Main facts: Tax assessment notice for collection of corporate income tax, social contribution, PIS and Cofins and fines (2012 to 2015) arising from the disallowance of operating expenses (interbank deposits) related to funds capitalized among the Group companies. THE VOLUNTARY APPEAL FILED IS CURRENTLY PENDING TRIAL.
  7. Chance of loss: Remote
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No. 16327.720972/2018-17

  1. Court: Federal Revenue Service
  2. Jurisdiction: Administrative appellate court - Administrative Board of Tax Appeals (CARF)
  3. Filing date: 12/10/2018
  4. Parties to the proceedings: Federal Government vs. Itaú Unibanco Holding S/A
  5. Amounts, rights or rights involved: R$ 879,226,563.42 (December 2019)
  6. Main facts: Tax assessment notice for collection of corporate income tax and social contribution, on the grounds that tax authorities understood as nondeductible expenses the interest on capital expenses that were not paid to the stockholders of the defendant, but rather to the usufructuaries of the share yield. It currently awaits to be served with notice in connection with the decision that granted the voluntary appeal.
  7. Chance of loss: Remote
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No. 16327.720774/2018-45

    1. Court: Federal Revenue Service
  1. Jurisdiction: Administrative appellate court - Administrative Board of Tax Appeals (CARF)
  2. Filing date: 10/26/2018
  3. Parties to the proceedings: Federal Government vs. Itaú Unibanco S/A
  4. Amounts, rights or rights involved: R$ 2,744,341,445.27 (December 2019)
  5. Main facts: Tax assessment notice for collection of corporate income tax, social contribution, PIS and Cofins and fines (2012 to 2013) arising from the disallowance of operating expenses (interbank deposits) related to funds capitalized among the Group companies. The Federal Revenue Service Judgment Office (DRJ) dismissed the objection filed by the company. THE VOLUNTARY APPEAL FILED IS CURRENTLY PENDING TRIAL.
  6. Chance of loss: Possible (R$933,617,383.55) and Remote (R$1,810,724,061.72)
  7. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No. 16561.720086/2018-11

  1. Court: Federal Revenue Service
  2. Jurisdiction: Administrative appellate court - Administrative Board of Tax Appeals (CARF)
  3. Filing date: 11/14/2018
  4. Parties to the proceedings: Federal Revenue Service vs. Redecard S/A
  5. Amounts, rights or rights involved: R$ 7,237,584,345.41 (December 2019)

48

  1. Main facts: Assessment notice levied on Redecard arising from the disallowance of goodwill on acquisition of Redecard's shares by Banestado through a public offering of shares, and a 150% fine and another separate fine levied on the grounds of non-payment of monthly estimated amounts. The Administrative lower court has partially granted the objection filed, and Redecard has filed a voluntary appeal against the upheld portion of the assessment and the mandatory review related to the portion discharged, to be tried by the administrative appellate court, CARF. It is currently awaiting trial of voluntary appeal and mandatory review.
  1. Chance of loss: Remote
  2. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No.16327.720188/2019-81

  1. Court: Federal Revenue Service
  2. Jurisdiction: Administrative lower court
  3. Filing date: 02/27/2019
  4. Parties to the proceedings: Federal Government vs. Itaú Unibanco S/A
  5. Amounts, rights or rights involved: R$ 1,197,005,462.22 (December 2019)
  6. Main facts: Tax assessment notice aimed at the collection of social security tax due on payments of employee and management profit sharing, meal voucher and food allowance paid in tickets and bonus, all of these amounts related to 2014. It is currently awaiting trial of the objection filed.
  7. Chance of loss: Possible (R$601,474,089.96) and Remote (R$595,531,372.25).
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No.16327.720115/2012-13

  1. Court: 10th Federal Civil Court of São Paulo
  2. Jurisdiction: Administrative higher court - Higher Chamber of Tax Appeals (CSRF)
  3. Filing date: 02/01/2012
  4. Parties to the proceedings: Federal Revenue Service vs. Unibanco União de Bancos Brasileiros S/A.
  5. Amounts, rights or rights involved: R$ 752,503,704.71 (December 2019)
  6. Main facts: Tax assessment notice for collection of corporate income tax and social contribution for calendar year 2007 due to excess distribution of interest on capital of prior years. The special appeal filed by the Federal Revenue Service was granted, the discussion at the administrative level is closed. Preliminary injunction was granted and, the writ of mandamus related to the debts filed to challenge the tax assessment notice was granted. The Federal Regional Court of the 3rd Region has denied the appeal filed by the Federal Government against the valid judgment. The Federal Government filed an internal interlocutory appeal, which was denied.
  7. Chance of loss: Remote
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No. 16327.721221/2019-91

  1. Court: Federal Revenue Service
  2. Jurisdiction: Administrative lower court
  3. Filing date: 12/30/2019
  4. Parties to the proceedings: Federal Revenue Service vs. Banco Itaucard S/A
  5. Amounts, rights or rights involved: R$ 867,227,634.63 (December 2019)
  6. Main facts: Tax assessment notice for collection of corporate income tax and social contribution for calendar year 2014 on the grounds of disallowance of losses incurred by Banco Itaucard in derivative operations with Itaú Unibanco S/A. Currently awaiting trial of objection filed.
  7. Chance of loss: Possible (R$640,033,473.39) and Remote (R$227,194,161.24).
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

49

Case No. 16327.721240/2019-17

  1. Court: Federal Revenue Service
  2. Jurisdiction: Administrative lower court
  3. Filing date: 12/30/2019
  4. Parties to the proceedings: Federal Government vs. Banco Itaucard S.A.
  5. Amounts, rights or rights involved: R$ 1,076,289,831.88 (December 2019)
  6. Main facts: Tax assessment notice in connection with PIS/Cofins on the grounds of alleged failure to submit for taxation the economic-financial result of leasing operations carried out and closed in 2014, with a 150% fine levied. Currently awaiting trial of objection filed.
  7. Chance of loss: Possible (R$161,122,183.70) and Remote (R$915,167,648.17).
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No. 16327.721172/2019-96

  1. Court: Federal Revenue Service
  2. Jurisdiction: Administrative lower court
  3. Filing date: 12/16/2019
  4. Parties to the proceedings: Federal Government vs. Itaú Unibanco S.A.
  5. Amounts, rights or rights involved: R$ 1,008,165,063.31 (December 2019)
  6. Main facts: Tax assessment notice for social security tax due and third parties on payments made in 2015 in connection with profit sharing, bonus, meal voucher and food allowance. Currently awaiting trial of objection filed.
  7. Chance of loss: Possible (R$324,859,072.70) and Remote (R$683,305,990.62).
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No.16327.720779/2014-44

  1. Court: Federal Revenue Service
  2. Jurisdiction: Administrative appellate court
  3. Filing date: 08/25/2014
  4. Parties to the proceedings: Federal Government vs. Banco Itaú BBA S/A
  5. Amounts, rights or rights involved: R$ 723,050,168.35 (December 2019)
  6. Main facts: Tax assessment notice aimed at the collection of social security tax due on payments of employee and management profit sharing in 2010 and 2011. Currently awaiting service of notice of the trial of the special appeal filed by the company, denied by CSRF after casting vote.
  7. Chance of loss: Possible (R$704,056,754.98) and Probable (R$18,993,413.37).
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

Case No. 6017.2019/0071660-6

  1. Court: São Paulo City Tax Council
  2. Jurisdiction: Appellate court
  3. Filing date: 12/13/2019
  4. Parties to the proceedings: City of São Paulo vs. Banco Itaucard S/A
  5. Amounts, rights or rights involved: R$ 4,033,952,193.58 (December 2019)
  6. Main facts: Tax assessment notices to discuss the place of collection of service tax (ISS) on card and lease operations.
  7. Chance of loss: Possible (R$2,015,853,494.12) and Remote (R$2,018,098,699.46).
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

50

Labor claims

No labor claims in the period.

Administrative proceeding

Case No.08700.008182/2016-57

  1. Court: Administrative Council for Economic Defense (CADE)
  2. Jurisdiction: Administrative lower court - General Superintendency of the Administrative Council of Economic Defense (CADE)
  3. Filing date: December 8, 2016, as published in the Official Gazette of the Federal Government.
  4. Parties to the proceedings: CADE ex officio vs. Banco Itaú BBA S.A and others.
  5. Amounts, rights or rights involved: According to Law No. 12,529/11, Article. 37, item I, any violation of the economic order will subject the company to a fine ranging from one-tenth percent (0.1%) to twenty percent (20%) of the gross revenue of such company, group or conglomerate, earned in the last year prior to the filing of the administrative proceeding, in the business activity field in which the alleged violation was committed, which will never be lower than the alleged advantage gained, whenever such calculation is possible. On the grounds of lack of definition of the calculation basis applicable, as well as of the significantly wide range of percentages applicable, it is not possible to calculate the fine amounts in the event of an unfavorable decision.

f. Main facts: Administrative proceeding filed to investigate an alleged cartel in the Brazilian onshore foreign exchange market involving the Brazilian currency (Brazilian real). These presumed anticompetitive conducts would have been engaged mainly in the FX spot and futures (derivatives) markets, in Brazil by financial institutions (Banco Itaú BBA S.A., among them) and individuals located in the Brazilian territory. The defense was timely filed on January 8, 2018.

  1. Chance of loss: Possible
  2. Analysis of impact in the event of an unfavorable decision: payment of the fine amount.

Arbitration proceedings

The Issuer is not a party to any arbitration proceedings in progress on December 31, 2019 that are material in terms of the matters or amounts involved.

4.3.1. Indicate the amount provided for, if any, for the lawsuits described in item 4.3

The total amount provided for the claims described in item 4.3. is R$ 1,672,686,644.34 for tax claims.

4.4 Describe the legal, administrative or arbitration proceedings that are not confidential to which the issuer or its subsidiaries are a party and to which the opposing parties are management members or former management members, parent companies or former parent companies, or investors of the issuer or its subsidiaries, informing:

The Issuer is not a party to any proceedings filed either by its management members or former management members, or by its controlling stockholders or former controlling stockholders.

Additionally, the Issuer and its subsidiaries carry out corporate transactions that are sometimes challenged by minority stockholders who mainly disagree with the amount paid for their shares. We describe below the civil lawsuits filed by investors of the Issuer and its subsidiaries.

51

Case No. 000.00.643149-6

  1. Court: 8th Civil Court of the Central Court of the Judicial District of the Capital City of São Paulo (State of São Paulo).
  2. Jurisdiction: Appellate court.
  3. Filing date: 11/27/2000
  4. Parties to the proceedings: Sumatra Comércio e Indústria, Importações e Exportações Ltda. and João Antonio Lian vs. Banco Bandeirantes S/A
  5. Amounts, rights or rights involved: R$ 0,00
  6. Main facts: The purpose of this lawsuit is the annulment of the resolutions of the Annual

    1. Shareholders' Meetings of Banco Bandeirantes, held in 1999 and 2000, in connection with fiscal years 1998 and 1999, to (i) disapprove the financial statements and developments resulting therefrom, mainly agreements for assignment of credits entered into by Banco Bandeirantes and Portonovo, which should be annulled, thereby revoking the effects from these agreements, and
    2. to recover damage sustained by the plaintiffs as a result of these credit assignment agreements. The claim was denied and this decision was upheld by the Superior Court of Justice (STJ). The extraordinary appeal filed by Sumatra was denied. Interlocutory appeal on extraordinary appeal that ordered it to be remanded to the TJSP on the grounds of the general repercussion regime. At TJSP, on the grounds that the judge reviews its own decision, the extraordinary appeal was still not granted. Final and unappealable decision. Decision favorable to the bank.
  7. Chance of loss: Remote
  8. Analysis of impact in the event of an unfavorable decision: Amount not stated

Case No. 000.00.619716-7

  1. Court: 7th Civil Court of the Central Court of the Judicial District of the Capital City of São Paulo (State of São Paulo)
  2. Jurisdiction: Federal Supreme Court (STF)
  3. Filing date: 10/05/2000
  4. Parties to the proceedings: Sumatra Comércio e Indústria, Importações e Exportações Ltda and João Antonio Lian vs. Banco Bandeirantes S/A
  5. Amounts, rights or rights involved: R$ 282,005,718.34 (December 2019)
  6. Main facts: Action whereby the plaintiffs seek to benefit from the same terms provided in the agreement entered into by the defendants and other minority shareholders of Banco Bandeirantes, ensuring them all the rights set forth therein. The claim was ruled valid by the TJSP.
    A special appeal was granted to suspend UBB and Bandeirantes' eligibility regarding acts committed by the former parent company. The extraordinary appeal filed by Sumatra was dismissed. The interlocutory appeal on Extraordinary Appeal filed by Sumatra was dismissed. Decision favorable to the bank.
  7. Chance of loss: Remote
  8. Analysis of impact in the event of an unfavorable decision: Loss of the amount challenged.

52

Case No. 51718900-0

  1. Court: (iii) 39th Civil Court of the Central Court of the Judicial District of the Capital City of São Paulo (State of São Paulo)
  2. Jurisdiction: (iii) Superior Court of Justice (STJ)
  3. Filing date: (iii) 02/17/2000
  4. Parties to the proceedings: Estate of Yerchanik Kissajikian vs. Banco Bandeirantes S/A
  5. Amounts, rights or rights involved: R$ 0.00
  6. Main facts: Action whereby the plaintiffs seek adjudication on the right to subscribe R$300,000.00, as well as the adjudication of the damage sustained due to the unjustified dilution of their ownership interest resulting from capital increases prompted by unjustified losses imposed thereupon by the controlling shareholders abusing power and causing the reduction of the stockholders' equity as a result of sales of assets at incompatible amounts. The claim was judged to be unfounded at the lower court. The appellate decision by the TJSP affirmed the judgment for defendant. The special appeal filed is currently pending trial.
  7. Chance of loss: Remote
  8. Analysis of impact in the event of an unfavorable decision: Amount not stated

Case No. 583.00.2001.076875-7

  1. Court: 3rd Civil Court of the Central Court of the Judicial District of the Capital City of São Paulo (State of São Paulo)
  2. Jurisdiction: Superior Court of Justice (STJ)
  3. Filing date: 07/05/2001
  4. Parties to the proceedings: Antranik Kissajikian, André Kissajikian, Suely Kissajikian, Vanda Kissajikian Mordjikian and Companhia Iniciadora Predial e Comercial Empreendimentos Brasil S.A. vs. Unibanco - União de Bancos Brasileiros S/A, Caixa Geral de Depósitos S/A, and Caixa Brasil Participações S/A
  5. Amounts, rights or rights involved: R$ 0.00
  6. Main facts: This lawsuit alleges abuse of power by the controlling shareholder, considering the dilution of the ownership interest in Banco Bandeirantes and the subsequent delisting of the bank without a prior public offering. Judgment favorable to the defendant and upheld by the TJSP. The special appeal filed is currently pending trial.
  7. Chance of loss: Possible
  8. Analysis of impact in the event of an unfavorable decision: Amount not stated

53

Case No. 583.00.2009.229.838-5

  1. Court: 39th Civil Court of the Central Court of the Judicial District of the Capital City of São Paulo (State of São Paulo)
  2. Jurisdiction: Superior Court of Justice (STJ)
  3. Filing date: 02/05/2010
  4. Parties to the proceedings: S/A Philomeno Indústria e Comércio and Panamá Empreendimentos e Participações vs. Itaú Unibanco Holding S/A
  5. Amounts, rights or rights involved: R$ 0.00
  6. Main facts: Stockholder seeks compensation for damage on the grounds of having been precluded from exercising its right as a stockholder. The action was dismissed as being defective, because the relief sought by the plaintiff was not specific. The Appellate Court of the State of São Paulo, in spite of having accepted the generic relief, has dismissed the case with prejudice, as it was time barred. The special appeal filed was not granted. The interlocutory appeal on special appeal filed is currently pending trial.
  7. Chance of loss: Remote
  8. Analysis of impact in the event of an unfavorable decision: Amount not stated

4.4.1. Indicate the amount provided for, if any, for the lawsuits described in item 4.4

No provision is recognized for the lawsuits described in item 4.4, since their likelihood of loss is classified as possible or remote.

4.5. With respect to the significant confidential proceedings to which the issuer or its subsidiaries are a party and which have not been reported in items 4.3 and 4.4 above, analyze the impact in the event of an unfavorable decision and inform the amounts involved

The Issuer and its subsidiaries are not party to any confidential proceedings that are considered significant.

4.6. Describe any repetitive or related legal, administrative or arbitration proceedings based on similar legal facts or causes that are not confidential and that are collectively significant, to which the issuer or its subsidiaries are party, specifying labor, tax and civil claims, among others, and indicating:

  1. Amounts involved
  2. Action carried out by the issuer or its subsidiary that gave rise to this contingency
    4.6.1. Indicate the total amount provided for, if any, for the lawsuits described in item 4.6

The Issuer is not a party to any repetitive or related legal, administrative or arbitration proceedings that are collectively significant.

In the normal course of business, the Issuer's subsidiaries are party to legal and administrative proceedings that are collectively significant and whose types of contingency are detailed in the table below:

R$MM

AMOUNT

AREA

PROVIDED

TYPE OF CONTINGENCY

FOR

Contingencies are related to individual or collective lawsuits in

Labor

8,579

which alleged labor rights based on labor legislation specific to

the related profession are discussed, such as overtime, salary

equalization, reinstatement, and transfer allowances.

Civil contingencies are usually related to demands related to the

revision of contracts and compensation for damage and pain and

Civil

3,633

suffering, in addition to specific lawsuits for the collection of

understated inflation adjustment for savings in connection with

the economic plans implemented in the 1980s and 1990s as a

measure to combat inflation¹.

Tax provisions are related to lawsuits in which we discuss the

Tax2

6,593

legality and unconstitutionality of legislation in force. These

lawsuits, which the conglomerate classifies as legal liabilities,

54

refer particularly to challenges to different social contribution rates and the calculation basis of PIS and COFINS contributions. The conglomerate is also a party to tax and social security lawsuits classified as contingent liabilities, which likelihood of loss is classified as probable, with main discussions on tax service (ISS) on certain revenues.

¹Although ITAÚ UNIBANCO HOLDING has complied with the rules in effect at the time, the company is a defendant in lawsuits filed by individuals that address this topic, as well as in class actions filed by: (i) consumer protection associations; and (ii) the Public Prosecution Office on behalf of savings account holders. With respect to these lawsuits, ITAÚ UNIBANCO HOLDING recognizes provisions when it is summoned and when individuals apply to enforce the decision rendered by the Judicial Branch, using the same criteria adopted to determine the provisions for individual lawsuits. The Federal Supreme Court (STF) has issued a number of decisions favorable to the holders of savings accounts, but has not consolidated its understanding regarding the constitutionality of the economic plans and its applicability to savings accounts. The ruling of appeals involving this matter is currently suspended by the STF, until it hands down a final ruling on the rights under discussion. In December 2017, through mediation of the Federal Attorney's Office (AGU) and supervision of the Central Bank of Brazil, savers (represented by two civil associations, FEBRAPO and IDEC) and FEBRABAN entered into an instrument of agreement aiming at resolving lawsuits related to economic plans, and Itaú has already adhered to its terms. Said agreement was approved on March 1, 2018 by the Plenary Session of the Federal Supreme Court (STF) and, as from May 22, 2018, savers may adhere to its terms for a 24-month period, with the subsequent settlement of lawsuits. With maturity scheduled to the end of this period, in March 2020 the parties entered into an amendment to the agreement aimed to extend the adherence period for other 60 months, so as to a larger number of savers can join in and, as a result, increase the number of lawsuits ultimately settled. Approval from the STF will be required for this amendment to become valid and effective, which is expected for the second quarter of 2020.

2The amounts provided for in connection with the tax contingencies stated herein do not include the amounts for the cases with probable likelihood of loss already stated in item 4.3 of this Form.

4.7. Describe other significant contingencies that are not included in the previous items

No amounts involved in tax and social security lawsuits whose likelihood of loss is possible are provided for. The amounts involved in key tax and social security lawsuits whose likelihood of loss is possible, whose total risk is estimated at R$28,959 million, are as follows:

R$ million

Tax

Issue

Amount

Non-wage amounts: we defend the non-levy of contribution

INSS

on non-wage amounts, such as profit sharing and stock-

5,009

option plans.

Funding expenses: We challenge the deductibility of

IRPJ/CSLL/PIS/COFINS

funding expenses related to funds capitalized among the

4,115

Group companies.

Goodwill - Deduction: the deductibility of goodwill on

IRPJ/CSLL

acquisition of investments with expected future

3,307

profitability is discussed.

Banking activities: We challenge the levy and/or place of

ISS

collection of ISS for certain banking revenues.

3,239

Reversal of revenues from excess depreciation: the

PIS/COFINS

accounting and tax treatment granted to PIS and COFINS

2,199

upon settlement of lease operations is discussed.

Request for offset rejected: the liquidity and certainty of

IRPJ/CSLL/PIS/COFINS

the offset credit are analyzed.

1,762

Disallowance of losses: The amount of tax loss and/or tax

IRPJ/CSLL

loss carryforwards used by the Federal Revenue Service

1,164

in tax assessment notices, which are still pending a final

decision, is being challenged.

Deductibility of losses in loan operations: tax assessment

IRPJ/CSLL

notices for collection of IRPJ and CSLL due to alleged

685

noncompliance with legal criteria for deduction of losses

on receipt of credits.

55

4.8. For the rules of the foreign issuer's country and the rules of the country in which the foreign issuer's securities are held in custody, if different from the original country, please identify:

  1. Restrictions imposed on the exercise of political and economic rights
    Not applicable; Brazil is the Issuer's country of origin.
  2. Restrictions on outstanding securities and their transfer

Not applicable; Brazil is the Issuer's country of origin.

  1. Cases for the cancellation of registration, as well as of rights of the holders of securities in this situation

Not applicable; Brazil is the Issuer's country of origin.

  1. Cases where the holders of securities have the preemptive right to subscribe shares, stock backed securities or securities convertible into shares, and the respective conditions to exercise this right, or cases where this right is not guaranteed, if applicable

Not applicable; Brazil is the Issuer's country of origin.

e) Other issues of interest to investors

Not applicable; Brazil is the Issuer's country of origin.

ITEM 5 - RISK MANAGEMENT AND INTERNAL CONTROL POLICY

5.1. In relation to the risks indicated in item 4.1, inform:

  1. whether the issuer has a formal risk management policy, informing, if so, the approving body and the date of approval, and, if not, the reasons why the issuer has not adopted such a policy

We have a defined governance process for policy review applicable to Brazil and our international units. Policies preponderantly define institutional guidelines, methodologies and processes, address regulatory requirements and the best market practices. The institution has internal policies that provides guidelines and establishes risk management governance, as follows:

Policies (1)

Approving body

Date of

approval

Capital Management

03/28/2019

Credit Risk Management and Control

03/28/2019

Integrated Management of Operational

12/14/2018

Risk, Internal Controls and Compliance

Board of Directors

Liquidity Risk Management and Control

02/06/2020

Market Risk Management and Control

02/06/2020

Compliance Policy

02/28/2019

  1. Available for consultation on website www.itau.com.br/investor-relations> Menu > Itaú Unibanco > Corporate Governance > Rules and Policies > Reports.

56

  1. the objectives and strategies of the risk management policy, if any, including:
    1. risks that are intended to be hedged

Risks

Description

Credit risk

Risk of loss associated with: failure by a borrower, issuer or counterparty to fulfill their

respective financial obligations as defined in the contracts; value loss of a credit

agreement resulting from a deterioration of the borrower's, issuer's or counterparty's

credit rating; reduction of profits or income; benefits granted upon subsequent

renegotiation; or debt recovery costs.

Operational risk

Possibility of losses arising from failure, deficiency or inadequacy of internal

processes, people or systems or from external events that affect the achievement

of strategic, tactical or operational objectives. It includes legal risk associated with

inadequacy or deficiency in contracts signed by us, as well as penalties due to

noncompliance with applicable laws and damages to third parties arising from the

activities undertaken by us.

Internally, we classify these exposures to risk within the following categories:

• Internal fraud;

• External fraud;

• Labor claims and deficient security in the workplace;

• Inadequate practices related to clients, products and services;

• Damage to our own physical assets or assets in use;

• Interruption of our activities;

• Failures in information technology systems; and

• Failures in the performance, compliance with deadlines and management

of our activities.

Liquidity risk

Likelihood that an institution will not be able to effectively honor its expected and

unexpected obligations, current and future, including those from guarantees

commitment, without affecting its daily operations or incurring significant losses.

Market risk

Possibility of losses resulting from fluctuations in the market value of positions

held by a financial institution, including the risk of operations subject to variations

in foreign exchange rates, interest rates, price indexes, equity and commodity

prices.

Other Risks

Description

Products that compose portfolios of our insurance companies are related to life and

Insurance

elementary insurance, as well as pension plans and premium bonds. Accordingly,

products, pension

we understand that the main risks inherent to these products are:

plan and premium

bonds risks

• Underwriting risk: the possibility of losses arising from insurance products, pension

plans and premium bonds that go against our expectations, directly or indirectly

associated with technical and actuarial bases used for calculating premiums,

contributions and technical provisions;

• Market risk;

• Credit risk;

• Operational risk; and

• Liquidity risk.

Environmental

Possibility of losses due to exposure to environmental and social events

and social risk

arising from the performance of our activities.

57

Regulatory risk

Risk of incurring losses due to fines, sanctions and other penalties applied by

regulatory agencies resulting from lack of compliance with regulatory

requirements.

Model risk

Risk that arises from the models used by us not reflecting, on a consistent basis, the

relationships of variables of interest, creating results that systematically differ from

those observed. This risk may materialize due to the use in different situations from

those modeled.

Country risk

Risk of losses arising from noncompliance with obligations in connection with

borrowers, issuers, counterparties or guarantors as a result of actions taken by the

government of the country where the borrower, issuer, counterparty or guarantor is

located.

Business

and

Risk of a negative impact on our financial results or capital as a consequence of

strategy risk

faulty strategic planning, making adverse strategic decisions, and our inability to

implement the proper strategic plans and/or changes in its business environment.

Reputational risk

Risk arising from internal practices, risk events and external factors that may

generate a negative perception of us among clients, counterparties, stockholders,

investors, supervisors and commercial partners, among others, which could affect

the value of our brand and financial losses, in addition to adversely affecting our

capability to maintain our existing commercial relations, start new businesses and

continue to have access to financing sources.

ii. Instruments used for hedging purposes

Undertaking and managing risks is essential to our business and a employees. For this reason, we must have well-established objectives and management.

responsibility of all of our rules with respect to risk

In this context, risk appetite determines the nature and the level of the risks that are acceptable to us and our culture of risks guides the necessary attitudes to manage them:

  • Our Risk Culture is intended to be an umbrella for different risk-management related initiatives.
  • Both our risk appetite and the initiatives included in the strategic risk management frontline are aimed at designing tools to enable implementation of our Risk Culture principles, namely: "We are all risk managers", "We assume risks on an informed basis", "We discuss our risks", and "We act on our risks".

Our risk appetite establishes the types and levels of risk acceptable to us.

58

In addition to the adoption of risk management, risk appetite and risk culture principles, we describe below the procedures used specifically to protect against the risks mentioned in item 5.1.b.i) above.

Credit Risk

The key assignments of the business units are (i) monitoring the portfolios under their responsibility,

  1. granting credit, taking into account approval levels, market conditions, macroeconomic prospects, changes in markets and products, and (iii) credit risk management aimed at making the business sustainable.

Our credit policy is based on internal factors, such as: client rating criteria, performance and evolution of our portfolio, default levels, return rates and allocated economic capital, among others; and also takes into account external factors such as: interest rates, market default indicators, inflation and changes in consumption, among others.

With respect to our individuals, small and medium companies, credit ratings are assigned based on statistical models (in the early stages of our relationship with a customer) and behavior score models (used for customers with whom we already have a relationship). For large companies, classification is based on information such as the counterparty's economic and financial situation, its cash generating capacity, and the business group to which it belongs, the current and prospective situation of the economic sector in which it operates. Credit proposals are analyzed on a case-by-case basis through the approval governance.

The concentrations are continuously monitored for economic sectors, and largest debtors, allowing preventive measures to be taken to avoid the violation of the established limits. We also strictly control our credit exposure to clients and counterparties, acting to reverse occasional limit breaches. We may use contractual covenants for these purposes, such as the right to demand early payment or require additional collateral.

59

To measure credit risk, we take into account the probability of default by the borrower, issuer or counterparty, the estimated amount of exposure in the event of default, past losses from default and concentration of borrowers. Quantifying these risk components is part of the lending process, portfolio management and definition of limits.

The models used by us are independently validated, to ensure that the databases used in constructing the models are complete and accurate, and that the method of estimating parameters is adequate, so as to reduce the modeling risk and keep the models calibrated, so that they reflect risk parameters more accurately.

In compliance with the principles of the CMN Resolution 4,557, our credit risk management structure and institutional policy are approved by our Board of Directors and are applicable to all companies and subsidiaries in Brazil and abroad.

Please see "Note 32 - Risk and Capital Management" to our audited consolidated financial statements for further details about credit risk.

Loan Approval Process

Extensions of credit are approved based on policies at the business unit level, determined in accordance

with the criteria of each department and our bank's risk appetite. The decision to extend credit may be granted

by means of a pre-approval process or the traditional approval mechanism, which is applied on a client by client basis. In both cases, decisions are made based on principles of credit quality such as credit rating supported by statistical models, percentage of income committed by/leverage of the client and credit restrictions determined by us and the market.

The business units prepare and maintain the policies and procedures of the credit cycle.

The credit granting process contemplates the use of credit protection services with the purpose of checking whether a client's credit history includes information that could be considered an obstacle to granting a loan, such as assets blocked by court orders, invalid tax payer identification numbers, prior or pending debt restructuring or renegotiation processes and checks not honored due to insufficient funds.

The policy assessment process allows for the identification of potential risks and is intended to ensure that credit decisions make sense from both an economic and a risk perspective.

60

Please see "Note 32 - Risk and Capital Management, 1.1 Collateral and policies for mitigating credit risk", to our audited consolidated financial statements for further details about our risk mitigating instruments.

Operational Risk

The main operational risks associated with the processes of the business and support areas are captured continually updated and stated in the risk maps of the institution's executive boards. These risks are classified by each department based on the inherent risk level and control environment, so as to encourage the accountability of managers, who are primarily responsible for adopting and implementing responses to risks.

The risks identified in the processes are grouped in standardized taxonomy, creating a consolidated overview of the institution's main operational risks and are aligned to the risk categories below.

  • Internal fraud;
  • External fraud;
  • Labor claims and deficient security in the workplace;
  • Inadequate practices related to clients, products and services;
  • Damage to our own physical assets or assets in use;
  • Interruption of our activities;
  • Failures in information technology systems; and
  • Failures in the performance, compliance with deadlines and management of our activities.

To encourage the proper management of these risks, the institution has an incentive mechanism called "Operational Risk Rating", aimed at assessing the managers' performance regarding both their meeting governance terms for the implementation of action plans to face identified weaknesses and the maintenance of a proper control environment for each process of the executive boards.

In addition, the institution has specific guidelines for crisis management and business continuity:

61

i. Crisis Management and Business Continuity

The purpose of our Business Continuity Program is to protect our employees, ensure the continuity of the critical functions of our business lines, safeguard revenue and sustain both a stable financial market in which we operate and the trust of our clients and strategic partners in providing our services and products.

Our Business Continuity Program is composed of procedures for relocating and/or recovering operations in response to a variety of interruption levels and can be divided into four key elements:

  • Disaster Recovery Plan: focused on the recovery of our primary data center, ensuring the continuity of the processing of critical systems within minimum pre-established periods;
  • Workplace Contingency Plan: employees responsible for carrying out critical business functions have alternative facilities from which to perform their activities in the event the buildings in which they usually work become unavailable. There are approximately 2,000 contingency dedicated seats that are fully equipped to meet the needs of critical business units in emergency situations;
  • Emergency Plan: procedures aimed at minimizing the effects of emergency situations that may impact our facilities, with a preventive focus; and
  • Processes Contingency Plan: alternatives (Plan B) to carry out the critical processes identified in the business areas.

In order to keep the continuity solutions aligned with the business requirements the program applies the following tools to understand the institution:

  • Business Impact Analysis (BIA): evaluates the criticality and resumption requirement of the processes that support the delivery of products and services. Through this analysis the businesses' resumption priorities are defined; and
  • Threats and Vulnerabilities Analysis (AVA): identification of threats to the locations where our buildings are located.

In addition, we have a corporate-wide Crisis Management Program, which is aimed at managing business interruption events, natural disasters, impacts of an environmental, social, and infrastructural/operational (including information technology) nature or of any other nature that jeopardize the

image and reputation and/or viability of Itaú Unibanco's processes with its employees, clients, strategic

partners and regulators, with timely and integrated responses.

Our Corporate Business Continuity Policy is available at our website www.itau.com.br/investor- relations> Menu > Itaú Unibanco > Corporate Governance > Rules and Policies > Policies.

Liquidity Risk

The liquidity coverage ratio (LCR) was 149.1% on the fourth quarter average compared to the minimum required by the Central Bank of 100% for 2019. As of December 2018, the net stable funding ratio (NSFR), which closed the fourth quarter of 2019 at 122.2%, was released. The minimum limit required by the Central Bank is 100%. We have diversified sources of resources, with a significant share coming from the retail segment. The main sources of resources are deposits, savings, issuance of bonds and accepted resources.

Market Risk

In an attempt to fit the transactions into the defined limits, we hedge transactions with clients and proprietary positions, including investments overseas. Derivatives are the most commonly used instruments for carrying out these hedging activities, and can be characterized as either accounting or economic hedge, both of which are governed by our institutional regulations.

62

Additional information regarding market risk protection instruments are described in item 5.2.b.iii) of this Reference Form.

Other Risks

Insurance Products, Pension Plan and Premium Bonds Risks

We act with a series of instruments that mainly aim to identify, monitor and control the risks tied to the business, bringing greater security and tranquility in the decision making of executives. Procedures to protect this risk include: (i) Key indicators; (ii) Integrated Risk Forum; (iii) Risk appetite for the insurance business; (iv) Risk Management Policy directed to the specificities of the business.

Environmental and Social Risk

To mitigate the risk, we map our processes, adopt internal controls, monitor new regulations on the subject, and record occurrences in our internal databases. In addition, risks identified, prioritized and actions taken are reported to our management of environmental and social risk.

We consistently pursue to evolve in environmental and social risk management, always attentive to challenges including those arising from regulations and from a changing stakeholders' expectations. We have assumed and incorporated several national and international voluntary commitments into our governance several aiming at continuously improving our integrated environmental and social risk management. We have committed with Principles for Responsible Investment (PRI), Principles for Responsible Banking (PRB), the Charter for Human Rights - Ethos, Equator Principles (EP), Global Impact, Carbon Disclosure Project (CDP), Brazilian GHG Protocol Program, National Pact for Eradicating Slave Labor (Pacto Nacional para Erradicação do Trabalho Escravo), among others. Our efforts to increase knowledge and governance of environmental and social risk have been recognized in Brazil and abroad, as shown by our recurring presence in sustainability indexes, such as Dow Jones Sustainability Index, Euronext Vigeo - Emerging 70, and in B3's Corporate Sustainability Index, as well as numerous prizes and recognitions which we have been awarded.

Regulatory Risk

We have a structured process for addressing rules, covering the stages of recognition, distribution, monitoring and compliance, and all of these processes are established in internal policies. The process for handling regulatory risk involves various areas of the institution, and consists of: (i) structure of lines of defense;

  1. monitoring draft legislation, public notices and public hearings; (iii) monitoring new rules and definition of action plans; (iv) relationship with regulators and professional organizations; (v) monitoring action plans; (vi) control over compliance with legal decisions and TAC (conduct adjustment agreements), executed in public civil actions. In addition, the institution's risks are classified and prioritized according to our internal control methodology.

Model Risk

The use of models can lead to more accurate decisions and its increasingly use by the institution has supported strategic decisions in several contexts such as credit approval, operations pricing, volatility curves estimation, capital calculation, among others.

The best practices that mark the model risk control at the institution include: (i) certification of the quality of the database used; (ii) application of a check-list of essential steps to be taken during the development of the model in question; (iii) the use of conservative estimates in judgmental models; (iv) use of external benchmarks; (v) approval of results generated in model implementation; (vi) independent technical validation of models; (vii) validation of use of models; (viii) assessments of the impact in the use of models;

  1. monitoring of performance of models; and (x) monitoring of the distribution of the explanatory variables and final score.

Country Risk

We have a specific structure for the management and control of country risk, consisting of corporate bodies and dedicated teams, with responsibilities defined in policies. The institution has a structured and consistent procedure for managing and controlling country risk, including: (i) the establishment of country ratings; (ii) the determination of limits for countries; and (iii) the monitoring of limits.

63

Business and Strategy Risk

We have implemented many mechanisms to ensure that both the business and the strategic decision- making processes follow proper governance standards, have the active participation of executives and the Board of Directors, are based on market, macroeconomic and risk information and are aimed at optimizing the risk-return ratio.

Procedures to hedge against this risk include as follows: (i) the qualifications and incentives of board members and executives; (ii) the budgetary process; (iii) product assessment; (iv) the evaluation and prospecting of proprietary mergers and acquisitions; and (v) a risk appetite framework which, for example, restricts the concentration of credit and exposure to specific and material risks.

Reputational Risk

Among our processes and internal initiatives are (i) risk appetite statement; (ii) processes to prevent and combat the use of Itaú Unibanco in unlawful acts; (iii) crisis management processes and business continuity procedures; (iv) processes and guidelines with respect to governmental and institutional relations;

  1. corporate communication processes; (vi) brand management processes; (vii) ombudsman offices initiatives and commitment to customer satisfaction; and (viii) ethics and corruption prevention guidelines.
    1. Money Laundering Prevention

Financial institutions play a key role in preventing and fighting illicit acts, which includes money laundering, terrorism financing and fraud.

The challenge is to identify and prevent increasingly sophisticated operations that seek to conceal the source, ownership and transfer of goods and assets, derived from illegal activities.

We have established a corporate policy to prevent our involvement in illicit activities, protecting our reputation and image among employees, customers, strategic partners, suppliers, service providers, regulators and the society. Our policy is based on a governance structure focused on transparency, strict compliance with the rules and regulations and cooperation with enforcement and judicial authorities. We also strive to conduct our business in accordance with the local and international best practices to prevent and fight illicit acts, through investments and training our employees on an ongoing basis.

In order to comply with our corporate policy, we have established a program to prevent and fight illicit acts, which includes the following pillars:

  • Customer Identification Process;
  • KYC;
  • KYP;
  • KYS;
  • KYE;
  • Risk Assessment on New Products and Services;
  • Transaction Monitoring;
  • Reporting Suspicious Transactions to Regulators and Authorities; and
  • Training.

This program is applicable to us and our controlled entities in Brazil and abroad. The oversight of prevention and detection of illegal activities is carried out by the Board of Directors, the Audit Committee, Compliance and Operational Risk Committees, and the Anti-Money Laundering Committee.

64

Our Corporate Policy for Prevention and Fight Against Illegal Acts is available at our website www.itau.com.br/investor-relations> Menu > Itaú Unibanco > Corporate Governance > Rules and Policies > Policies.

ii. Politically Exposed Persons (PEPs)

Our commitment to compliance with applicable law and to the adoption of the best practices for prevention and detection of money laundering activity is also reflected in the identification, assessment and monitoring of PEPs, whether as individuals or entities.

As per our policies, we conduct enhanced due diligence with respect to PEPs. We require a higher level of approval prior to establishing any relationship with a PEP.

iii. risk management organizational structure

Our risk management organizational structure complies with Brazilian and applicable international regulations currently in place and is aligned with best market practices. There is a structure in place for coordination and consolidation of information and related processes, which are all subject to verification by independent validation, internal controls and audit areas. The following committees are part of our risk and capital management governance structure:

Risk & Capital Management Committee (CGRC): supports our Board of Directors in performing its duties related to our risk and capital management by meeting, at least, four times annually, and submitting reports and recommendations to assist the Board of Directors in its decision-making with respect to:

  • Decisions regarding our risk appetite, in terms of capital, liquidity, results, operational risk and reputation, ensuring these aspects are in alignment with our strategy, and including acceptable capital and liquidity levels and types of risks to which we may be exposed, as well as overall limits for each type of risk, tolerance for volatility of results and risk concentration, and general guidelines about tolerance for risks that may impact our brand (e.g., brand risk).

65

  • Supervision of our risk management and control activities in order to ensure their suitability to the risk levels assumed and to the complexity of the operations as well as compliance with regulatory requirements;
  • Review and approval of policies and strategies for capital management, to establish mechanisms and procedures aimed at keeping capital consistent with the risks we incur;
  • Establishing our minimum expected return on capital as a whole and for our lines of business, as well as monitoring performance;
  • Supervision of our incentive structures, including compensation, aimed at ensuring its alignment with risk control and value creation goals; and
  • Fostering improvement in our Risk Culture.

Superior Market Risk and Liquidity Committee (CSRML): meets on a monthly basis and is

responsible for setting guidelines and governance for investments and market and liquidity risks regarding our consolidated positions and business lines.

Superior Operational Risk Committee (CSRO): meets on a bimonthly basis and is responsible for understanding the risks of our processes and business, defining guidelines for operational risks management and assessing the results achieved by our Internal Controls and Compliance System. The CSRO is our main decision-making committee for all operational risk management matters. It is responsible for defining our operational risk framework and structure and related policies for identification, measurement, assessment, reporting and monitoring of operational risk.

Superior Products Committee (CSP): meets on a weekly basis and is responsible for evaluating products, operations, services and processes that are beyond the authority of our Products Committees that report to it or that involve image risk to us.

Superior Credit Committee (CSC): meets on a weekly basis and is responsible for analyzing and deciding on credit proposals that are beyond the authority of the credit committees that report to the CSC. It is also responsible for analyzing decisions which may have not been taken due to a lack of consensus at the committee immediately subordinate to it or cases where, due to the relevance or characteristics of the topic or other features, such Credit Committees decide to submit to the CSC's review.

Superior Retail Credit and Collection Committee (CSCCV): meets on a monthly basis and is responsible for approving credit policies and assessing the performance of Retail Credit and Collection portfolios and strategies.

Superior Wholesale Credit and Collection Committee (CSCCA): meets on a monthly basis and is responsible for approving credit policies and assessing the performance of Wholesale Credit and Collection portfolios and strategies.

Additionally, we have sub-committees, chaired by our chief risk officer and CFO, which are also responsible for risk and capital management. Any such sub-committee may report directly to the Risk and Capital Management Committee or to the sub-committees mentioned above.

To support this structure, we have the Risks & Finance Control and Management Area, structured with specialized departments and subordinated to our chief risk officer and CFO, intending to independently and in a centralized manner to ensure that the institution's risks and capital are managed in accordance with established policies and procedures.

Risk governance at foreign subsidiaries

Among our medium and long-term strategic goals, is our internationalization process that aims to reach, in the countries in which we do business, at least the same governance quality and level of results we observe in Brazil.

Therefore, we have been continuously improving our risk monitoring and management processes, not only in operations carried out abroad, but also for the supervision, proximity and robust governance of our holding company.

66

The continuous improvement of control processes allow us to better understand the particularities of each country and region in which we do business, and quickly adapt to changes in the different regulatory, social and economic market environments.

Risk management at our foreign subsidiaries is undertaken by teams dedicated to control and monitor risks, with direct communication channels that allow the information to flow at a timely manner as well as the alignment in the whole group.

Finally, promoting the Risk Culture in Brazil and abroad strengthens the individual and collective responsibility of all of our employees, so they can do the right thing, at the right time and in the right way, respecting the ethical and sustainable way of doing business.

Internal Audit

The Internal Audit Department is subordinated, at the administrative level, to the Chairman of the Board of Directors of Itaú Unibanco Holding S.A. Its activities are supervised by the Audit Committee of Itaú Unibanco Holding S.A.

The Internal Audit representation offices located in Foreign Units report, at a technical level, to the Audit Executive Office of Itaú Unibanco S.A., and its activities are supervised by the Audit Committee of Itaú Unibanco Holding S.A., as well as by local Audit Committees.

The internal audit activities carried out and the use of the name "internal audit" in the Conglomerate are exclusive to the Audit Executive Board of Itaú Unibanco.

The Internal Audit Department adopts a proprietary methodology that is mandatory for all Internal Audit units of the Conglomerate. This methodology is in line with the international standards for the internal auditor's profession disclosed by The Institute of Internal Auditors (The IIA). Every time this methodology is revised, changes are submitted for approval of the Audit Executive Office and to the Audit Committee.

In the event of noncompliance with standards, the Internal Audit Department will report this fact to the Audit Committee.

The Internal Audit Department has an agenda to report to the Governance, which includes meetings with the Audit Committee, Executive Committee, Chairman of the Board of Directors, and the Board of Directors.

Risk

Risk Management

Credit risk

Our credit risk management is intended to preserve the quality of the loan

portfolio at levels compatible with our risk appetite, for each market segment in

which we operate.

Our credit risk governance is managed through corporate bodies, which report

to the Board of Directors or to our executive structure. Such corporate bodies

act primarily by assessing the competitive market conditions, setting our credit

limits, reviewing control practices and policies, and approving these actions at

the respective authority levels. The risk communication and reporting

processes, including disclosure of institutional and supplementary policies on

credit risk management, are the responsibility of our structure. We manage the

credit risk to which it is exposed during the entire credit cycle, from before

approval, during the monitoring process and up to the collection or recovery

phase.

Our credit risk management and control structure is centralized and

independent of the business units and defines operational limits, risk mitigation

mechanisms and processes, and instruments to measure, monitor and control

credit risk inherent to all products, portfolio concentrations and impacts to

potential changes in the economic environment. Our credit's portfolio, policies

and strategies are continuously monitored so as to ensure compliance with the

rules and laws in effect in each country.

67

Operational Operational risk management includes conduct risk, which is subject to

riskmitigating procedures to assess product design (suitability) and incentive models. The inspection area is responsible for fraud prevention. Irrespective of their origin, specific cases may be handled by risk committees and integrity and ethics committees.

We have a governance process that is structured through forums and corporate bodies composed of senior management, which report to the Board of Directors, with well-defined roles and responsibilities in order to segregate the business and management and control activities, ensuring independence between the areas and, consequently, well-balanced decisions with respect to risks. This is reflected in the risk management process carried out on a decentralized basis under the responsibility of the business areas and by a centralized control carried out by the internal control compliance and operational risk department, by means of methodologies, training courses, certification and monitoring of the control environment in an independent way.

The managers of the executive areas use corporate methods constructed and made available by the internal control, Compliance and operational risk area. Among the methodologies and tools used are the self-evaluation and the map of our prioritized risks, the approval of processes, products, and system development products and projects, the monitoring of key risk indicators and the database of operational losses, guaranteeing a single conceptual basis for managing processes, systems, projects and new products and services.

Within the governance of the risk management process, the consolidated reports on risk monitoring, controls, action plans and operational losses are regularly presented to the business area executives.

Liquidity risk

Our liquidity risk control is managed by an independent area and is responsible for determining the composition of our reserve, estimating cash flow and exposure to liquidity risk over several time horizons, and monitoring the minimum limits of the risk appetite in countries in which we operate. All activities are subject to assessment by an independent validation, internal controls and audit departments.

In accordance with the requirements of Central Bank regulations, we report monthly our Liquidity Risk Statements (DLR and DLP). Besides, the following items are periodically produced and submitted to the senior management for monitoring and decision support:

  • Different scenarios for liquidity projections to decision support, also using stressed macroeconomics scenarios and reversed stress according to risk appetite;
  • Contingency plans for potential crisis, which contains procedures ordered by levels of execution, considering each countries' characteristics;
  • Reports of risk indicators; and
  • Tracking, and monitoring of funding sources considering counterparty type, maturity and other aspects, considering the risk appetite.

Market risk Our market risk management strategy on described in item 5.2.b. vi) of this Reference Form.

68

Insurance

In line with domestic and international practices, we have a risk management

products,

structure which ensures that risks resulting from insurance, pension and

pension plan

special savings products are properly assessed and reported to the relevant

and premium

forums.

bonds risks

The process of risk management for insurance, pensions and premium bond

plans is independent and focuses on the special nature of each risk.

As part of the risk management process, there is a governance structure

where decisions may be escalated to sub-committees, thus ensuring

compliance with several regulatory and internal requirements, as well as

balanced decisions relative to risks.

Our objective is to ensure that assets serving as collateral for long-term

products, with guaranteed minimum returns, are managed according to the

characteristics of the liabilities, so that they are actuarially balanced and

solvent over the long term.

Environmental

The risks identified, prioritized and actions taken are reported to our

and social risk

management of environmental and social risk.

Environmental and social risk management is carried out by our first line of

defense in its daily activities, with technical support of our legal and risk

teams, both of which have a team specialized in environmental and social risk

management. Business units also have their governance for the approval of

new products, including assessing the environmental and social risks, which

ensures compliance in all new products and processes employed by the

institution. Our governance also includes an Environmental and Social Risk

Committee, which is primarily responsible for guiding institutional views of

environmental and social risk exposure related to our activities and

operations.

Given the growing importance of an integrated approach for environmental

and social risk management, in 2019, we increased our governance creating

a new structure under the Compliance department: the Corporate

Environmental and Social Risk Management unit. Such area has the mandate

to strengthen the environmental and social risk governance, counsel on

related dilemmas, and to lead integrated reports to the high administration.

For further information about our Policy for Sustainability and Social and

Environmental

Responsibility,

check

our

website

at

www.itau.com.br/investor-relations> Menu > Itaú Unibanco > Corporate

Governance > Rules and Policies > Policies > Policy for Sustainability and

Social and Environmental Responsibility.

Regulatory

The regulatory risk is managed through a structured process aimed at

risk

identifying changes in the regulatory environment, analyzing their impacts on

the institution and monitoring the implementation of actions directed at

adherence to the regulatory requirements.

Model risk

The use of models can lead to more accurate decisions and its increasingly

use by the institution has supported strategic decisions in several contexts

such as credit approval, operations pricing, volatility curves estimation, capital

calculation, among others.

Due to increasing use of models, driven by the application of new

technologies and by the expanded use of data, Itaú Unibanco has improved

its governance in relation to data development and monitoring through of a

set of guidelines, policies and procedures that aim the quality assurance and

the mitigation of associated risks.

69

Country risk

We have a specific structure for the management and control of country risk,

consisting of corporate bodies and dedicated teams, with responsibilities

defined in policies.

Business and

Decision-making and the establishment of business and strategy guidelines,

strategy risk

count on the full engagement of the Board of Directors, primarily through the

Strategy Committee, and of the executives, through the Executive

Committee. In order to handle risk adequately, we have governance and

processes that involve the Risks & Finance Control and Management Area in

business and strategy decisions, so as to ensure that risk is managed and

decisions are sustainable in the long term.

Reputational

Since reputational risk directly or indirectly permeates all of our operations

risk

and processes, we have governance procedures that are structured in a way

to ensure that potential reputational risks be identified, analyzed and

managed in the initial phases of our operations and the analysis of new

products.

The treatment given to reputational risk is structured by means of many

processes and internal initiatives, which, in turn, are supported by our internal

policies. Their main purpose is to provide mechanisms for the monitoring,

management, control and mitigation of the main reputational risks.

  1. The adequacy of operating structure and internal controls to verify the effectiveness of the policy adopted

The structure adopted is adequate and able to monitor market risks in accordance with the guidelines of policies and the risk appetite statement. The integrated management of operational risk, internal controls and compliance is structured in three lines of defense:

  • First line: represented by the business and back office areas, it is responsible for identifying, measuring, assessing, and managing operational risk events, as well as keeping an effective control environment (including the compliance with internal and external rules).
  • Second line: represented by the independent internal controls/validation area, its responsibilities are, among others, disclosing and ensuring the application of decisions, policies and strategies with respect to operational risk management, as well as validating policies and processes on an independent basis.
  • Third line: represented by the Internal Audit Department, its responsibilities are, among others, verifying, on an independent and periodic basis, the adequacy of processes and procedures for risk identification and management.

The second line of defense activity is carried out by the Internal Controls, Compliance and Operational Risk area, the matrix of which is segregated from the business and back office areas, thus ensuring its independence.

Regarding its activities, the second line of defense carries out the process validation focused on identifying, measuring, assessing, monitoring and responding to the organization's operational risks, thus ensuring that any losses and risks are kept within the limits established by the institution.

In the face of the COVID 19 pandemic, this risk management model is being put to the test and giving us the certainty that our risk governance structure allows us to face the current scenario of a serious crisis.

70

5.2. With respect to the market risks indicated in item 4.2, please inform:

  1. whether the issuer has a formal market risk management policy, informing, if so, the approving body and the date of approval, and, if not, the reasons why the issuer has not adopted such a policy

Our institutional market risk management policy is a set of principles contained in the CMN regulations applicable to all business units and legal entities of the Itaú Unibanco Group.

Our market risk management process is subject to the governance and hierarchy of committees, with specific limits assigned to different portfolios and levels (for example, Banking Portfolio, Trading Portfolio), as well as some types of market risk (such as interest rate and foreign exchange risks). Daily risk reports, used by the business and control areas, are also sent to senior management. In addition, our market risk management and control process is subject to periodic reviews. Our market risk control framework is responsible for:

  • providing visibility and assurance for all senior management levels that market risks assumed are in line with our risk-return objectives;
  • promoting a disciplined and informed dialogue about the overall market risk profile and its evolution over time;
  • increasing transparency as to how the business seeks to optimize results;
  • providing early warning mechanisms to facilitate effective risk management, without obstructing the business objectives; and
  • monitoring and preventing risk concentration.

The market risk is controlled by an area independent from the business units and that is responsible for performing the daily activities of (i) risk measurement and assessment; (ii) monitoring stress scenarios, limits and alerts; (iii) application of stress scenarios, and related analysis and tests; (iv) reporting risk findings to responsible individuals within the relevant business units in accordance with our governance requirements;

  1. monitoring any necessary actions to readjust positions and/or levels of risk to make them viable; and (vi) providing support for the launch of new financial products. To this end, we have a structured communication and information flow process that provides information to our Superior Committees and monitors compliance with the requirements of Brazilian and foreign regulatory agencies.

Our structure of limits and alerts follows the guidelines of the Board of Directors and is approved by the Superior Market and Liquidity Risk Committee (CSRML) or proper authority level, which meets at least once a month. This structure of limits and alerts promotes control effectiveness and coverage and is reviewed at least annually; it also ranges from mapping of the aggregated risk indicators (portfolio levels) to granular limits (individual desk levels). The structure of market risk limits extends to the risk factor level, with specific limits aimed to improve the monitoring and understanding of the risks as well as to avoid risk concentration. These limits are determined based on projected balance sheet results, size of stockholders' equity, liquidity, market complexity and volatility, and our risk appetite. The process of setting these limit levels and breach reporting follows the approval governance procedures of our financial conglomerate´s institutional policies. Our information flow aims at providing information for the several executive levels of the organization, including the Board of Directors members through the CGRC, which meets every two months. Risk limits are monitored daily and any excess and potential breaches of limits are reported and discussed at the proper authority levels:

  • Within one business day, to the management of the relevant business units and to the risk control area and the business unit executives; and
  • Within a month, to the Superior Market and Liquidity Risk Committee (CSRML) whenever this is the proper authority level.

The market risk management is governed by the internal policies below, approved by the respective proper bodies:

The Risk and Finance Policies Committee (CNRF) and the Board of Directors for policies with PS / RG reference code.

71

Reference

Policy

Revised on

PS-57

MARKET RISK MANAGEMENT AND CONTROL

02/12/2020

POLICY (GLOBAL)

RG-23

CLASSIFICATION OF OPERATIONS

02/20/2020

PR-100

DATABASE OF MARKET AND LIQUIDITY RISKS,

02/05/2020

RESULTS AND OPERATIONS (BRAZIL)

PR-97

MANAGEMENT AND MARKET RISK LIMITS (GLOBAL)

02/01/2020

PR-121

PRICING PARAMETERS (GLOBAL)

02/20/2020

PR-122

MARKET RISK BACKTESTING (GLOBAL)

04/05/2020

PR-98

MARKET RISK STRESS TESTING (GLOBAL)

04/05/2020

PR-55

PREPARATION OF MARKET RISK MODELS

10/04/2019

PR-123

PRUDENTIAL ADJUSTMENTS CALCULATION

02/13/2020

PROCESS (GLOBAL)

PR-126

MARKET RISK CONTROL PROCEDURES FOR

12/24/2019

TREASURY (GLOBAL)

PR-123

EFFECTIVENESS OF ECONMIC HEDGING OF

02/14/2020

FOREIGN INVESTMENTS (BRAZIL)

PR-124

MARKET RISK STATEMENT (GLOBAL)

02/13/2019

PR-47

GOVERNANCE INTERNAL MARKET RISK MODELS

09/24/2019

(BRAZIL)

b) the objectives and strategies of the market risk management policy, if any, including:

i. the market risks that are intended to be hedged

Hedges are mainly used against the risks posed by fluctuations in interest, inflation and foreign exchange rates.

ii. the equity hedging strategy

The hedging strategy is aimed at adjusting income from foreign exchange variation after taxes on foreign investments (accounting basis) and its hedges. An economic hedge is composed of positions aimed at hedging income from foreign exchange variation on foreign investments. Economic hedges may be traded on derivative stock or over-the-counter markets and through foreign currency liabilities.

The market risk management is aimed at mapping and controlling the risk of mismatches. The Market and Liquidity Risk Control Executive Board is responsible for mapping, calculating and informing market risks and mismatching of terms, currencies and indexes, as well as the use of limits approved by proper committees or authorities.

The Treasury department carries out hedging transactions to mitigate and manage risks of mismatches, complying with the limits of exposure and risks approved by proper committees or authorities. For management of these risks, the information provided and economic data are analyzed for hedging purposes.

The so-called hedge accounting derivatives are monitored in accordance with their effectiveness and accounting impacts.

72

iii. instruments used for equity hedging purposes

When necessary, the Issuer operates in the market with derivative financial instruments.

The Bank uses a number of financial instruments for risk management, including securities and derivatives traded on over-the-counter or stock exchanges. Derivatives mainly include:

  • Interest rate and foreign exchange futures contracts;
  • Non-DeliverableForward - NDF;
  • Interest rate and foreign exchange swap contracts; and
  • Options.

Transactions with derivative financial instruments are classified based on their characteristics, risk management or cash flow hedging.

iv. parameters used for managing these risks

Risk parameters used by the Issuer include market risk measures, such as:

  • Value at Risk (VaR): a statistical metric that quantifies potential economic losses in normal market conditions, considering a defined holding period and confidence level;
  • Losses in Stress Scenarios (Stress Testing): a simulation technique to evaluate the impact on assets, liabilities and derivatives portfolios of various risk factors in extreme market situations (based on prospective and historic scenarios);
  • Stop Loss: a mechanism that triggers a management review of positions, if accumulated losses in a given period reach specified levels;
  • Concentration: cumulative exposure of certain financial instruments or risk factors calculated at market value (MtM - Mark to Market); and
  • Stressed VaR: a statistical measure derived from VaR calculation, aimed at capturing the largest risk in simulations of the current portfolio, considering observable returns in historical extreme volatility scenarios.

Additionally, sensitivity and loss control measures are also analyzed. These include:

  • Gap Analysis: accumulated exposure of cash flows by risk factor, marked-to-market and allocated on settlement dates;
  • Sensitivity (DV01 - Delta Variation): impact on the market value of cash flows when a one basis point change is applied to current interest or index rates; and Sensitivities to Various Risk Factors (Greek): partial derivatives of a portfolio of options in connection with the prices of underlying assets, implied volatilities, interest rates and time.

Itaú Unibanco manages its exposure based on the net of hedging and hedging objects. The controls that use net exposure limits are applied in accordance with the risk appetite determined by the bank.

v. whether the issuer operates financial instruments with goals diverse from equity hedging, and what are these goals

The Issuer hedges transactions with clients and proprietary positions to take advantage of market opportunities, seeking to mitigate risks arising from fluctuations in prices of market risk factors and mismatches, and maintaining the classification of operations within exposure limits in effect approved by proper committees/authorities.

Derivative instruments are used for these hedging activities and treasury proprietary transactions. For situations in which these are hedge accounting transactions, both hedge effectiveness and any accounting impacts are monitored. Accounting and economic hedging procedures are governed by institutional policies.

vi. the organizational structure for market risk management control

73

Market Risk

Senior management is directly involved in market risk management, conducted on an ongoing basis with commissions and committees meeting regularly so that the risk assessment and its impact on capital have an effective impact on the decision-making process of all levels, whether related to products, activities, processes or systems of Itaú Unibanco.

The organizational structure for risk management control, including market risk, is described in item 5.1.b.iii of this Reference Form.

In addition to the description in said item, we detail below the governance process structured specifically to address market and liquidity risks.

Superior Market and Liquidity Risk Committee (CSRML)

CSRML is aimed to determine guidelines and governance for investments and market and liquidity risks in connection with the Bank's consolidated positions and business lines. Accordingly, the CSRML is mainly responsible for:

Market and liquidity risk strategic management.

  • Analyzing current and future liquidity levels and taking actions to promote the safe, efficient management of the Holding Company's cash flows.
  • Discussing and deciding additional liquidity and market risk limits, within the authority assigned by the CGRC.

Guidelines on activities and decision-making powers assigned to the CGRML;

  • Retention periods for main types of risks, taking into account the size of positions and market liquidity;
  • The positions under the management of this committee;

74

  • Risk control models and procedures, including those additional to the ones assigned by CRGC;
  • Issues and limits related to treasury operational risk;
  • Stop loss policies;
  • Incentive policies;
  • Maximum levels of liquidity mismatch (GAP) for various terms and currencies, minimum levels of reserves in local and foreign currencies, subordinated to those defined by the CGRC, which may even determine additional or supplementary controls and limits, if required;
  • Funding and investment policy in domestic and international financial markets;
  • Criteria and rules for determining the internal transfer pricing of funds in the conglomerate's companies;
  • Strategies for financing the group portfolio;
  • Criteria and models for assessing liquidity risk;
  • liquidity contingency plans.

Establishing guidelines and governance for market and liquidity risks for managing funds from Technical Reserves and Insurance, Pension Plan and Premium Bonds (capitalization) equity.

Monitoring a proper Asset Liability Management (AML) of private pension plan entities (foundations) related to the Itaú Unibanco Group.

Monitoring the adequate management of the objectives and governance of defined investments and risks.

The committee is composed as follows:

  • CEO of Itaú Unibanco Holding;
  • Wholesale Banking Senior Vice President ("Diretor Geral");
  • Retail Banking Senior Vice President ("Diretor Geral");
  • Vice President of Technology and Operations;
  • Vice President of the Risk and Finance Department (ARF);
  • Vice President of the Legal, Institutional and People (AJIP);
  • Executive Officer - CIB;
  • Executive Officer - Global Markets and Treasury;
  • Executive Finance Officer;
  • Executive Internal Audit Officer;
  • Risk Officers;
  • Finance Officers;
  • Institutional Treasury Officers; and
  • Chief Economist.

Frequency of meetings: Monthly

Market and Liquidity Risk Management Committee (CGRML)

It is mainly responsible for:

  • discussing proposals for changing higher authority limits;
  • defining and monitoring its authority limits;
  • monitoring the impact of regulatory changes in the group liquidity and market risks.

75

The committee is composed as follows:

  • Secretary: Market and Liquidity Risks Studies Manager;
  • Executive Officer - Global Markets and Treasury;
  • Executive Finance Officer;
  • Trading Officer;
  • Banking Officer;
  • Desks, Products and Planning Officer;
  • Market and Liquidity Risks Control Officer; and
  • Capital Management Officer.
  • Topics that specifically need decision making are submitted to the Vice President of the Risk and Finance Department (ARF)

Frequency of meetings: Monthly.

Meetings may be cancelled due to conflicting agendas and held at any time if requested by members

Policies Committee (CN)

The Policies Committee (CN) is aimed at improving governance and revising the bank's policies.

This committee is mainly responsible for:

Revising and approving, by consensus, the bank's policies.

Revising and validating, for final approval of the Board of Directors, or related committees, the policies not addressed by another committee with at least an officer level

  • Chairman: Executive Compliance and Operational Risk Officer;
  • Compliance Officer; and

Officers responsible for the policies under approval.

Frequency of meetings: At least four times a year.

Market Model Assessment Technical Committee (CTAM Market)

The CTAM Market is aimed at approving market, pricing and liquidity risk models, based on the independent opinion of the model validation area, and recommending and monitoring action plans for validated models. It is mainly responsible for:

Approving market, pricing and liquidity risk models, as well as recommending and monitoring action plans for validated models.

The CTAM is aimed at assessing market, pricing and liquidity risk models, based on the independent opinion of the model validation department. It is mainly responsible for:

  • approving market, pricing and liquidity risk calculation models;
  • deciding on whether to use market, pricing and liquidity risk models;
  • approving, recommending, suggesting and monitoring action plans proposed for validated models;
  • monitoring the performance of market risk models over time, determining new developments, if required;
  • monitoring, as a minimum agenda, the stressed VaR (sVaR) period used to calculate market risk capital by internal models. Studies should be submitted by the market risk control department.

Models disapproved or approved for use should be monitored, as a minimum agenda.

Decisions made by this committee will be valid after informed to the Vice President of the Risk and Finance Management and Control Department.

The committee is composed as follows:

  • Vice President of the Risk and Finance Management and Control Area (ACGRF);

76

  • Internal Controls, Compliance and Operational Risk Officer;
  • Market and Liquidity Risks Control Officer;
  • Internal Controls, Risk and Finance Compliance Superintendent;
  • Specialized Client Service Superintendent;
  • Market and Liquidity Risk Control Superintendent;
  • Risk Infrastructure Superintendent; and
  • Treasury Planning Superintendent.

Assignment of decision-making power: In case of absence of the Market and Liquidity Risk Control Officer, they may assign decision power to their respective superintendents.

The Internal Controls, Compliance and Operational Risk Officer may not assign decision-making

powers.

Frequency of meetings: every two months or upon request.

  1. The adequacy of operating structure and internal controls to verify the effectiveness of the policy adopted

The adequacy of the operating structure and internal controls to check the effectiveness of the policy adopted for market risks is the same to the one stated in item 5.1.c of this Reference Form. The adopted structure is adequate and able to monitor market risks in accordance with the guidelines of policies and the risk appetite statement.

5.3. With respect to the controls adopted by the issuer to ensure the preparation of reliable financial statements, indicate:

  1. The main internal control practices and the efficiency level of such controls, indicating any imperfections and measures adopted to correct them.

The management of Itaú Unibanco Holding is responsible for establishing and maintaining internal

controls related to the Company's consolidated financial statements.

The Internal control related to the financial statements is a process developed to provide reasonable assurance regarding the reliability of accounting information and the preparation of the financial statements disclosed in accordance with the International Financial Reporting Standards (IFRS) issued by the International Accounting Standards Board (IASB). The internal controls related to the financial statements include policies and procedures that: (i) are related to the maintenance of records that, in reasonable detail, reflect accurately and properly the transactions and write-offs of the Company's assets; (ii) provide reasonable assurance that transactions are recorded as necessary to enable the preparation of the financial statements under the International Financial Reporting Standards (IFRS) issued by the International Accounting Standards Board (IASB), and that the Company's receipts and payments are only being made as authorized by the Company's management and officers; and (iii) provide reasonable assurance regarding the timely prevention or the

detection of unauthorized acquisition, use or allocation of the Company's assets that could have a material

effect on our financial statements.

Due to their inherent limits, the internal controls related to the financial statements may not be able to avoid or detect errors. Therefore, even the systems determined to be effective may only provide reasonable assurance regarding the preparation and presentation of the financial statements. Likewise, projections of any evaluation on their effectiveness for future periods may be subject to the risk that controls may become inadequate due to changes in conditions, or deterioration may occur in the level of conformity with practices or procedures.

Management evaluated the effectiveness of the internal controls related to the Company's consolidated financial statements on December 31, 2019 in accordance with the criteria defined by the Committee of Sponsoring Organization of the Treadway Commission in Internal Control ("COSO") - Integrated Framework (2013). The management's evaluation includes the documentation, assessment and tests of the design and effectiveness of the internal controls related to the financial statements. Based on this evaluation, Management concluded that the internal controls related to the consolidated financial statements are effective with respect to December 31, 2019.

77

b) the organizational structures involved

Itaú Unibanco Holding's internal controls and operational risk management framework is in conformity with the definitions established by international bodies Committee of Sponsoring Organizations of the Treadway Commission (COSO) (2013) (COSO - Enterprise Risk Management (ERM) - Integrated Framework), and Information Systems Audit and Control Association (ISACA) (Control Objectives for Information and Related Technology (COBIT)). It also adheres to the recommendations suggested by the Basel Committee and the provisions of domestic and foreign regulatory bodies, and it is in line with institutional policy "Integrated Operational Risk and Internal Controls Management" as a primary means to operate its Operational Risk and Internal Controls management framework and to ensure compliance with defined guidelines by way of an integrated approach.

Main elements of this framework are:

Board of Directors:

  • Approving guidelines, strategies and policies related to operational risk and internal controls, ensuring a clear understanding of the roles and responsibilities by all the levels in the conglomerate.

Audit Committee:

- Supervising the internal controls and risk management processes.

Superior Operational Risk Committee (CSRO):

  • Understanding the risks of Itaú Unibanco's processes and business, defining guidelines for operational risks management and assessing the results of the work performed.

Compliance and Operational Risk Committee (CCRO):

  • Monitoring and promoting the development and implementation of guidelines approved and defined by the CSRO in each Executive Department, discussing main existing and potential risks in place at the Business Departments, as well as the action plans proposed for mitigation purposes.

Internal Operational Risk Committee (CIRO):

  • Discussing Operational Risks and Internal Controls related topics of each Business Unit, which will be reported to a higher decision-making level of authority at the Compliance and Operational Risk Committees (CCRO).

Chief Risk Officer (CRO):

  • Responsible for managing the organization's operational risk.

Internal Controls and Operational Risk:

Operating in the second line of defense, this framework is represented by superintendents working as Internal Controls and Risks Officials (OCIRs) who, together with their teams, are responsible for:

  • Supporting the first line of defense when carrying out its direct duties.
  • Developing and providing methodologies, tools, systems, infrastructures and governance required to support the integrated Operational Risk and Internal Controls management in the significant conglomerate and outsourced company activities;
  • Coordinating the Operational Risk and Internal Controls activities with the Business and Back- Office departments, being independent when exercising its functions and having direct communication with any management member or employee, as well as access to any information required under the scope of its responsibilities. Accordingly, this department is barred from carrying out any business that might compromise its independence.

Business/Back-Office Departments:

  • Primarily responsible for identifying, prioritizing, responding to risk, monitoring and reporting operational risk events that may impact the achievement of strategic and operational goals set.

Internal Audit:

  • Checking, on an independent and periodic basis, the adequacy of processes and procedures for risk identification and management, in accordance with the guidelines set forth in the Internal Audit Policy.

78

  1. whether and how the efficiency of internal controls is overseen by the issuer's management, indicating the position of the people responsible for such monitoring

To ensure that the risk management process is disclosed and reported to the institution's senior management, together with the respective status of action plans, the organization counts on the support of the Committees listed in item b) above, as defined in the Integrated Operational Risk and Internal Control Management Policy.

  1. deficiencies in and recommendations on the internal controls included in the detailed report prepared and forwarded to the issuer by the independent auditor, in accordance with the CVM regulation addressing the registration and exercising of the independent audit activity

We did not note any significant deficiencies in internal controls related to the financial statements in the independent auditor's report.

However, we should emphasize that action plans for other deficiencies and recommendations indicated by the independent auditor are monitored on a monthly basis and reported to the senior management by multidisciplinary committees, with the presence of representatives of the Internal Audit and Internal Controls.

Additionally, the results of this monitoring are periodically reported to the Company's Executive Committee and Audit Committee.

  1. officers' comments on the deficiencies stated in the detailed report prepared by the independent auditor and on any corrective measures adopted

We did not note any significant deficiencies in internal controls in the independent auditor's report.

5.4. In relation to the integrity mechanisms and internal procedures adopted by the issuer to prevent, detect and remedy misconduct, frauds, irregularities and illicit acts against national or foreign public administration, inform:

  1. whether the issuer has rules, policies, procedures or practices aimed to prevent, detect and remedy frauds and illicit acts against the public administration, and identify, if applicable:

i. key integrity mechanisms and procedures adopted and its adequacy to the profile and risks identified by the issuer, and inform how often risks are reassessed and policies, procedures and practices are adjusted

Itaú Unibanco has a series of corporate policies, such as the Anti-Corruption Corporate Policy, Corporate Conduct, Integrity and Ethics Policy, Government and Institutional Relations Policy, Code of Ethics, and Supplier Relationship Code, in addition to internal procedures, which help prevent frauds and illicit acts against the public administration. These Policies are available on website www.itau.com.br/relacoes-com-investidores> Menu > Itau Unibanco > Corporate Governance > Rules and Policies > Policies, and are revisited on an annual basis.

The Integrity and Ethics Program is structured through procedures and controls in the following dimensions: i) Senior Management Commitment, ii) Policies and Procedures, iii) Education and Communication, iv) Monitoring, and v) Channels for Reporting Unethical Misconduct, Questions, and Illicit Acts.

Risks are reassessed and the Program is improved on an ongoing basis. These assessments may be carried out in a number of ways, such as indicators, key control tests, risk diagnosis or studies of processes, audit work, outside assessments, and monitoring of standards and trends.

79

Itaú Unibanco's Integrity and Ethics Program is assessed by the Internal Audit department every year with satisfactory outcomes. Internal policies are also revised annually.

Additionally, in 2018 Itaú Unibanco's Integrity Program was assessed for maturity by an outside independent consultancy. This assessment was carried out through a methodology based on foreign legislations and the highest international integrity program assessment standards, covering a number of aspects of the Brazilian Anti-Corruption Law (Law No. 12,846/13), the Decree that regulated this law (Decree No. 8,420/15), and the guidelines of the Office of the Federal Controller General (CGU) for integrity program implementation. The outcome of this assessment has evidenced Itaú Unibanco's Integrity Program's advanced maturity level.

Our efforts to fight and prevent corruption and fraud have been publicly acknowledged by the Ministry of Transparency and the Office of the Federal Controller General (CGU) in partnership with the Ethos Institute for the recognition of Itaú Unibanco as a Pro-Ethics Company for the third consecutive year. In this latest edition, from the 373 participating companies in the 2018-2019 biennial period, 26 companies were approved and recognized at the Lei da Empresa Limpa (Clean Company Law) Conference held in Brasilia in December 2019.

It is worth mentioning that Itaú Unibanco has set a corporate policy to prevent its involvement in illegal activities, protect its reputation and image with employees, clients, strategic partners, suppliers, service providers, regulators and society by means of a governance structure focused on transparency, strict compliance with rules and regulations, and cooperation with the police and legal authorities. It also seeks to keep an ongoing alignment with the best national and international practices to prevent and fight illicit acts by way of making investments and continually training its employees.

In order to be compliant with corporate policy guidelines, Itaú Unibanco has established programs to prevent and fight illicit acts, based on the following pillars:

  • Customer identification process;
  • "Know Your Customer" process (KYC);
  • "Know Your Partner" Process (KYP);
  • "Know Your Supplier" Process (KYS);
  • "Know Your Employee" process (KYE);
  • Risk assessment on new products and services;
  • Transaction monitoring;
  • Reporting suspicious transactions to regulators and authorities;
  • Training; and
  • Preventing and fighting frauds.

These programs are applicable to the entire Itaú Unibanco Group, its subsidiaries and affiliates in Brazil and abroad. The corporate policy is revised once a year, and risks and procedures are reassessed on a permanent basis in accordance with the best market practices and dynamics.

The Illicit Acts Prevention and Combat Corporate Policy is available on the Investor Relations website: www.itau.com.br/investor-relations> Menu > Itaú Unibanco > Corporate Governance > Rules and Policies > Policies.

  1. the organizational structures involved in monitoring the operation and efficiency of the integrity mechanisms and internal procedures, to indicate its duties, whether their establishment was formally approved, the issuer's bodies to which they report, and mechanisms to ensure the independence of members, if applicable

The Corporate Compliance Office (DCC) is responsible for coordinating the identification of major risks associated with corruption and required adjustments of the Integrity and Ethics Program processes, with the support of other departments, such as the Corporate Security Office and the Internal Controls and Risk Office.

80

As defined in the Compliance Policy approved by the Board of Directors, the Compliance department is independent to exercise its duties and has direct communication with any management member or employee and access to any information required within the scope of its responsibilities.

This independence is strengthened by the framework of the Integrity and Ethics joint body coordinated by the DCC and the Program reporting to a number of Senior Management joint bodies (Superior Ethics and Sustainability Committee, Audit Committee, and Board of Directors).

DCC has, among its responsibilities, risk analysis with a focus on integrity and ethics; the creation of policies and procedures related to the Integrity and Ethics Program; alignment with the other departments of the Conglomerate for the implementation and maintenance of controls aimed at minimizing the risks; the establishment and implementation of a communication and training plan; and monitoring. These responsibilities are formalized in the Anti-Corruption Corporate Policy.

DCC also works in sharing the Integrity and Ethics Program with the Conglomerate's International Units, evaluating and supporting communication, awareness and training initiatives. The Program for Brazil and the International Units initiatives are discussed and approved in the Integrity and Ethics committees.

Furthermore, illicit act prevention and fight activities, including its monitoring, are carried out by Itaú Unibanco's Credit Risk, Modeling Department and Anti-Money Laundering and Counter Terrorist Financing Office (DRCMPLD), which is mainly responsible for:

    • Managing Itaú Unibanco's Anti-Money Laundering and Counter Terrorism Financing Program in Brazil and abroad;
    • Improving the quality and effectiveness of its processes and responsibilities over Itaú Unibanco's Anti- Money Laundering and Counter Terrorism Financing processes;
    • Performing a prior assessment of the risks of money laundering and terrorism financing in products and services;
    • Defining guidelines and minimum criteria for risk rating relating to money laundering and terrorism financing of customers, employees, business partners, suppliers, and service providers;
    • Monitoring and diagnosing different types of money laundering, in order to anticipate trends and propose preventive and countering solutions;
    • Validating Itaú Unibanco's Anti-Money Laundering and Counter Terrorism Financing procedures mentioned in the business units' documents;
    • Periodically reporting to the Audit Committee any material facts relating to Anti-Money Laundering and Counter Terrorism Financing of Itaú Unibanco.
  1. whether the issuer has a code of ethics or conduct formally approved, indicating:
  • whether it applies to all officers, members of the fiscal council, members of the board of directors, and employees, as well as to third parties, such as suppliers, service providers, intermediaries and associates

Itaú Unibanco's Code of Ethics applies indiscriminately to all management members and employees of the Itaú Unibanco Conglomerate in Brazil and abroad. The Corporate Conduct, Integrity, and Ethics Policy complements the Code of Ethics, establishing a series of procedures to ensure the sharing of ethical behaviors and the adoption of proper conduct by all policy addressees. Also complementing the Code of Ethics is the Supplier Relationship Code that is to be applied to all management members and employees of Itaú Unibanco and its direct and indirect suppliers. Additionally, the Corporate Anti-Corruption Policy applies to all management members, employees and controlling stockholders of the Conglomerate in Brazil and abroad, as well as to nonprofit organizations linked to the Conglomerate in Brazil, and to any relationship the Conglomerate has with clients, partners, suppliers, and other stakeholders.

81

  • whether and how often officers, members of the fiscal council, members of the board of directors, and employees undergo training in the code of ethics or code of conduct and other related rules

Senior management members take part in integrity and ethics training by way of in-person lectures and e-learning courses. Officers take part in integrity and ethics (business ethics, anti-corruption, compliance, information security, AML, personal investments, etc.) e-learning courses and in-person seminars. Members of the board of directors attend annual in-person illicit acts prevention and AML lectures. Furthermore, everybody receives periodic corporate communications on Code of Ethics related topics (via corporate portal and other available media) and must adhere to the corporate integrity policies on an annual basis by way of an electronic mandatory statement.

  • any sanctions applicable for violating the code or other rules, identifying the document in which these sanctions are provided

Any noncompliance with the guidelines of the Code of Ethics, the Corporate Conduct, Integrity and Ethics Policy, the Corporate Anti-Corruption Policy, and the Supplier Relationship Code, in addition to other corporate integrity policies, is subject to administrative sanctions set forth in Itaú Unibanco's internal rules. These sanctions may range from receiving feedback or warning to the mere termination or termination with cause according to the seriousness of the misconduct.

  • the body approving the code, date of approval, and, if the issuer discloses the code of conduct, where in the web this document may be found

The Itaú Unibanco's Code of Ethics was approved by the Board of Directors of Itaú Unibanco Holding S.A. on November 30, 2019. This document is available on the bank's intranet and on the Internet at www.itau.com.br/relacoes-com-investidores www.itau.com.br/investor-relations> Menu > Itaú Unibanco > Corporate Governance > Rules and Policies > Code of Ethics and Conduct.

  1. whether the issuer has a whistleblowing channel, indicating, if applicable: I) if it is either an internal channel or it is in charge of third parties

Itaú Unibanco's Code of Ethics and its Corporate Integrity, Ethics and Conduct Policy encourage the timely reporting of suspected or actual violation of guidelines, laws, rules or regulations. These documents contain guidelines on how the commitment of each and every employee to the guidance in the Policy and the Code of Ethics is the effective pillar of Itaú Unibanco's soundness and sustainability. If an employee faces or witness any suspicious or actual related situation, they are responsible for promptly reporting it to available channels, each with its own specificities, as follows: Ethics Consultancy, Audit Committee, Inspector Office, and Internal Ombudsman's Office. These four internal channels are structured as follows:

  • Ethics Consultancy
    The Ethics Consultancy is structured in the Regulator Relationship and Compliance Superintendence, which reports to the Operational Risk and Compliance Executive Board.
  • Audit Committee
    The Audit Committee reports to the Board of Directors.
  • Inspector Office
    The Inspector Office is structured under the Inspector Office and Fraud Prevention Superintendence, which reports to the Corporate Security Office.
  • Internal Ombudsman's Office
    The Internal Ombudsman's Office is structured in the Ombudsman Superintendence, which reports directly to the CEO.

82

II) whether the channel is open to receive reports from third parties or only from employees

These reporting channels are available to the following audiences:

  • Ethics Consultancy
    Channel available to employees for guidance and solving questions on ethical issues, such as conflicts of interest and ethical dilemmas.
  • Audit Committee
    Channel available to employees and the external public to receive suspected or actual reports on any noncompliance with legal and regulatory provisions and internal rules, frauds committed by management members, employees or third parties, or errors resulting in significant misstatements.
  • Inspector Office
    A channel available to employees and the external public to receive reports on frauds and other illicit acts, including corruption acts.
  • Internal Ombudsman's Office
    A channel available to employees to receive and handle interpersonal conflicts and conflicts of interest in the workplace, ethical misconduct and nonconformities with related institutional policies carried out by management members and employees.

III) whether mechanisms are in place to provide anonymity and protect whistleblowers in good faith

These channels provide confidentiality and protection to whistleblowers. The Code of Ethics and the Integrity, Ethics and Conduct Policy provide information on how a report may be filed, as follows:

  • Secrecy of the inquiry will be kept;
  • Anonymity is also assured to those who so desire.
  • The investigation will be unbiased and independently conducted;
  • Reports or accusations without consistent reasoning will be disregarded;
  • Malicious information or accusations, aiming to undermine someone, will be subject to disciplinary measures;
  • Disciplinary measures are prescribed for any attempted retaliation.

IV) issuer's body responsible for investigating whistleblowing reports

Itaú Unibanco's Code of Ethics discloses four guidance channels for reporting any suspected or actual violation of a guideline, law, rule or regulation. All reports are received and analyzed by the proper channel 1, on an independent, unbiased basis and at arm's length, and a registration is kept of the related analysis and handling history.

The responsibilities of these channels and the governance ruling their activities are formalized in the organization's internal policies (such as the Reporting Channel - Illicit Acts Policy and the Corporate Integrity, Ethics and Conduct Policy), described as follows:

    • Specific channels in the local Codes of Ethics are provided in the International Units or the whistleblower may report through the following channels at the parent company: Inspector Office, Audit Committee, and Internal Ombudsman Office, in accordance with the respective governance level.
  • Ethics Consultancy

The Ethics Consultancy guides and solves doubts on issues regarding the Code of Ethics and the Corporate Integrity, Ethics and Conduct Policy, such as conflicts of interest and ethical dilemmas, through the key for email COMITÊ DE INTEGRIDADE E ÉTICA. If required, the Ethics Consultancy may escalate the issue to an integrity and ethics joint body.

83

  • Audit Committee

The Audit Committee is one of the channels that receive reports whose investigations are coordinated by the Internal Audit.

  • Inspector Office

The Corporate Security Office analyzes the reports received, obtains supplementary information and documents to investigate facts, carries out interviews and internal inquiries, requesting support from other departments, when required, such as the Legal, Audit or Internal Ombudsman's Office, to help analyze and/or address such reports.

In the event a specific report cannot be assessed due to a conflict of interest, the procedure to be followed for submission of the report to the Executive Internal Audit Board is described below:

Involved in the report

Responsible for the analysis and

handling

Up to superintendent level

Corporate Security Office

Officers and executive officers

Executive Internal Audit Board and

Corporate Security Office

Members of the Executive Committee or

Executive Internal Audit Office

Audit Committee or members of the Board

of Directors or other members of the

committees reporting to the Board of

Directors

Audit officers

Board of Directors, Audit Committee, and

Corporate Security Office

  • Internal Ombudsman's Office

The Internal Ombudsman's Office is an independent department in the organization with autonomy to operate in any hierarchical level. This department analyzes the reports received, obtains supplementary information and documents to investigate facts, carries out interviews and requests support from other departments, when required, such as the Legal and Inspector Office, to help analyze and/or address such reports. In cases involving senior management members, this channel may also request the Executive Committee and/or the Audit Committee to resolve on such incidents.

  1. whether the issuer adopts any procedures in mergers, acquisitions or corporate reorganizations to identify weaknesses and risks of undue practices in the companies involved in these processes

In mergers, acquisitions, and corporate reorganizations, Itaú Unibanco, through its proprietary mergers and acquisitions department, adopts the procedures available to identify any weaknesses and relevant undue practices in connection with the counterparties involved in such processes.

This procedure is carried out by way of a thorough diligence process on companies subject to a merger or acquisition, as well as by the inclusion of specific contractual clauses in the instruments that formalize each operation in the event the transaction is closed.

A diligence is the in-depth assessment and analysis of publicly and non-publicly information and documents of an entity and/or a business as part of a merger or acquisition operation. It is a long-running, complex investigation process aimed at identifying weaknesses and/or relevant undue practices in the company involved in the process and validating the data made available to prospective buyers.

This process comprises financial, accounting, fiscal, technology, legal, corporate, labor, social security, E&S, real estate, intellectual property, compliance, AML, anti-corruption, among other issues, so as to assure whether the company has conducted business in compliance with applicable legislation and whether it is regularly organized, in addition to whether it holds all authorizations and permits required for operation purposes.

84

In addition to the proprietary mergers and acquisitions department and the external advisors engaged with exclusivity to this end, the diligence process involves other departments of the bank to help the analysis process, such as the Compliance, Audit and Internal Controls, Corporate Legal and Litigation, Business and Products, Finance, Tax, Treasury, Human Resources, Technology and Information Security.

Notwithstanding all reasonable measures taken to identify weaknesses and undue practices, there is always the risk that we, our legal or financial advisors may not detect them. Should this occur and Itaú Unibanco incur losses as a result of these weaknesses and undue practices after the completion of the process, the indemnity rules provided for in the agreements related to each operation will be applied.

Regarding contractual provisions, Itaú Unibanco demands that its counterparties provide a number of representations and warranties regarding themselves and the entities and/or business involved in the operation. These representations and warranties cover, for example, the regular organization of companies and compliance with legislation applicable to these companies, including specific anti-corruption and anti- money laundering regulations. Any breach of these representations and warranties by counterparties may cause different penalties to befall these counterparties, including the early termination of the contract or operation in question and the payment of compensation to the buyer for the damage suffered.

After completing this process, the resulting analysis is submitted to and discussed by the executive team involved in the business and later forwarded for approval by the Strategy Committee, the Executive Committee and/or the Board of Directors, if applicable.

  1. whether the issuer has no rules, policies or practices to prevent, detect and remedy frauds and illicit acts carried out against public administration, identify the reasons why the issuer has failed to adopt any controls accordingly

Not applicable.

5.5. State whether, in the previous year, there were significant changes in the main risks to which the issuer is exposed or in the risk management policy adopted, and comment on any expected increase or decrease in the issuer's exposure to such risks

In the last fiscal year there were no significant changes in the main risks to which the Issuer is exposed or in the risk management policy adopted. We believe that managing risks is the essence of our activity and a responsibility of all employees and, therefore, we have the challenge of following up and monitoring traditional risk areas (market, credit and operational risks), and seek, based on our risk culture, to involve all our employees in the day-to-day of risk management. In relation to any expected increase or decrease in the

Issuer's exposure to risks, in addition to those declared in the traditional risk management, we will also seek

to monitor the following as we consider them to be emerging risks:

  • Business risk: client centricity is a principle of ours, prioritizing the sustainability of our relationships. We monitor the evolving profile of our clients and competition, creating new products and services always focused on customer satisfaction.
  • Technology risk: we are committed to managing our digitization process, preventing the obsolescence of platforms or systems that may no longer meet business needs, in addition to increasing our IT department productivity.
  • People risk: we are committed to improving mechanisms to attract, motivate and retain the best professionals. We should continually improve our evaluation models to be increasingly perceived as fair and meritocratic.
  • Regulatory risk: we should always be attentive to specific changes in laws and regulations that may affect our business and the offer of products or services. Therefore, we are committed to having a proactive attitude and monitor regulatory changes.

85

5.6. Supply other information that the issuer may deem relevant

On August 21, 2017, CMN Resolution No. 4,557, which provides for the risk and capital management structure, came into effect. Noteworthy in this resolution are the implementation of a continuous, integrated risk management framework, the requirements for defining the Risk Appetite Statement (RAS) and the stress testing program, the set-up of a Risk Committee, the nomination of the Chief Risk Officer (CRO) to be reported to the Central Bank of Brazil, and the CRO's roles, responsibilities and independence requirements.

Additional information on items 5.1 and 5.5

COVID-19

During this unprecedented health crisis, we are engaged in reducing the transmission of COVID-19 not only within our facilities but also across Brazil and in the countries in which we operate, as we are aware of the importance of avoiding the collapse of public and private healthcare systems.

Since March 2020, our senior management and Executive Committee have held daily meetings to continuously monitor the crisis and to implement the measures necessary to support our workforce, our clients, and the society in facing the COVID-19 pandemic.

Please find below some initiatives that we have adopted in hopes of minimizing the effect of the COVID-19 pandemic.

For the society:

We have announced the donation of R$250 million through Fundação Itaú and Instituto Unibanco for the building of hospitals, the purchase of respiratory equipment, masks, basic needs and hygiene kits. Our goal is to support vulnerable communities and to assist in the prevention and treatment of COVID-19. In trying to achieve this goal, we have, along with Bradesco and Santander, donated 5 million quick COVID-19 tests and medical equipment, such as tomography devices and respiratory equipment.

In order to provide support to parents with young children, we have launched the 'read at home' campaign, a special edition of our 'read for a child' program suitable for social distancing.

We launched the Todos pela Saúde ("All for Health") initiative that will be funded by a R$1 billion donation. The purpose of this initiative is to fund and coordinate relief efforts aimed to address the effects of the COVID-19 pandemic on Brazilian society. Seven renowned experts will lead the initiative and will be responsible for selecting initiatives to be funded. Todos pela Saúde will operate through four axes of action:

  • Informing: educating the population, such as promoting the use of face masks;
  • Protecting: testing the population and health professionals;
  • Caring: supporting officials of states and large municipalities in establishing crisis response committees; training and supporting health professionals; adopting telemedicine; expanding the capacity and efficiency of hospitals; acquiring and distributing strategic inputs, as well as procuring equipment and human resources.
  • Resuming: cooperating for the development of strategies to a safely resume social activities, and monitoring programs for vulnerable communities.

For our clients:

• Since March 24, 2020, opening hours of Itaú and Itaú Uniclass branches were shortened:

  1. from 9:00 am to 10:00 am to the special public (retirees, INSS beneficiaries, the elderly, and pregnant women); and
    1. from 10:00 am to 2:00 pm to the general public, on a contingency basis.
  • Itaú Personnalité digital branches have also shortened their opening hours, now from Mondays to Fridays, from 9:00 am to 6:00 pm.

86

  • Our reward programs will not expire until June 30, 2020.
  • We are encouraging the use of our digital channels, such as apps and bankline, and digital products, such as virtual cards, contactless payment, and digital bank statements.
  • We have added content to our website to assist clients in the use of digital channels, along with information relating to opening hours, branches, and other frequently asked questions (www.itau.com.br/coronavirus).
  • We will ramp up communication through digital channels, both for our usual customer service and for providing financial guidance during this period of market instability.
  • We have increased the transaction limits in our digital channels, so that our clients are able to make transactions and payments without having to leave their homes.
  • We offered an emergency credit line for SME payroll loans and granted a 60-days grace period for individuals loans.
  • We have announced a timely extension of 60 days to installment payments of up-to-date loans, maintaining the original interest rate of the contract.
  • In April, we extended the term for extending loan and financing installments by up to 120 days for individuals and up to 180 days for small and middle market companies.

•In addition, loan agreement terms can also be extended up to 6 years for individuals and up to 5 years for small and middle market companies, thus reducing the value of monthly installments and keeping the same interest rates. Within this period, approximately 850 thousand contracts have already been renegotiated.

  • We have suspended the minimum billing requirement for Rede's clients until May 31, 2020, thus ensuring fee rates remain unchanged regardless of the billing volume reached.
  • Since March 26, users may block cards in the event of loss or theft at the customer service IVR. This enables our clients to block cards by themselves very quickly, without having to wait for the help of one of our employees.
  • In partnership with Ifood, Rede has given more liquidity to the restaurants affiliated to the platform: from April 2, 2020 on, these restaurants will receive their sales revenues in 7 days rather than the usual 30- day period.
  • Clients with vehicle financing who wish to request a 60-day postponement for repaying installments may do so on a fully digital basis, by accessing option "Carência 60 dias" (60-day grace period).
  • Small businesses may have their employees' salaries guaranteed for two months. This is eligible for businesses which: (i) have annual revenues from R$360 thousand through R$10 million; (ii) have engaged our payroll loan services; and, (iii) are current with payments in the latest quarter. These eligible companies may start repaying this benefit in six months, with installment payments of up to 30 months, and an interest rate equivalent to the CDI rate, which is currently at 3.0% p.a. This measure is a part of the PESE Program, which is a partnership with the Brazilian National Treasury, the Central Bank, and Bradesco and Santander.

For our employees:

We have taken preventive measures, to ensure the wellbeing of our workforce that were only possible due to our continuous investments in people development and technology.

  • Several channels to provide our employees with intense communication about COVID-19 and our role during this crisis.
  • Daily report distributed to all our employees.
  • CEO posts weekly videos with updates on the actions taken to fight this crisis.
  • Currently we have around 40 thousand collaborators working remotely.
  • Risk group employees were kept away from their in-person activities on a preventive basis, and were instructed to work remotely or have their absence waived.

87

  • All in-person events and meetings that could not be done through digital channels were canceled.
  • The number of clients in branches at the same time has been limited to 10 people at the most.
  • Branch employees are working under a weekly rotation system, with the physical presence of up to 50% employees, as we seek to keep minimum staff numbers in client service.
  • Branches hit with COVID-19 cases will be closed for the public and only reopen when all outlined prevention measures are completed.
  • We have readjusted our call center operations and intensified hygiene protocols.
  • Early payment of the 13th salary on April's payroll.
  • Temporary suspension of employment contract terminations without cause.
  • We have entered into new partnerships offering benefits that promote physical and mental health with activities that may be performed at home (Totalpass and GympassW).
  • The Be Ok (Fique OK) channel is available for all employees and family members who wish to talk about their health. A multidisciplinary team of professionals, such as psychologists, psychiatrists, and nutritionists, provides advice by telephone, email or WhatsApp.
  • Remote medical advice service is available to all employees, free of charge and regardless of the healthcare plan they have, through Sírio-Libanês and Albert Einstein hospitals. Advice is offered by professionals, who screen symptoms and advise on signs of severity, treatments and suitable referrals, so as to contribute to the wellbeing of all and prevent people from going to hospitals in less complex cases.

ITEM 6. HISTORY OF THE ISSUER

6.1 / 6.2 / 6.4 - Issuer's incorporation, term of duration and date of registration with CVM

Date of issuer's incorporation

09/09/1943

Type of business organization

Corporation

Country of incorporation

Brazil

Term of duration

Undetermined

Date of registration with CVM

12/30/2002

6.3. Brief history of the Issuer General

Our legal name is Itaú Unibanco Holding S.A. We were incorporated on September 9, 1943. We are organized as a publicly-held corporation for an unlimited period of time under the laws of Brazil. Our head offices are located at Praça Alfredo Egydio de Souza Aranha, 100, CEP 04344-902, São Paulo, SP, Brazil, and our telephone number is +55-11-2794-3547. Our CNPJ/MF nº 60.872.504/0001-23 is registered at the Board of Trade of the State of São Paulo under NIRE No. 35300010230. Our social purpose, as established by Article 2 of our Bylaws, is to undertake the banking activity in all authorized forms, including foreign exchange operations.

We were formed in 2008 by the merger of Banco Itaú S.A. and Unibanco. Banco Itaú's predecessor was founded in 1943 as the Banco Central de Crédito S.A. in São Paulo. Unibanco's predecessor was founded in 1924 as the Seção Bancária da Casa Moreira Salles in Minas Gerais.

In 2008, Itaú and Unibanco merged to become the largest Brazilian bank and one of the twenty largest banks worldwide in terms of assets. The merger was not limited to only a merger of two businesses, but was also the blending of two institutional cultures that complement one another and share common characteristics, such as growth on the basis of mergers and acquisitions, ethics and transparency, respect of the law, close relationships with clients and collaborators, and expansion on the basis of adequate financing.

88

Historically, we have always been responsive to transformations that take place in society. In 2019, we have taken a stronger position in digital transformation and client satisfaction with the opening of virtual branches, the creation of apps for smart phones and tablets with new functionalities, and the acquisition of firms that offer solutions in technology, as in our recent acquisition of Zup IT Serviços em Tecnologia e Inovação Ltda. We are likewise reinforcing our aim to provide positive changes in the lives of people and in society as a whole, establishing commitments with sustainability and diversity.

6.5. Indicate whether there has been any petition for bankruptcy, provided that it was based on a significant amount, or for judicial or extrajudicial recovery from the issuer, and the current status of such petitions:

Not applicable.

6.6. Other relevant information Not applicable.

ITEM 7. ACTIVITIES OF THE ISSUER

7.1 Briefly describe the activities carried out by the issuer and its subsidiaries

We are a holding company whose main activity is to hold ownership interests in the capital of financial institutions that, in turn, were incorporated for the purpose of developing all authorized types of banking activities. Additionally, we also hold investments in companies that carry out activities related to the insurance and capital markets.

7.1-A. If the issuer is a semi-public corporation, please identify:

  1. the public interest that justified its incorporation Not applicable.
  2. Issuer's operations in compliance with public policies, including universalization targets, identifying:
    • government programs carried out in the previous year, those established for the current year, and those determined for the next fiscal years, the criteria adopted by the issuer to classify these operations as being developed to meet the public interest mentioned in "a"
    • with respect to the above-mentioned public policies, the investments made, cost incurred and the origin of funds involved - own cash generation, transfer of public funds and financing, including funding sources and conditions
  • estimated impacts of the above-mentioned public policies on the issuer's financial performance or state that no analysis was carried out of the financial impact of the above-mentioned public policies

Not applicable.

  1. Pricing process and rules applicable to establishing fees Not applicable.

89

7.2. With respect to each operating segment disclosed in the latest financial statements for year-end or, where applicable, in the consolidated financial statements, please indicate the following information:

a) Marketed products and services

Operations Overview

We report the following segments: (i) Retail Banking, (ii) Wholesale Banking, and (iii) Activities with the Market and Corporation. Through these operational segments, we provide a broad range of banking services to a diverse client base that includes individuals and corporate clients, on an integrated basis as follows:

The Retail Banking segment offers services to a diversified base of account holders and non-account holders, individuals and companies in Brazil. The segment includes retail customers, mass affluent clients (Itaú Uniclass and Personnalité) and very small and small companies. Our offering of products and services in this segment includes: personal loans, credit cards, payroll loans, vehicle financing, mortgage loans, insurance, pension plan and premium bond products, and acquiring services, among others. The Retail Banking segment represents an important funding source for our operations and generates significant financial income and banking fees.

The Wholesale Banking segment is responsible for our private banking clients, the activities of our Latin America units, our middle-market banking business, asset management, capital market solutions, corporate and investment banking activities. Our wholesale banking management model is based on building close relationships with our clients by obtaining an in-depth understanding of our clients' needs and offering customized solutions. Corporate activities include providing banking services to large corporations and investment banking activities include offering funding resources to the corporate sector, including fixed and variable income instruments.

The Activities with the Market and Corporation segment manages interest income associated with our capital surplus, subordinated debt surplus and the net balance of tax credits and debits. This segment also manages net interest income from the trading of financial instruments through proprietary positions, currency interest rate gaps and other risk factors, arbitrage opportunities in the foreign and Brazilian domestic markets, and mark-to-market of financial instruments. It also includes our interest in Porto Seguro S.A. For more information on our interest in Porto Seguro S.A., see "-Insurance."

We carry out a wide range of operations outside of Brazil with units strategically located in the Americas, Europe and Asia. Our international presence creates significant synergies in foreign trade finance, in the placement of Eurobonds and in the offering of more sophisticated financial transactions to our clients.

Please see "Note 30 - Segment Information" to our audited consolidated financial statements for further details.

90

The diversification of our business is reflected in the changing composition of our loan portfolio over the last few years, focusing on origination in lower risk segments with enhanced guarantees. We continuously seek to implement and focus on offering new products and services that add value to our clients and diversify our income sources. This allows for the growth of our non-financial income arising mainly from banking service fees, income from bank charges and from insurance, pension plan and capitalization operations.

Retail Banking

We have a large and diverse portfolio of products, such as credit and investments, and services to address our clients' needs. Our retail banking business is segmented according to customer profiles, which allows us to connect with and understand our customers' needs, better enabling us to offer suitable products to meet their demands. Our main activities under the retail banking segment are the following:

Itaú Retail Banking (individuals)

Our core business is retail banking and through our retail operation we offer a dedicated service structure to consumer clients throughout Brazil. Our customer service structure is targeted to offering the best solutions for each client profile. We classify our retail clients as individuals with a monthly income of up to R$4,000.

Our Itaú Uniclass services are available at every branch for clients who earn more than R$4,000 and less than R$10,000 per month. We offer exclusive services to our Itaú Uniclass clients, including investment advisory services, exclusive cashiers and higher credit limits and a large team of dedicated relationship managers. For clients who prefer remote services, our Itaú Uniclass provides a "digital bank platform" where relationship managers service clients through telephone, e-mail, SMS, videoconference and chat from 8 a.m. to 8 p.m. on business days, at no additional cost.

Our focus on digital transformation led to an increase of the share of our digital operations, which are sales, account openings and accesses through the internet and mobile app. For instance, the online account opening process via mobile app, launched in 2016, already represents 39% of the individual accounts opened on a monthly basis (excluding salary accounts), as of December 31, 2019.

We have also focused on developing initiatives to improve customer satisfaction, according to the NPS System. The satisfaction ratings (NPS score) of the retail bank improved 8 percentage points between August 2018 and December 2019.

Itaú Personnalité (banking for high-income individuals)

We began providing customized services to high-income individuals in 1996 with the creation of the Itaú Personnalité segment, which currently serves individuals who earn more than R$15,000 per month or have investments in excess of R$250,000.

Itaú Personnalité is focused on providing (i) financial advisory services by managers who understand the specific needs of our higher-income clients, (ii) a large portfolio of exclusive products and services and (iii) special benefits based on the type and length of relationship with the client, including discounts on various products and services. Itaú Personnalité services its clients through a dedicated network of 236 branches, located in the main Brazilian cities. Itaú Personnalité clients also have access to our retail banking network of branches and ATMs throughout the country and can also access our internet, telephone and mobile banking.

For clients who prefer remote services, Itaú Personnalité provides a "digital bank platform" where relationship managers service clients through telephone, email, SMS and videoconference from 8 a.m. to 10 p.m. on business days. We also developed apps for smartphones and tablets that enable our clients to make investments, buy products such as credit and insurance, make check deposits, transfers and payments, check account balances and find nearby branches and ATMs using GPS features.

91

The table below shows our market position and information about competitors for our retail banking (including Itaú Personnalité) business:

Itaú Empresas (very small and small companies)

To meet and fulfill the needs of our corporate customers, we specialize in offering customized solutions and detailed advice on all products and services for:

  • Microenterprises: customer base consisting of companies with annual revenues of up to R$ 1.2 million, served by 2,686 bank branches and 2,098 relationship managers at December 31, 2019; and
  • Small businesses: customer base consisting of companies with annual revenues between R$ 1.2 million and R$ 30 million, served by 411 bank branches and 1,628 relationship managers at December 31, 2019.

ANBIMA certifies all of our relationship managers, who are trained and skilled to offer the appropriate banking solutions for each client, guided by all the variables that can affect the companies that we serve and their owners.

Our customers rely on our main strategy of capturing market opportunities and meeting their needs, particularly regarding cash flow management, credit facilities, investments and banking services.

To honor our commitment to customer centrality in 2019, we created experience improvement fronts in our product hiring journey. In addition, in order to increase satisfaction, we established the end of the prepayment rate on credit card transactions without installments for eligible clients.

In order to improve our loan portfolio and reduce the volume of delinquent loans, we focus on sustainable loan portfolio growth. We have improved credit review processes, policies and tools, as well as intensified our credit collection and recovery efforts.

We maintained our service model in digital branches, aiming at greater efficiency in business generation and prompt service. In addition, we also increased our commercial team focused on acquiring new customers.

We strive to maintain high levels of customer satisfaction by placing them at the center of our business approach. To achieve this goal, we implemented follow-ups through periodic and detailed indicators for transactions and interactions with our managers and other service channels.

We continue our strategy to develop digital products and services, as well as the development and enhancement of the tools used by our sales and relationship teams and intend to continue to capture and expand the benefits of such investments, measured by increased business productivity and greater proximity to our customers.

Credit Cards and Commercial Agreements

We are a leader in the Brazilian credit card market in terms of purchase volume, according to ABECS.

Through our proprietary and partnership operations with major retailers, telephone operators, automakers and airlines established in Brazil, we offer a wide range of credit and debit cards to account holders and non-account holders.

Our purpose is to provide the best customer experience and satisfaction. Our aim is to continuously grow our credit card portfolio, to increase profitability and to manage the quality of our assets. Accordingly, our credit card division is dedicated to developing new products and new digital services while controlling our portfolio credit quality, increasing the ability of our customers to obtain financing and assessing our partnerships.

92

At the beginning of 2019 we defined the "Customer First" as one of our priorities. Our global net promoter score, a measure of customer satisfaction, indicates that our score improved 5bps compared to 2018. Our strategies focus in three main customer segmentation businesses: Account Holders, Non-Account Holders and Retail Partnerships.

In 2019 the Account Holders businesses - Itaú Agências, Itaú Uniclass e Personnalité - achieved the record on activated and total accounts, growing by more than 7% and 5% compared to 2018, respectively. We reached purchase volume growth of 18% compared to 2018. At the end of 2018 and throughout 2019 we launched fast growing sales products: Itaú Uniclass Mastercard Black, Itau Uniclass Visa Infinite and Itaú Personnalité Visa Infinite.

In the Non-Account Holders division, we launched the Itaucard "Click" credit card in October 2019. The value proposition is to offer a simple, digital product with financial solutions for the customer. We launched it as a spending based fee waiver product in which customers who make more than R$100 in purchases per month will be exempt from the annual fee. After the launch we got a 12bps leverage on the portfolio's NPS.

In the same month, the LATAM Pass program was launched. It unified the customer base of Multiplus Itaucard and Latam Itaucard. The new product offers several benefits such as VIP lounge access, international class upgrade vouchers and the possibility of free annual fee.

We also advanced with Credicard, following the brand relaunch in December 2017. In January 2019 Credicard moved into its own office, extending the brand's and business autonomy. Credicard customer satisfaction grew by +12 bps in the NPS and for the second consecutive year earned the "Reclame Aqui" award in the Credit Cards category. We are seeking to deliver more benefits to our customers, so we launched 26 new partnerships in the Credicard app benefits store, increasing customer satisfaction.

The Retail Partnerships business is one of our fastest growing businesses in the credit card division. We have partnerships with the main national retail brands, such as Magazine Luiza, Ponto Frio, Pão de Açúcar and Extra. In 2019, we delivered a double-digit revenue growth with these portfolios.

In partnership with Magazine Luiza we continue to reinforce our strategy of growing customer base. In 2019, we had sales and purchase volume growth records- more than 14% year over year and more than 33% year over year, respectively.

Finally, we increased functionality and in-store service capabilities, allowing customers to solve their requests at time and increasing the NPS by 5 bps.

In the Sam's Club card, in addition to the launch of the discount program, we have improved the points program, where now for every R$ 2,500 spent in the year in any Big Group store, the customer has a cashback of R$ 75 on the bill, which is the amount paid to be a member of the Club.

At Marisa the milestone of the year was the launch of the International variant, meeting the main desire of Marisa Itaucard card customers. The Marisa Internacional card already represents 37% of the portfolio, significantly boosting business revenues and purchase volume.

At Ipiranga we launched the Platinum variant. The card was the first product at Itaucard with cashback, for any transaction, the customer has 1% cashback. When the transaction is made in the Abastece Aí app, the customer has a 3.5% cashback, in addition to having a 5% discount at the time of fuel supply.

In 2018, we launched our digital wallets and became the first bank in Brazil to have all portfolios available for Apple, Samsung and Google Pay, both for credit and debit cards. By December 2019, we had more than 2.5 million users.

Payroll Deducted Loans

In Brazil, a payroll deducted loan is a specific type of loan entered into by salaried employees or pensioners of the Brazilian social security system, as borrowers, and banks, as lenders, in which fixed monthly installments are deducted directly from the borrower's payroll or pension, as the case may be, for the payment of the amount owed to the lender.

Our strategy is directed mainly to the pensioners of the Brazilian social security system and employees of public and private companies.

93

We offer payroll deducted loans in Brazil mainly through two sales channels: (i) our branch network and our remote service channels, focusing on retail account holders, and (ii) the network of acquisition partners, focusing on non-account holders. This strategy allows us to expand our business activities with historically lower credit risk, achieving a competitive position in the offer, distribution and sale of payroll deducted loans in Brazil and improving the risk profile of our loans portfolio to individuals.

Mortgage

We assist our clients with their financial development, as we help them with their personal assets. Mortgage financing products allow us to create long-lasting relationships with our clients, as mortgage financing products are of a long-term nature.

Since 2008, we have been the market leaders among Brazilian private banks in mortgage loans to individuals in terms of the total size of our portfolio. This is a result of our business focus, which is in line with our strategy to migrate to lower-risk portfolios.

We have several sales channels that are utilized for purposes of mortgage financing products: (i) branch network, (ii) construction and development companies, (iii) mortgage agencies, and (iv) partnerships with REMAX, a realtor company, and CrediPronto, a mortgage financing company.

We prioritize customer satisfaction by providing our clients with a specialized mortgage financing advisor to support them during the mortgage process. Our process is expeditious and efficient, and it takes us less than two hours to get back to the client for loans up to R$1 million. This financing process can be fully digital.

In line with our strategic focus on digital processes, our simulator is included on the websites of partner development companies and real estate agencies, placing our brand closer to clients when they are looking to acquire real property. Our services are customized for every moment of the client's digital journey, from internet banking services to social networks, providing us with increasing client exposure levels. In 2019 and 2018 we were awarded the "Best Digital Mortgage Bank Brazil" by Global Finance.

The number of mortgages we provided directly to individuals in 2019 was 40 thousand, for an aggregate value of R$12.9 billion during the year. In 2019, our portfolio had an average Loan to Value (LTV) of 38.6%, compared to 38.7% in 2018. In commercial loans, we financed 95 new real estate units during 2019, with an aggregate value of R$3.6 billion.

Another positive feature of the Brazilian market is the constant amortization system pursuant to which decreasing installments provide faster amortization of a contract, reducing our loan-to-value indicator at a faster rate than other amortization systems.

Merchant Acquirer

Rede is one of the leading companies in the electronic payment solutions industry in Brazil. It is a multi-brand merchant acquirer of credit, debit and benefit cards. Rede's activities include merchant acquiring, capturing, transmission, processing and settlement of credit and debit card transactions, prepayment of receivables to merchants (resulting from credit card transactions), rental of point of sale (POS) terminals, e- commerce solutions, e-wallet and check verification through POS terminals.

In 2019, we kept on restructuring our business model, which has as its priorities: 1) integration of our banking operations; 2) strengthening of direct sales channels; and 3) digital transformation.

We received R$ 487.8 billion in transactions with respect to credit and debit cards in 2019 an increase of 11.6% compared to the same period in 2018. The following table sets forth the financial volume of transactions of credit and debit cards processed by us in 2019, 2018 and 2017:

94

Credit cards

Debit cards

Total

(In billions of R$)

Financial Volume

2019

2018

2017

314.1

280.8

255.9

173.7

156.3

135.8

487.8

437.1

391.7

Private Pension Plans

We offer private pension plans to our clients as an option for wealth, inheritance planning and income tax purposes (these products are tax-deferred). We provide our clients with a solution to ensure the maintenance of their quality of life through long-term investments, as a supplement to government general social security system plans.

Product innovation has been important for the sustainable growth of our private sector pension operations. For legal entities, we offer specialized advice and develop customized solutions for each company. We establish long-term partnerships with our corporate clients, maintaining a close relationship with their human resources departments and adopting a communication strategy focused on our employees' financial education.

According to the National Federation of Private Pension and Life (Federação Nacional de Previdência Privada e Vida), or FENAPREVI, contributions to Itaú Private Pension Plans reached R$21.6 billion in 2019, mainly due to the increase in our VGBL (Redeemable Life Insurance) product.

Vehicle Financing

We have developed and launched a series of new products and services during 2019, some of which are described below:

Digital Retail - the evolution in our digital retail platform has had an important impact in our journey. We have launched a feature that enables the customer to give the next step in his or her financing process. Now, our clients are able to upload the documents and complete all the information needed to book a transaction.

iCarros Products - Our solutions help dealers make their sales process more efficient. The Lead Manager is now fully integrated with Linx Auto solution to help dealers on sales and billing process, ensuring a unique journey experience; "Garagem do Conhecimento" is a new educational platform with distant education classes to prepare professionals of the automotive sector. We are the first Brazilian automotive marketplace integrated with several banks, who offer personalized credit that match customer's profiles; Check-up iCarros is a car management app for end consumers, focused on services to drivers and also supplying detailed data from clients' cars to the service providers.

New Credline - our credit application platform has significantly evolved along the year. We launched the corporate buyer experience, which increased significantly our market visibility. Further, in order to ensure safety in our transactions, we have deployed a facial biometrics solution.

Vehicle Website - we created the Itaú website for our vehicle solutions. In this webpage, we advertise all of our solutions for this segment, including the auto loan digital process, our products shelf, and our benefit shelf. The number of page views on our website increased from 100,000 to 1,000,000. This solution offers experience to either individual or corporate buyers.

95

As of December 31, 2019, our individual and corporate vehicle financing portfolio (ex Finame) totaled R$28 billion, an 39% increase from the previous year. The average loan to value ratio of our individual vehicle portfolio (the ratio of a loan to the value of an asset purchased) was 59.6% in December 31, 2019, a 2% increase compared to 2018. Since 2012, we have reduced our risk exposure in the sector and focused on clients with better risk profiles, which has allowed us to improve the credit quality of our vehicle loan portfolio.

In 2019, our new individual and corporate vehicle financing operations reached R$ 20.5 billion, a 32% growth compared to 2018. The average vehicle loan term was 43 months, with 37% of the transactions carried out with terms up to 36 months.

Insurance

Our insurance business provides a wide range of life and personal accident products, automobile and property insurance, credit insurance and travel insurance. Our insurance core activities, which include our 30% stake in Porto Seguro S.A, consist of mass-market insurance products related to life, property and credit. These products are offered in synergy with retail channels - our branch network, partnerships with retailers, credit card clients, real estate and vehicle financing, personal loans - and the wholesale channel. These products have characteristics such as a low combined ratio, low volatility in results and less use of capital, making them strategic and increasingly relevant in the diversification of the Itaú Unibanco Group's revenues. Other insurance activities encompass extended warranty, health insurance, our 11.2% stake in IRB - Brasil Resseguros S.A. and other operations.

Our insurance products have been receiving updates on coverage and assistance, bringing more value to these customers. In order to expand our insurance products portfolio, we are concentrating on our own existing distribution channels as well as expanding our insurance brokerage activities and providing third-party insurance policies from partner insurers to our clients through an open platform.

Premium Bonds ("títulos de capitalização", or capitalization plans)

Premium bonds are fixed deposit products pursuant to which a client makes a one-time deposit or monthly deposits of a fixed sum that will be returned at the end of a designated term. Ownership of premium bonds automatically qualifies a customer to participate in periodic raffles, each time with the opportunity to win a significant cash prize.

We currently market our premium bonds products portfolio through our branch network, electronic channels and ATMs, and we are currently developing new technologies for channel diversification. The net collection, taking into account the deduction of redemptions, from capitalization plans decreased 20.6% in 2019 when compared to 2018.

Consortia

A consortium is a pool of people and/or legal persons in a group with the purpose of allowing their members, on an equal basis, to acquire assets, such as vehicles, properties, or services, through self- financing. The payments made by the group participants are applied to a common fund, used by one or more members of the consortium at a time, to acquire the assets elected by the members when the product was contracted. The participants receive the assets during the validity of the contract through the following methods: (i) random drawing; (ii) bid offer with own resources; (iii) part of the letter of credit; and (iv) FGTS tax (only for properties consortium), with the exception of the random drawing, the other options may be combined.

As consortia are regarded as a provision of services under Brazilian law, the management of consortia does not give rise to default risk or regulatory capital requirements for us.

Consortia do not charge interest rates and our revenues come mainly from the administration fee charged to clients.

96

Given these characteristics, this business is strategic to us, contributing to revenue diversification and to a more complete product portfolio offering to our clients. As of December 31, 2019, we achieved the following results:

  • 361 thousand in active contracts, a decrease of 6.4% compared to December 31, 2018;
  • R$12.6 billion in balance of installments receivables, an increase of 6.9% compared to December 31, 2018; and
  • R$700 million in administration fees from January 31, 2019 to December 31, 2019, an increase of 2.8% compared to the same period of 2018.

Microcredit

Our microcredit unit offers to low-income entrepreneurs who do not have the necessary attributes to participate in the traditional financial system the chance to expand and develop their businesses. As a tool to stimulate entrepreneurship, Itau Microcrédito has specific rules to credit application. Some of them are: includes working capital loans, or loans for upgrades and fixed assets provided to formal and informal business people engaged in small business activities. Loans are granted by specifically trained microcredit loan officers who discuss the client's financial situation and understand their business, needs, as well as providing information regarding the responsible use of money.

As a result of this initiative, micro-entrepreneurs develop a relationship with the formal financial system, generating more opportunities to develop their business, contributing to the growth of their communities.

Our investment in microcredit consolidates our strategy to act as an agent of transformation in society. Microcredit is also important as it reinforces our vision of sustainability and increases our ability to spread our knowledge in financial education. The end goal is to create a virtuous cycle in which our bank encourages the social and economic development of Brazil's low-income population. In view of this, we have expanded our microcredit operations to six Brazilian states, operating in the cities and metropolitan areas of São Paulo, in the state of São Paulo, Rio de Janeiro, in the state of Rio de Janeiro, Montes Claros, in the state of Minas Gerais, Campina Grande, in the state of Paraíba, Fortaleza in the state of Ceará and Teresina, in the state of Piaui. This expansion has brought positive results, increasing the number of customers and communities impacted. In 2020 we expect to expand our business channels, increasing product capillarity and impacting more customers.

Public Sector

Our public sector business operates in all divisions of the public sector, including the federal, state and municipal governments (in the executive, legislative and judicial branches).

To service public sector clients, we use platforms that are separate from our retail banking branches, with teams of specially trained managers who offer customized solutions in tax collection, foreign exchange services, administration of public assets, payments to suppliers, payroll for civil and military servants and retirement. Based on these platforms, we have a significant amount of business with public sector clients, particularly in those Brazilian states where we acquired previously state-owned financial institutions. As of December 31, 2019, we had 6,033 public sector clients and 13 offices where such services were offered in Brazil.

Wholesale Banking

Wholesale Banking is the segment responsible for banking operations of middle-market, corporate, large and ultra-companies (those with annual revenues from R$30 million) and investment banking services. Our Wholesale Banking segment offers a wide range of products and services to the largest economic groups of Brazil.

97

Our activities in this business range from typical operations of a commercial bank to capital markets operations and advisory services for mergers and acquisitions. These activities are fully integrated, which enables us to achieve a performance tailored to our clients' needs.

One of the most important features of our strategy for our Wholesale Banking segment is the set of initiatives linked to improving efficiency in our operations. These ongoing actions, which are expected to continue to grow in the coming years, are designed to increase revenues, improve processes and reduce costs.

Investment Banking

Our investment banking business carried out through Itaú BBA, assists companies raising capital through fixed income and equity instruments in public and private capital markets, and provides advisory services in mergers and acquisitions. We advise companies, private equity funds and investors in the structuring of variable income products and in mergers and acquisitions. We believe we offer a wide portfolio of investment banking services ranging from research to Brazilian and other Latin American companies.

Our fixed income department acts as bookrunner or manager in the issuance of debentures, promissory notes and securitization transactions at the investment banking segment.

Asset Management

With more than 60 years of experience in investment management, Itaú Asset Management has R$

770.8 billion in assets under management (including Itaú Unibanco and Intrag) according to ANBIMA (Ranking de Gestão - December 2019) and recorded 13.3% growth during 2019. Itaú Asset Management ranked as the largest non-government owned asset manager in Brazil, with a 14.2% market share as of December 31, 2019, according to ANBIMA.

In 2019 Itaú Asset Management was awarded for the 11th time the title of best asset manager in Brazil by Revista Exame.

Kinea Investimentos LTDA., an alternative investments management company controlled by us, held R$68.5 billion in managed assets as of December 31, 2019, compared to R$50.8 billion as of December 31, 2018, according to ANBIMA.

Investment Services

Itaú Investment Services business units provide

  1. local custody and fiduciary services,
  2. international custody services, and
  3. corporate solutions that act as transfer agent and stockholder servicer for Brazilian companies issuing equity, corporate bonds, promissory and bank credit notes. We also work as guarantor in transactions for project finance, escrow accounts and loan and financing contracts.

We provide the technological tools to perform daily activities of each service and rely on compliance and contingency procedures. Thus, our clients can direct the focus on their business management.

Pension funds, insurance companies, asset managers, international institutional investors and equity and debt issuers are our primary clients in these businesses, representing approximately 2,237 clients, that reached R$3.7 trillion of assets under service as of December 31, 2019, which includes investment funds, underwriting, pension funds, trustee and brokerage services.

In 2019, Global Finance named Itaú Investment Services as the best sub-custodian in Brazil and Uruguay. We are currently updating our technological platform regarding securities services.

98

Itaú Private Bank

With a full global wealth management platform, we are one of the private bank market leaders in Brazil and one of the main private bank players in Latin America. Our multidisciplinary team, which is supported by a team of investment advisers and product experts, provides comprehensive financial services to clients, understanding and addressing their needs from our eight offices in Brazil and in our offices located in Zurich, Miami, New York, Santiago and Nassau.

Our clients have access to a complete portfolio of products and services, ranging from investment management to wealth planning, as well as credit and banking solutions. In addition to our in-house customized products and services, we offer our clients access to an open architecture of alternative products from third- party providers.

Aligned with our vision to be the leading bank in sustainable performance and customer satisfaction, we decided to focus our strategic priorities on the following Itaú Private Bank initiatives:

  • Being the leading private bank in terms of client satisfaction;
  • Adding value to clients and stockholders with a complete offering of long-term proactive advisory services;
  • Continuing to invest in our international platforms to enhance Brazilian clients' experience;
  • Improving our operational efficiency through continuous investments in technology; and
  • Maintaining a focus on risk management and regulatory considerations.

Itaú Corretora (Brokerage)

Itaú Corretora has been providing brokerage services since 1965. We provide retail brokerage services in Brazil to over 207 thousand clients with positions in the equity and fixed income markets, accounting for approximately R$59.4 billion in trading volume in 2019. The brokerage services are also provided to international clients through our broker-dealer in New York.

International Operations - Global footprint

We want to achieve, in the countries where we operate, the same management quality and level of results we have in Brazil. Through our internationalization strategy, we seek to understand different markets, business, products and services, identifying opportunities to integrate our units and to expand our operations to new countries.

The table below shows some of our operations in Latin America, excluding Brazil:

Countries

Branches & CSBs

ATMs

Employees

Argentina

87

176

1,613

Chile

194

424

5,755

Colombia(1)

128

147

3,326

Paraguay

44

298

869

Uruguay(2)

26

62

1,101

  1. Includes employees in Panamá.
  2. Does not include the 35 OCA points of service.

Overview

Latin America is a priority in our international expansion due to the geographic and cultural proximity to Brazil. Our goal is to be recognized as the "Latin American Bank", becoming a reference in the region for all financial services provided to individuals and companies.

Over the past years, we consolidated our presence in Argentina, Chile, Paraguay and Uruguay. In these countries, we operate in the retail, companies, corporate and treasury segments, with commercial

99

banking as our main focus. With the recent merger between Banco Itaú Chile and CorpBanca, which assured our presence in Colombia and Panama, we expanded our operations in the region even further. In Mexico, we are present through an office dedicated to equity research activities.

As of December 31, 2019, we had a network of 479 branches, including 6 digital branches, and client service branches in Latin America (excluding Brazil). In Paraguay, we had 57 non-bank correspondent locations, which are points of service with a simplified structure, strategically located in supermarkets to provide services to our clients in that country. As of December 31, 2019, we also had 35 points of service through OCA S.A., our credit card operator in Uruguay. Please see "Distribution Channels", for further details about our distribution network in Latin America.

Banco Itaú Argentina

We have operated in Argentina since 1979, where we began with a focus on large companies with business ties to Brazil. In 1995, we began our retail operations in Buenos Aires. In 1998, we increased our presence through the acquisition of Buen Ayre Bank, subsequently renamed Banco Itaú Argentina.

Through Banco Itaú Argentina we offer products and services in corporate banking, small and middle- market companies and retail banking. Our corporate banking business focuses on large and institutional clients, providing lending, structured finance, investment and cash management services. Our small and middle-market operations provide credit for working capital and investments in production capacity increases. Our retail banking business focuses on middle and upper-income clients, and our services offerings include current and savings accounts, personal loans and credit cards. In 2019 Banco Itaú Argentina opened two digital branches enhancing its presence in Argentina's financial market.

Itaú Corpbanca

In April 2016, we closed the merger of Banco Itaú Chile with and into Corpbanca and, as a result, acquired control of the resulting entity - Itaú Corpbanca. On that same date, we entered into the Shareholders' Agreement of Itaú Corpbanca, or Itaú Corpbanca's Shareholders' Agreement, which entitles us to appoint, together with Corp Group, the former controlling shareholder of Corpbanca, the majority of the members of Itaú Corpbanca's Board of Directors. Such members are appointed according to the ownership interest of each party, and we have the right to elect the majority of the members elected by this block. In addition, on that same date, we consolidated Itaú Corpbanca in our financial statements, adding approximately R$114 billion of assets to our balance sheet.

These steps were implemented as a result of the obligations we undertook in the transaction agreement, which we entered into together with Corpbanca and its controlling shareholders in January 2014 and amended in June 2015.

In January 2017, we executed a new amendment to the transaction agreement, which provided for (i) the postponement of the date of acquisition of the shares held by Corp Group in Banco Corpbanca Colombia S.A., or Corpbanca Colombia, from January 29, 2017 to January 28, 2022, subject to receipt of applicable regulatory approvals; (ii) the modification of the previously defined structure for the combination of the operations of Itaú Unibanco and Itaú Corpbanca in Colombia to a sale and purchase of assets and liabilities, which was concluded in April 2017; and (iii) the replacement of the obligation to consummate an initial public offering of Corpbanca Colombia for the obligation to register Corpbanca Colombia as a public company and list its shares on the Colombian stock exchange.

Pursuant to the exercise of put options by Corp Group, as set forth in Itaú Corpbanca's Shareholders' Agreement, we acquired (i) in October 2016, 10.9 billion shares of Itaú Corpbanca for approximately R$288.1 million, increasing our equity stake from 33.6% to 35.7%; (ii) in September 2017, 1.8 billion shares of Itaú Corpbanca for approximately R$55.6 million, increasing our equity stake from 35.7% to 36.1%; and (iii) in October 2018, 10.6 billion shares of Itaú Corpbanca for approximately R$363 million, increasing our equity stake from 36.1% to 38.1%. In all cases the governance of Itaú Corpbanca remained the same.

Helm Group

In December 2016, Helm LLC ("Helm") initiated an arbitration proceeding before the ICC International Court of Arbitration (the "ICC") against Corp Group Holding Inversiones Ltda. ("Corp Group") and Itaú

100

Attachments

  • Original document
  • Permalink

Disclaimer

Itaú Unibanco Holding SA published this content on 19 August 2020 and is solely responsible for the information contained therein. Distributed by Public, unedited and unaltered, on 19 August 2020 15:31:13 UTC