Exhibit 99.1 Risk and Capital Management Pillar 3 4Q19 Exhibit 99.1 Risk and Capital Management Pillar 3 4Q19

Risk and Capital Management – Pillar 3 OBJECTIVE 1 KEY INDICATORS 1 1 RISK MANAGEMENT 2 1.1 Risk Appetite 2 1.2 Risk Culture 3 1.3 Risk and Capital Governance 3 1.4 Risk- adjusted Compensation 4 2 CAPITAL 5 2.1 Capital Management 5 2.2 Capital Adequacy Assessment 5 2.3 Stress Testing 5 2.4 Recovery Plan 6 2.5 Capital Requirements and Capital Composition 6 2.6 Risk-Weighted Asset (RWA) 9 Risk-Weighted Assets for Credit Risk (RWA ) 10 CPAD Risk-Weighted Assets for Market Risk (RWA ) 10 MINT Risk-Weighted Assets for Operational Risk (RWA ) 11 OPAD 2.7 Additional Capital Buffers 11 2.8 Capital Adequacy 12 2.8.1 IRRBB – Interest Rate Risk in the Banking Book 13 2.9 Leverage Ratio 16 3 BALANCE SHEET AND INSTITUTIONS 17 3.1 Balance Sheet 17 3.2 Institutions that comprise the Financial Statements of Itaú Unibanco Holding 19 Institutions that comprise the financial statements an the Prudential Conglomerate 19 Institutions that comprise only the financial statements 20 Non consolidated institutions 21 Material entities 21 4 INVESTMENTS IN OTHER ENTITIES NOT CLASSIFIED IN THE TRADING BOOK 22 5 CREDIT RISK 23 5.1 Framework and Treatment 23 5.2 Credit Portfolio Analysis 24 Operations with Credit Granting Characteristics by Countries and by Brazil Geographic Regions 24 Operations with Credit Granting Characteristics by Economic Sector 25 Remaining maturity of loan transactions 26 Concentration on the Major Debtors 26 Overdue Amounts 26 Allowance for Loan Losses 26 Mitigating Instruments 27 Counterparty Credit Risk 28 Acquisitions, Sale or Transfer of Financial Assets 29 Operations of Securitization 30 Credit Derivatives 31 6 MARKET RISK 33 6.1 Framework and Treatment 33 6.2 Portfolio Analysis 34 Interest rate risk in the banking book 34 Evolution of the Trading Book 35 Evolution of the Derivatives Portfolio 35 VaR - Consolidated Itaú Unibanco 35 VaR and Stressed VaR Internal Model – Regulatory Portfolio 36 Stress Testing 36 Backtesting 36 Pricing of Financial Instruments 37 Itaú Unibanco Risk and Capital Management – Pillar 3 OBJECTIVE 1 KEY INDICATORS 1 1 RISK MANAGEMENT 2 1.1 Risk Appetite 2 1.2 Risk Culture 3 1.3 Risk and Capital Governance 3 1.4 Risk- adjusted Compensation 4 2 CAPITAL 5 2.1 Capital Management 5 2.2 Capital Adequacy Assessment 5 2.3 Stress Testing 5 2.4 Recovery Plan 6 2.5 Capital Requirements and Capital Composition 6 2.6 Risk-Weighted Asset (RWA) 9 Risk-Weighted Assets for Credit Risk (RWA ) 10 CPAD Risk-Weighted Assets for Market Risk (RWA ) 10 MINT Risk-Weighted Assets for Operational Risk (RWA ) 11 OPAD 2.7 Additional Capital Buffers 11 2.8 Capital Adequacy 12 2.8.1 IRRBB – Interest Rate Risk in the Banking Book 13 2.9 Leverage Ratio 16 3 BALANCE SHEET AND INSTITUTIONS 17 3.1 Balance Sheet 17 3.2 Institutions that comprise the Financial Statements of Itaú Unibanco Holding 19 Institutions that comprise the financial statements an the Prudential Conglomerate 19 Institutions that comprise only the financial statements 20 Non consolidated institutions 21 Material entities 21 4 INVESTMENTS IN OTHER ENTITIES NOT CLASSIFIED IN THE TRADING BOOK 22 5 CREDIT RISK 23 5.1 Framework and Treatment 23 5.2 Credit Portfolio Analysis 24 Operations with Credit Granting Characteristics by Countries and by Brazil Geographic Regions 24 Operations with Credit Granting Characteristics by Economic Sector 25 Remaining maturity of loan transactions 26 Concentration on the Major Debtors 26 Overdue Amounts 26 Allowance for Loan Losses 26 Mitigating Instruments 27 Counterparty Credit Risk 28 Acquisitions, Sale or Transfer of Financial Assets 29 Operations of Securitization 30 Credit Derivatives 31 6 MARKET RISK 33 6.1 Framework and Treatment 33 6.2 Portfolio Analysis 34 Interest rate risk in the banking book 34 Evolution of the Trading Book 35 Evolution of the Derivatives Portfolio 35 VaR - Consolidated Itaú Unibanco 35 VaR and Stressed VaR Internal Model – Regulatory Portfolio 36 Stress Testing 36 Backtesting 36 Pricing of Financial Instruments 37 Itaú Unibanco

Risk and Capital Management – Pillar 3 7 OPERATIONAL RISK 38 7.1 Framework and Treatment 38 7.2 Crisis Management and Business Continuity 38 7.3 Independent Validation of Risk Models 39 8 LIQUIDITY RISK 40 8.1 Framework and Treatment 40 8.2 Liquidity Coverage Ratio (LCR) 40 8.3 Net Stable Funding Ratio (NSFR) 41 9 OTHER RISKS 44 Insurance products, pension plans and premium bonds risks 44 Social and Environmental Risk 44 Regulatory and Compliance Risk 44 Model Risk 45 Reputational Risk 45 Country Risk 46 Business and Strategy Risk 46 10 APPENDIX I 47 11 GLOSSARIES 50 11.1 Glossary of Acronyms 50 11.2 Glossary of Regulations 53 Itaú Unibanco Risk and Capital Management – Pillar 3 7 OPERATIONAL RISK 38 7.1 Framework and Treatment 38 7.2 Crisis Management and Business Continuity 38 7.3 Independent Validation of Risk Models 39 8 LIQUIDITY RISK 40 8.1 Framework and Treatment 40 8.2 Liquidity Coverage Ratio (LCR) 40 8.3 Net Stable Funding Ratio (NSFR) 41 9 OTHER RISKS 44 Insurance products, pension plans and premium bonds risks 44 Social and Environmental Risk 44 Regulatory and Compliance Risk 44 Model Risk 45 Reputational Risk 45 Country Risk 46 Business and Strategy Risk 46 10 APPENDIX I 47 11 GLOSSARIES 50 11.1 Glossary of Acronyms 50 11.2 Glossary of Regulations 53 Itaú Unibanco

Risk and Capital Management – Pillar 3 Objective This document presents Itaú Unibanco Holding S.A. (Itaú Unibanco) information required by the Central Bank of Brazil (BACEN) through Circular 3,678 and subsequent amendments, which address the disclosure of information on risks management, calculation of risk-weighted assets (RWA), and calculation of the Total Capital Patiôio de Refeêia - PR, i aodae ith Itaú Uiao’s istitutioal stadads. For further information than the contained on this document, please visit http://www.itau.com.br/investor-relations. The information available in the website http://www.itau.com.br/investor-relations and referred to in this document is supplementary to this publication, and there were no important amendments between the dates of its disclosure and the base date of this report. Key indicators Itaú Uiao’s isk ad apital aagee t fouses o aitaiig the istitu tio i lie with the risk strategy approved by the Board of Directors. The key indicators based on the Prudential Consolidation, on December 31, 2019, are summarized below. Common Equity Tier I Ratio Tier I Ratio Total Capital Ratio 13.2% 14.4% 15.8% September 30, 2019: 12.8% September 30, 2019: 14.1% September 30, 2019: 15.4% Common Equity Tier I Tier I Total Capital R$ 117,328 million R$ 128,696 million R$ 140,596 million September 30, 2019: R$ 113,235 million September 30, 2019: R$ 124,856 million September 30, 2019: R$ 136,755 million RWA Credit Risk Exposure R$ 891,300 million R$ 784,730 million September 30, 2019: R$ 887,513 million September 30, 2019: R$ 759,358 million RWA Composition Composition of Credit Risk Exposure¹ 9.2% 9.2% 09/30/2019 12/31/2019 2.8% 6.7% 5.2% 7.0% 26.8% 28.2% 22.7% 22.6% 88.0% 85.6% . 09/30/2019 12/31/2019 Credit Risk Market Risk Operational Risk 42.2% 43.8% . Securities Retail Non Retail Other Exposure ¹ Classification according to Circular BACEN 3,644 and subsequent amendments. 1 Itaú Unibanco Risk and Capital Management – Pillar 3 Objective This document presents Itaú Unibanco Holding S.A. (Itaú Unibanco) information required by the Central Bank of Brazil (BACEN) through Circular 3,678 and subsequent amendments, which address the disclosure of information on risks management, calculation of risk-weighted assets (RWA), and calculation of the Total Capital Patiôio de Refeêia - PR, i aodae ith Itaú Uiao’s istitutioal stadads. For further information than the contained on this document, please visit http://www.itau.com.br/investor-relations. The information available in the website http://www.itau.com.br/investor-relations and referred to in this document is supplementary to this publication, and there were no important amendments between the dates of its disclosure and the base date of this report. Key indicators Itaú Uiao’s isk ad apital aagee t fouses o aitaiig the istitu tio i lie with the risk strategy approved by the Board of Directors. The key indicators based on the Prudential Consolidation, on December 31, 2019, are summarized below. Common Equity Tier I Ratio Tier I Ratio Total Capital Ratio 13.2% 14.4% 15.8% September 30, 2019: 12.8% September 30, 2019: 14.1% September 30, 2019: 15.4% Common Equity Tier I Tier I Total Capital R$ 117,328 million R$ 128,696 million R$ 140,596 million September 30, 2019: R$ 113,235 million September 30, 2019: R$ 124,856 million September 30, 2019: R$ 136,755 million RWA Credit Risk Exposure R$ 891,300 million R$ 784,730 million September 30, 2019: R$ 887,513 million September 30, 2019: R$ 759,358 million RWA Composition Composition of Credit Risk Exposure¹ 9.2% 9.2% 09/30/2019 12/31/2019 2.8% 6.7% 5.2% 7.0% 26.8% 28.2% 22.7% 22.6% 88.0% 85.6% . 09/30/2019 12/31/2019 Credit Risk Market Risk Operational Risk 42.2% 43.8% . Securities Retail Non Retail Other Exposure ¹ Classification according to Circular BACEN 3,644 and subsequent amendments. 1 Itaú Unibanco

Risk and Capital Management – Pillar 3 1 Risk Management To undertake and manage risks is one of the activities of Itaú Unibanco. For this reason, the institution must have clearly established risk management objectives. In this context, the risk appetite defines the nature and the level of risks acceptable for the institution, while the risk culture guides the attitudes required to manage them. Itaú Unibanco seeks to maintain robust and company-wide risk management processes to serve as a basis for its strategic decisions intended to ensure business sustainability. These processes are in line with the guidelines of the Board of Directors and Executives who, through corporate bodies, defie the istitutio’s gloal ojeties, h ih ae the taslat ed ito tagets ad thesholds fo the usiess uits that a age isks. Cotol ad apital a ageet uits, i tu, suppot Itaú U iao’s a ageet though the processes of analysis and monitoring capital and risk assessment processes. The principles that provide risk management and risk appetite fundamentals, as well as guidelines regarding the actions take Itaú Uiao’s eploees i thei dail outies ae as follos : • Sustainability and customer satisfaction: the vision of Itaú Unibanco is to be a leading bank in sustainable performance and customer satisfaction. For this reason, the institution is concerned about creating shared values for employees, customers, shareholders and society to ensure the longevity of the business. Itaú Unibanco is concerned about doing business that is good for customers and for the institution; • Risk Culture: the istitutio’s isk ultue goes eod polii es, poedues ad poesses, stegthe ning the ep loees’ idii dual ad olletie esposiilit to do the ight thig, at the ight tie ad i the ight a , with respect for ethical business. The Risk Culture is described in item . Risk Cultue ; • Price for Risk: Itaú Unibanco operates and assumes risks in business that it knows and understands, avoids unknown risks or risks that provide no competitive advantages, and carefully assesses risk-return ratios; • Diversification: the institution has low appetite for volatility in its results. Accordingly, it operates with a diversified base of customers, products and business, seeking risk diversification and giving priority to low-risk transactions; • Operational excellence: Itaú Unibanco intends to provide agility, as well as a robust and stable infrastructure, so as to offer high quality services; • Ethics and respect for regulations: at Itaú Unibanco, ethics is non-negotiable. For this reason, the institution promotes an institutional environment of integrity, educating its employees to cultivate ethical relationships and usiesses, as ell as espetig the os , ad theefoe aig fo the istitutio’s eputatio. On August 21, 2017, the Resolution CMN 4,557 came into force, which established the structure of risk and capital management. The resolution highlights are the implementation of a continuous and integrated risk management framework; the requirements for the definition of the Risk Appetite Statement (RAS) and the stress test program; the establishment of a Risk Committee; the indication, before BACEN, of the Chief Risk Officer (CRO); ad the CRO’s oles, responsibilities and independence requirements. Itaú Unibanco complies with the best risk and capital management practices set forth in CMN Resolution 4,557; accordingly, there is no significant impact arising from its adoption. 1.1 Risk Appetite In 2016, Itaú Unibanco reviewed its risk appetite policy, which was established and approved by the Board of Directors ad guides the istitutio’s usiess stateg . The ak’s isk appetite is gouded o the folloig delaatio o f the Board of Directors: We are a uiersal ak, operatig predoiatly i Lati Aer ia. Supported y our risk ulture, e operate ased o rigorous ethical and regulatory compliance standards, seeking high and growing results, with low volatility, by means of the long-lasting relationship with clients, correctly pricing risks, well-distributed fund-raisig ad proper use of apital. Based on this declaration, the bank established five dimensions, each of which comprising a set of metrics associated with the key risks involved, combining complementary measurements and seeking a comprehensive view of its exposure: • Capitalization: establishes that Itaú Unibanco should have sufficient capital to protect against a serious recession or stress events without the need to adjust its capital structure under adverse circumstances. It is monitored by folloig up o the ak’ s capital ratios in usual or stress situations, and debt issue ratings. 2 Itaú Unibanco Risk and Capital Management – Pillar 3 1 Risk Management To undertake and manage risks is one of the activities of Itaú Unibanco. For this reason, the institution must have clearly established risk management objectives. In this context, the risk appetite defines the nature and the level of risks acceptable for the institution, while the risk culture guides the attitudes required to manage them. Itaú Unibanco seeks to maintain robust and company-wide risk management processes to serve as a basis for its strategic decisions intended to ensure business sustainability. These processes are in line with the guidelines of the Board of Directors and Executives who, through corporate bodies, defie the istitutio’s gloal ojeties, h ih ae the taslat ed ito tagets ad thesholds fo the usiess uits that a age isks. Cotol ad apital a ageet uits, i tu, suppot Itaú U iao’s a ageet though the processes of analysis and monitoring capital and risk assessment processes. The principles that provide risk management and risk appetite fundamentals, as well as guidelines regarding the actions take Itaú Uiao’s eploees i thei dail outies ae as follos : • Sustainability and customer satisfaction: the vision of Itaú Unibanco is to be a leading bank in sustainable performance and customer satisfaction. For this reason, the institution is concerned about creating shared values for employees, customers, shareholders and society to ensure the longevity of the business. Itaú Unibanco is concerned about doing business that is good for customers and for the institution; • Risk Culture: the istitutio’s isk ultue goes eod polii es, poedues ad poesses, stegthe ning the ep loees’ idii dual ad olletie esposiilit to do the ight thig, at the ight tie ad i the ight a , with respect for ethical business. The Risk Culture is described in item . Risk Cultue ; • Price for Risk: Itaú Unibanco operates and assumes risks in business that it knows and understands, avoids unknown risks or risks that provide no competitive advantages, and carefully assesses risk-return ratios; • Diversification: the institution has low appetite for volatility in its results. Accordingly, it operates with a diversified base of customers, products and business, seeking risk diversification and giving priority to low-risk transactions; • Operational excellence: Itaú Unibanco intends to provide agility, as well as a robust and stable infrastructure, so as to offer high quality services; • Ethics and respect for regulations: at Itaú Unibanco, ethics is non-negotiable. For this reason, the institution promotes an institutional environment of integrity, educating its employees to cultivate ethical relationships and usiesses, as ell as espetig the os , ad theefoe aig fo the istitutio’s eputatio. On August 21, 2017, the Resolution CMN 4,557 came into force, which established the structure of risk and capital management. The resolution highlights are the implementation of a continuous and integrated risk management framework; the requirements for the definition of the Risk Appetite Statement (RAS) and the stress test program; the establishment of a Risk Committee; the indication, before BACEN, of the Chief Risk Officer (CRO); ad the CRO’s oles, responsibilities and independence requirements. Itaú Unibanco complies with the best risk and capital management practices set forth in CMN Resolution 4,557; accordingly, there is no significant impact arising from its adoption. 1.1 Risk Appetite In 2016, Itaú Unibanco reviewed its risk appetite policy, which was established and approved by the Board of Directors ad guides the istitutio’s usiess stateg . The ak’s isk appetite is gouded o the folloig delaatio o f the Board of Directors: We are a uiersal ak, operatig predoiatly i Lati Aer ia. Supported y our risk ulture, e operate ased o rigorous ethical and regulatory compliance standards, seeking high and growing results, with low volatility, by means of the long-lasting relationship with clients, correctly pricing risks, well-distributed fund-raisig ad proper use of apital. Based on this declaration, the bank established five dimensions, each of which comprising a set of metrics associated with the key risks involved, combining complementary measurements and seeking a comprehensive view of its exposure: • Capitalization: establishes that Itaú Unibanco should have sufficient capital to protect against a serious recession or stress events without the need to adjust its capital structure under adverse circumstances. It is monitored by folloig up o the ak’ s capital ratios in usual or stress situations, and debt issue ratings. 2 Itaú Unibanco

Risk and Capital Management – Pillar 3 • Liuidit: estalishes that the istitutio’s liuidit should e ale to suppot log stess peiods. It is monitored by following up on liquidity ratios. • Composition of results: establishes that business will mainly focus on Latin America, where Itaú Unibanco will have a diversified range of customers and products, with low appetite for results volatility and high risk. This dimension includes business and profitability, as well as market and credit risks aspects. The metrics monitored by the bank seek to ensure, by means of exposure concentration limits such as, for example, industry sectors, quality of counterparties, countries and geographic regions and risk factors, a suitable cop ositio of the ak’s potfolios, aiming at low volatility of results and business sustainability. • Opeatioal isk: fouses o otollig opeatioal isk ee ts that a adesel ipat the ak’s usiess strategy and operations. This control is carried out by monitoring key operational risk events and incurred losses. • Reputation: deals with risks that a ip at ad al ue ad the istitutio’s eputatio ef oe its ustoes, employees, regulators, investors and the general public. In this dimension, risks are monitored by following up on ustoes’ satisfatio o dissatisfatio, edia eposue ad oseat io of the istitutio’s odut. The Board of Directors is responsible for approving risk appetite guidelines and limits, performing its activities with the support of the Risk and Capital Management Committee (CGRC) and the CRO. Metrics are regularly monitored and must comply with the limits defined. Monitoring is reported to the risk commissions and to the Board of Directors, guiding the use of preventive measures to ensure that exposures are within the limits provided and in line ith the ak’s stateg. 1.2 Risk Culture Aiming at strengthening its values and aligning the behavior of its employees with risk management guidelines, the institution adopts several initiatives to disseminate and strengthen its Risk Culture, which is based on four principles: osious isk takig, disussio aout ad atios o the istitutio ’s isks, ad eah ad ee oe’s esposiilit fo risk management. I additio to the ak’s polii es, poedues ad poesses of risk management, the Risk Culture strengthens the ep loees’ idii dual ad olletie esposiilit in understanding, identifying, measuring, managing and mitigating the risks connected to their activities, respecting the business management ethically. The institution promotes its Risk Culture by emphasizing a behavior that helps people of all company levels to undertake and manage risks in a conscious way. By disseminating these principles, the institution fosters the understanding and an open discussion about the risks, so that they are kept within the risk appetite levels established, so that each employee individually, regardless of their position, area or duties, may also assume responsibility for managing the risks of the business. Itaú Unibanco also makes some channels available for communication of operating failures, internal or external fraud, conflicts at the workplace, or cases that may result in inconveniences and/or losses for the institution or its customers. All employees or third parties are responsible for informing any problems immediately, as soon as they become aware of a situation. 1.3 Risk and Capital Governance The Board of Directors is the main body responsible for establishing the guidelines, policies and authority levels regarding risk and capital management. In turn, the CGRC provides support to the Board of Directors in the performance of their duties relating to risk and capital management. At the executive level, corporate bodies headed Itaú Uiao’s Chief Executive Officer (CEO) are established to manage risks and capital. Their decisions are overseen by the CGRC. Additionally, the institution has corporate bodies that perform delegated duties in the risk and capital management, and that are headed by the Vice-President of the Risk and Finance Area (ARF). Furthermore, to support this structure, ARF is structured with specialized departments. The objective is to provide independent and centralized management of the institution’s isks ad apital, and ensure the accordance with the established rules and procedures. A detailed description of the structure can be found on the Integrated Annual Report, section Risk Management . The Integrated Annual Report can be found in the website www.itau.com.br/investor-relations, section Reports. 3 Itaú Unibanco Risk and Capital Management – Pillar 3 • Liuidit: estalishes that the istitutio’s liuidit should e ale to suppot log stess peiods. It is monitored by following up on liquidity ratios. • Composition of results: establishes that business will mainly focus on Latin America, where Itaú Unibanco will have a diversified range of customers and products, with low appetite for results volatility and high risk. This dimension includes business and profitability, as well as market and credit risks aspects. The metrics monitored by the bank seek to ensure, by means of exposure concentration limits such as, for example, industry sectors, quality of counterparties, countries and geographic regions and risk factors, a suitable cop ositio of the ak’s potfolios, aiming at low volatility of results and business sustainability. • Opeatioal isk: fouses o otollig opeatioal isk ee ts that a adesel ipat the ak’s usiess strategy and operations. This control is carried out by monitoring key operational risk events and incurred losses. • Reputation: deals with risks that a ip at ad al ue ad the istitutio’s eputatio ef oe its ustoes, employees, regulators, investors and the general public. In this dimension, risks are monitored by following up on ustoes’ satisfatio o dissatisfatio, edia eposue ad oseat io of the istitutio’s odut. The Board of Directors is responsible for approving risk appetite guidelines and limits, performing its activities with the support of the Risk and Capital Management Committee (CGRC) and the CRO. Metrics are regularly monitored and must comply with the limits defined. Monitoring is reported to the risk commissions and to the Board of Directors, guiding the use of preventive measures to ensure that exposures are within the limits provided and in line ith the ak’s stateg. 1.2 Risk Culture Aiming at strengthening its values and aligning the behavior of its employees with risk management guidelines, the institution adopts several initiatives to disseminate and strengthen its Risk Culture, which is based on four principles: osious isk takig, disussio aout ad atios o the istitutio ’s isks, ad eah ad ee oe’s esposiilit fo risk management. I additio to the ak’s polii es, poedues ad poesses of risk management, the Risk Culture strengthens the ep loees’ idii dual ad olletie esposiilit in understanding, identifying, measuring, managing and mitigating the risks connected to their activities, respecting the business management ethically. The institution promotes its Risk Culture by emphasizing a behavior that helps people of all company levels to undertake and manage risks in a conscious way. By disseminating these principles, the institution fosters the understanding and an open discussion about the risks, so that they are kept within the risk appetite levels established, so that each employee individually, regardless of their position, area or duties, may also assume responsibility for managing the risks of the business. Itaú Unibanco also makes some channels available for communication of operating failures, internal or external fraud, conflicts at the workplace, or cases that may result in inconveniences and/or losses for the institution or its customers. All employees or third parties are responsible for informing any problems immediately, as soon as they become aware of a situation. 1.3 Risk and Capital Governance The Board of Directors is the main body responsible for establishing the guidelines, policies and authority levels regarding risk and capital management. In turn, the CGRC provides support to the Board of Directors in the performance of their duties relating to risk and capital management. At the executive level, corporate bodies headed Itaú Uiao’s Chief Executive Officer (CEO) are established to manage risks and capital. Their decisions are overseen by the CGRC. Additionally, the institution has corporate bodies that perform delegated duties in the risk and capital management, and that are headed by the Vice-President of the Risk and Finance Area (ARF). Furthermore, to support this structure, ARF is structured with specialized departments. The objective is to provide independent and centralized management of the institution’s isks ad apital, and ensure the accordance with the established rules and procedures. A detailed description of the structure can be found on the Integrated Annual Report, section Risk Management . The Integrated Annual Report can be found in the website www.itau.com.br/investor-relations, section Reports. 3 Itaú Unibanco

Risk and Capital Management – Pillar 3 Itaú Uiao’s isk a agee t ogaizatioal stutue oplies i th Bazilia ad iteatioal egulatios i plae and is aliged ith the a ket’s est paties. Resposiilities fo isk a agee t at Itaú Uiao ae stutued according to the concept of three lines of defense, namely: • in the first line of defense, the business and corporate support areas manage risks they give rise to, by identifying, assessing, controlling and reporting such risks; • i the seod lie of defese, a idepedet uit poi des etal otol, so as to esue that Itaú Uiao’s risk is managed according to the risk appetite and established policies and procedures. This centralized control poi des the Boad ad eeutie s ith a gloal oe i e of Itaú U iao’s eposue, to esue oet ad timely corporate decisions; • in the third line of defense, internal audit provides an idepedet assesset of the istitutio’s atiities, so that senior management can see that controls are adequate, risk management is effective and institutional standards and regulatory requirements are being complied with. Itaú Unibanco uses robust automated systems for full compliance with capital regulations, as well as for measuring risks in accordance with the regulatory determinations and models in place. It also monitors adherence to the qualitative and uatitatie egulatos’ iiu a pital ad risk management requirements. 1.4 Risk-adjusted Compensation The Compensation guidelines are aimed at attracting, retaining and compensating on merit its employees, encouraging prudent risk exposure levels in short, medium and long-term strategies. The Compensation Committee, in accordance with the CMN Resolution No. ,, ad the FEBRABAN’s oat ie SARB / ad with the reporting to the Board of Directors, is responsible for setting out the guidelines on models of compensation to employees and the policy on compensation of management members of the Itaú Unibanco companies. The practices of compensation take into account the strategy of the institution, the general and specific legislation that should be adopted for each business or region of operation, and the adequate risk management over time. Variable compensation considers the current and potential risks, giving incentive to the achievement of sustainable results and discouraging decisions that involve excessive risks and inadequacies. For more information about remuneration in Itaú Unibanco, see Note 13 – Shaeholdes’ Euit i the oplete Fiaial Stateets ad/o the setio People management i the Itegated Aual Repot , which is available on the website www.itau.com.br/investor-relations. 4 Itaú Unibanco Risk and Capital Management – Pillar 3 Itaú Uiao’s isk a agee t ogaizatioal stutue oplies i th Bazilia ad iteatioal egulatios i plae and is aliged ith the a ket’s est paties. Resposiilities fo isk a agee t at Itaú Uiao ae stutued according to the concept of three lines of defense, namely: • in the first line of defense, the business and corporate support areas manage risks they give rise to, by identifying, assessing, controlling and reporting such risks; • i the seod lie of defese, a idepedet uit poi des etal otol, so as to esue that Itaú Uiao’s risk is managed according to the risk appetite and established policies and procedures. This centralized control poi des the Boad ad eeutie s ith a gloal oe i e of Itaú U iao’s eposue, to esue oet ad timely corporate decisions; • in the third line of defense, internal audit provides an idepedet assesset of the istitutio’s atiities, so that senior management can see that controls are adequate, risk management is effective and institutional standards and regulatory requirements are being complied with. Itaú Unibanco uses robust automated systems for full compliance with capital regulations, as well as for measuring risks in accordance with the regulatory determinations and models in place. It also monitors adherence to the qualitative and uatitatie egulatos’ iiu a pital ad risk management requirements. 1.4 Risk-adjusted Compensation The Compensation guidelines are aimed at attracting, retaining and compensating on merit its employees, encouraging prudent risk exposure levels in short, medium and long-term strategies. The Compensation Committee, in accordance with the CMN Resolution No. ,, ad the FEBRABAN’s oat ie SARB / ad with the reporting to the Board of Directors, is responsible for setting out the guidelines on models of compensation to employees and the policy on compensation of management members of the Itaú Unibanco companies. The practices of compensation take into account the strategy of the institution, the general and specific legislation that should be adopted for each business or region of operation, and the adequate risk management over time. Variable compensation considers the current and potential risks, giving incentive to the achievement of sustainable results and discouraging decisions that involve excessive risks and inadequacies. For more information about remuneration in Itaú Unibanco, see Note 13 – Shaeholdes’ Euit i the oplete Fiaial Stateets ad/o the setio People management i the Itegated Aual Repot , which is available on the website www.itau.com.br/investor-relations. 4 Itaú Unibanco

Risk and Capital Management – Pillar 3 2 Capital 2.1 Capital Management The Boad of Dietos is the ai od i the Itaú Uiao’s apita l a agee t ad it is esposile fo appoi g the capital management institutional policy and guidelines regarding the istitutio’s capitalization level. The Board is also responsible for the full approval of ICAAP (Internal Capital Adequacy Assessment Process) report, a process which is intended to assess the adequa of Itaú Uiao’s apital. At the executive level, corporate bodies are responsible for approving risk assessment and capital calculation methodologies, as well as reviewing, monitoring and recommending capital related documents and topics to the Board of Directors. In order to provide the Board with the data required, management reports are prepared to inform the institutio’s apital adequacy, as well as capital level forecasts under usual and stress conditions. There is a structure in place for coordination and consolidation of information and related processes, which are all subject to verification by the independent validation, internal controls and audit areas. The guidelines of the institutional capital management policy can be accessed at www.itau.com.br/investor-relations, Itaú Unibanco, under Corporate Governance, Rules and Policies, Reports. 2.2 Capital Adequacy Assessment For its capital adequacy assessment process, the annual Itaú Uiao’s poedue is as follos: • Identification of the risks to which the institution is exposed and analysis of their materiality; • Assessment of the need for capital to cover the material risks; • Development of methods for quantifying additional capital; • Quantification of capital and internal capital adequacy assessment; • Capital and Contingency Plan; • Submission of report to BACEN. By adopting a prospective stance regarding capital management, Itaú Unibanco implemented its capital management structure and its ICAAP in order to comply with National Monetary Council (CMN) Resolution 4,557, BACEN Circular 3,846 and BACEN Circular Letter 3,841. The result of the last ICAAP – dated as of December 2018 – showed that, in addition to having enough capital to face all material risks, Itaú Unibanco has a significant buffer, thus ensuring the soundness of its equity position. 2.3 Stress Testing The stress test is a process of simulating extreme economic and market conditions on Itaú Uiao’s results and capital. The institution has been carrying out this test in order to assess its solvency in plausible scenarios of systemic crisis, as well as to identify areas that are more susceptible to the impact of stress that may be the subject of risk mitigation. For the purposes of the test, the economic research area estimates macroeconomic variables for each stress scenario. The scenarios are defined according to their importance for the institution results and the likelihood of their occurrence, and they are submitted annually to the Board of Directors for approval. Projections for the macroeconomic variables (such as GDP, the basic interest rate and inflation) and for variables in the credit market (such as raisings, lending, rates of default, margins and charges) used are based on exogenous shocks or through use of models validated by an independent area. Then, the stress scenarios adopted are used to influence the budgeted result and balance sheet, of which the risk- weighted assets and the capital and liquidity ratios are derived. The stress test is also an integral part of the ICAAP (Internal Capital Adequacy Process), the main purpose of which is to assess whether, even in severely adverse situations, the institution would have adequate levels of capital, without any impact on the development of its activities. This information enables potential risk factors in the business to be identified, and provides support for the strategic decisions of the Board of Directors, the budgeting and risk management process, as well as serving as an input for measuring risk appetite. 5 Itaú Unibanco Risk and Capital Management – Pillar 3 2 Capital 2.1 Capital Management The Boad of Dietos is the ai od i the Itaú Uiao’s apita l a agee t ad it is esposile fo appoi g the capital management institutional policy and guidelines regarding the istitutio’s capitalization level. The Board is also responsible for the full approval of ICAAP (Internal Capital Adequacy Assessment Process) report, a process which is intended to assess the adequa of Itaú Uiao’s apital. At the executive level, corporate bodies are responsible for approving risk assessment and capital calculation methodologies, as well as reviewing, monitoring and recommending capital related documents and topics to the Board of Directors. In order to provide the Board with the data required, management reports are prepared to inform the institutio’s apital adequacy, as well as capital level forecasts under usual and stress conditions. There is a structure in place for coordination and consolidation of information and related processes, which are all subject to verification by the independent validation, internal controls and audit areas. The guidelines of the institutional capital management policy can be accessed at www.itau.com.br/investor-relations, Itaú Unibanco, under Corporate Governance, Rules and Policies, Reports. 2.2 Capital Adequacy Assessment For its capital adequacy assessment process, the annual Itaú Uiao’s poedue is as follos: • Identification of the risks to which the institution is exposed and analysis of their materiality; • Assessment of the need for capital to cover the material risks; • Development of methods for quantifying additional capital; • Quantification of capital and internal capital adequacy assessment; • Capital and Contingency Plan; • Submission of report to BACEN. By adopting a prospective stance regarding capital management, Itaú Unibanco implemented its capital management structure and its ICAAP in order to comply with National Monetary Council (CMN) Resolution 4,557, BACEN Circular 3,846 and BACEN Circular Letter 3,841. The result of the last ICAAP – dated as of December 2018 – showed that, in addition to having enough capital to face all material risks, Itaú Unibanco has a significant buffer, thus ensuring the soundness of its equity position. 2.3 Stress Testing The stress test is a process of simulating extreme economic and market conditions on Itaú Uiao’s results and capital. The institution has been carrying out this test in order to assess its solvency in plausible scenarios of systemic crisis, as well as to identify areas that are more susceptible to the impact of stress that may be the subject of risk mitigation. For the purposes of the test, the economic research area estimates macroeconomic variables for each stress scenario. The scenarios are defined according to their importance for the institution results and the likelihood of their occurrence, and they are submitted annually to the Board of Directors for approval. Projections for the macroeconomic variables (such as GDP, the basic interest rate and inflation) and for variables in the credit market (such as raisings, lending, rates of default, margins and charges) used are based on exogenous shocks or through use of models validated by an independent area. Then, the stress scenarios adopted are used to influence the budgeted result and balance sheet, of which the risk- weighted assets and the capital and liquidity ratios are derived. The stress test is also an integral part of the ICAAP (Internal Capital Adequacy Process), the main purpose of which is to assess whether, even in severely adverse situations, the institution would have adequate levels of capital, without any impact on the development of its activities. This information enables potential risk factors in the business to be identified, and provides support for the strategic decisions of the Board of Directors, the budgeting and risk management process, as well as serving as an input for measuring risk appetite. 5 Itaú Unibanco

Risk and Capital Management – Pillar 3 2.4 Recovery Plan In response to the latest international crises, the Central Bank issued the Resolution No. 4,502, which requires the development of a Recovery Plan for the financial institutions that are classified in the Segment 1, with a total exposure of more than 10% of Gross Domestic Product (GDP). This plan aims to reestablish adequate levels of capital and liquidity, above the regulatory requirements, through appropriate strategies in the event of severe stress shocks of a systemic or idiosyncratic nature. Accordingly, each institution would be able to preserve its financial feasibility and, at the same time, mitigate the impact on the National Financial System. Itaú Unibanco has a Recovery Plan that contemplates the entire conglomerate, including foreign subsidiaries, and contains the description of the following items: I - Critical functions rendered by Itaú Unibanco to the market, activities that, if abruptly interrupted, could impact the National Financial System (SFN) and the functioning of the real economy; II- Institution's essential services: activities, operations or services which discontinuity could compromise the bank's viability; III - Monthly monitoring program, establishing critical levels for a set of indicators, with a view to risk monitoring and eventual trigger for the execution of the Recovery Plan; IV - Stress scenarios, contemplating events that may threaten the business continuity and the viability of the institution, including reverse tests, which seek to identify remote risk scenarios, contributing to an increase of the management sensitivity; V - Recovery strategies in response to different stress scenarios, including the main risks and barriers, as well as the mitigators of the latter and the procedures for the operationalization of each strategy; VI - Communication plan with stakeholders, seeking its timely execution with the market, regulators and other stakeholders; VII - Governance mechanisms necessary for the coordination and execution of the Recovery Plan, such as the definition of the director responsible for the exercise at Itaú Unibanco. This plan is reviewed annually and is subjected to the approval of the Board of Directors. With this practice, Itaú Unibanco has been able to continuously demonstrate, since its first edition in 2017, that even in severe scenarios, with remote probability of occurrence, it has strategies capable of generating sufficient resources to ensure the sustainable maintenance of critical activities and essential services, without losses to customers, to the financial system and to other participants in the markets in which it operates. Itaú Unibanco ensures the exercise maintenance to guarantee that strategies remain up-to-date and viable in the face of organizational, competitive or systemic changes. 2.5 Capital Requirements and Capital Composition Itaú Uiao’s i iu apital euiee ts ae epessed as atios of the apital aailale – stated by the Total (1)1 Capital (Referential Equity) and the risk-weighted assets (RWA). These ratios follow the set of resolutions and circulars disclosed by BACEN that implemented, in Brazil, the global capital requirement standards known as Basel III. The Total Capital is the sum of three items, namely: • Common Equity Tier I: sum of social capital, reserves and retained earnings, less deductions and prudential adjustment; • Additional Tier I Capital: consists of instruments of a perpetual nature, which meet eligibility requirements. Together with Common Equity Tier I it makes up Tier I; • Tier II: consists of subordinated debt instruments with defined maturity dates that meet eligibility requirements. Together with Common Equity Tier I and Additional Tier I Capital, it makes up Total Capital. (1) The standards that implemented the Basel III rules in Brazil were disclosed on March 1, 2013 through Resolutions No. 4,192 to No. 4,195 of the National Monetary Council (CMN) (Resolution No. 4,195 was revoked by Resolution No. 4,280), together with 15 Circulars published by BACEN on March 4, 2013, as amended. 6 Itaú Unibanco Risk and Capital Management – Pillar 3 2.4 Recovery Plan In response to the latest international crises, the Central Bank issued the Resolution No. 4,502, which requires the development of a Recovery Plan for the financial institutions that are classified in the Segment 1, with a total exposure of more than 10% of Gross Domestic Product (GDP). This plan aims to reestablish adequate levels of capital and liquidity, above the regulatory requirements, through appropriate strategies in the event of severe stress shocks of a systemic or idiosyncratic nature. Accordingly, each institution would be able to preserve its financial feasibility and, at the same time, mitigate the impact on the National Financial System. Itaú Unibanco has a Recovery Plan that contemplates the entire conglomerate, including foreign subsidiaries, and contains the description of the following items: I - Critical functions rendered by Itaú Unibanco to the market, activities that, if abruptly interrupted, could impact the National Financial System (SFN) and the functioning of the real economy; II- Institution's essential services: activities, operations or services which discontinuity could compromise the bank's viability; III - Monthly monitoring program, establishing critical levels for a set of indicators, with a view to risk monitoring and eventual trigger for the execution of the Recovery Plan; IV - Stress scenarios, contemplating events that may threaten the business continuity and the viability of the institution, including reverse tests, which seek to identify remote risk scenarios, contributing to an increase of the management sensitivity; V - Recovery strategies in response to different stress scenarios, including the main risks and barriers, as well as the mitigators of the latter and the procedures for the operationalization of each strategy; VI - Communication plan with stakeholders, seeking its timely execution with the market, regulators and other stakeholders; VII - Governance mechanisms necessary for the coordination and execution of the Recovery Plan, such as the definition of the director responsible for the exercise at Itaú Unibanco. This plan is reviewed annually and is subjected to the approval of the Board of Directors. With this practice, Itaú Unibanco has been able to continuously demonstrate, since its first edition in 2017, that even in severe scenarios, with remote probability of occurrence, it has strategies capable of generating sufficient resources to ensure the sustainable maintenance of critical activities and essential services, without losses to customers, to the financial system and to other participants in the markets in which it operates. Itaú Unibanco ensures the exercise maintenance to guarantee that strategies remain up-to-date and viable in the face of organizational, competitive or systemic changes. 2.5 Capital Requirements and Capital Composition Itaú Uiao’s i iu apital euiee ts ae epessed as atios of the apital aailale – stated by the Total (1)1 Capital (Referential Equity) and the risk-weighted assets (RWA). These ratios follow the set of resolutions and circulars disclosed by BACEN that implemented, in Brazil, the global capital requirement standards known as Basel III. The Total Capital is the sum of three items, namely: • Common Equity Tier I: sum of social capital, reserves and retained earnings, less deductions and prudential adjustment; • Additional Tier I Capital: consists of instruments of a perpetual nature, which meet eligibility requirements. Together with Common Equity Tier I it makes up Tier I; • Tier II: consists of subordinated debt instruments with defined maturity dates that meet eligibility requirements. Together with Common Equity Tier I and Additional Tier I Capital, it makes up Total Capital. (1) The standards that implemented the Basel III rules in Brazil were disclosed on March 1, 2013 through Resolutions No. 4,192 to No. 4,195 of the National Monetary Council (CMN) (Resolution No. 4,195 was revoked by Resolution No. 4,280), together with 15 Circulars published by BACEN on March 4, 2013, as amended. 6 Itaú Unibanco

Risk and Capital Management – Pillar 3 The Total Capital, Tier I Capital and Common Equity Tier I Capital ratios are calculated on a consolidated basis, applied to (2) 2 institutions included in Prudential Conglomerate , which comprises not only financial institutions but also collective fiaig plas consórcios, pae t etities, fato ing companies or companies that directly or indirectly assume credit risk, and investment funds in which the institution retains substantially all risks and rewards. For purposes of calculating these minimum capital requirements, the total RWA is determined as the sum of the risk- weighted asset amounts for credit, market, and operational risks. Credit, market and operational risks approaches are treated as described in section . Risk -Weighted Assets (RWA) . The minimum Total Capital ratio required is 8.0% as from January 1st, 2019. The BACEN rules call for Additional Capital Buffers (ACP), corresponding to the sum of the components ACPConservation, ACP and ACP , which, along with the requirements mentioned, increase capital requirement over time, as Countercyclical Systemic provided for in CMN Resolution 4,193. Basel III - Implementation Schedule (2) 2018 2019 Common Equity Tier I 4.5% 4.5% Tier I 6.0% 6.0% Total Capital 8.625% 8.0% Additional Capital Buffers (ACP) 2.375% 3.5% conservation 1.875% 2.5% (1) 0% 0% countercyclical systemic 0.5% 1.0% Common Equity Tier I + ACP 6.875% 8.0% Total Capital + ACP 11.0% 11.5% Prudential adjustments deductions 100% 100% (1) The countercyclical capital buffer is fixed by the Financial Stability Committee (Comef) based on discussions about the pace of credit expansion (BACEN Communication No. 30,371/17), and currently is set to zero (BACEN Communication No. 34,724/19). Should the requirement increase, the new percentage takes effect twelve months after the announcement. (2) Minimum requirements valid from 1 January, 2019 onwards. Basel III also redefined the requirements for qualifying the instruments eligible for Tier I and Tier II Capital, which in Brazil are regulated by CMN Resolution 4,192. This reform included a phase-out schedule for instruments currently included in capital, which were issued before the rule came into effect and which do not fully meet the new requirements. The table below presents the composition of the referential equity and its components (Common Equity Tier I, Additional Tier I Capital and Tier II Capital), taking into consideration their respective prudential adjustments, as required by current regulations. Composition of Referential Equity R$ million 12/31/2019 09/30/2019 12/31/2018 Stokholdes’ eu ity Itaú Uiao Holdig S.A. Cos olidated 131,987 125,719 131,757 Non-controlling interest in subsidiaries 11,110 12,712 12,276 Changes in ownership interest in a subsidiary in capital transactions 259 50 98 Cos olidated Stokholdes’ Euity BACEN 143,356 138,481 144,131 Common Equity Tier I prudential adjustments (26,028) (25,246) (20,773) Common Equity Tier I 117,328 113,235 123,358 Instruments eligible to comprise Additional Tier I 11,266 11,513 7,701 Additional Tier I prudential adjustments 102 108 95 Additional Tier I Capital 11,368 11,621 7,796 Tier I (Common Equity Tier I + Additional Tier I Capital) 128,696 124,856 131,154 Instruments eligible to comprise Tier II 11,833 11,833 15,778 Tier II prudential adjustments 67 66 96 Tier II 11,900 11,899 15,874 Reference Equity (Tier I + Tier II) 140,596 136,755 147,028 The most significant prudential adjustments for Itaú Unibanco are shown in the following table. Together, they account for more than 90% of the prudential adjustments as of December 31, 2019. (2) Further details of Prudential Conglomerate can be found in BACEN Circular No. 3,701, CMN Resolution No. 4,280 or in the link: http://www.bcb.gov.br/?BRPRUDENTIALFINREG. 7 Itaú Unibanco Risk and Capital Management – Pillar 3 The Total Capital, Tier I Capital and Common Equity Tier I Capital ratios are calculated on a consolidated basis, applied to (2) 2 institutions included in Prudential Conglomerate , which comprises not only financial institutions but also collective fiaig plas consórcios, pae t etities, fato ing companies or companies that directly or indirectly assume credit risk, and investment funds in which the institution retains substantially all risks and rewards. For purposes of calculating these minimum capital requirements, the total RWA is determined as the sum of the risk- weighted asset amounts for credit, market, and operational risks. Credit, market and operational risks approaches are treated as described in section . Risk -Weighted Assets (RWA) . The minimum Total Capital ratio required is 8.0% as from January 1st, 2019. The BACEN rules call for Additional Capital Buffers (ACP), corresponding to the sum of the components ACPConservation, ACP and ACP , which, along with the requirements mentioned, increase capital requirement over time, as Countercyclical Systemic provided for in CMN Resolution 4,193. Basel III - Implementation Schedule (2) 2018 2019 Common Equity Tier I 4.5% 4.5% Tier I 6.0% 6.0% Total Capital 8.625% 8.0% Additional Capital Buffers (ACP) 2.375% 3.5% conservation 1.875% 2.5% (1) 0% 0% countercyclical systemic 0.5% 1.0% Common Equity Tier I + ACP 6.875% 8.0% Total Capital + ACP 11.0% 11.5% Prudential adjustments deductions 100% 100% (1) The countercyclical capital buffer is fixed by the Financial Stability Committee (Comef) based on discussions about the pace of credit expansion (BACEN Communication No. 30,371/17), and currently is set to zero (BACEN Communication No. 34,724/19). Should the requirement increase, the new percentage takes effect twelve months after the announcement. (2) Minimum requirements valid from 1 January, 2019 onwards. Basel III also redefined the requirements for qualifying the instruments eligible for Tier I and Tier II Capital, which in Brazil are regulated by CMN Resolution 4,192. This reform included a phase-out schedule for instruments currently included in capital, which were issued before the rule came into effect and which do not fully meet the new requirements. The table below presents the composition of the referential equity and its components (Common Equity Tier I, Additional Tier I Capital and Tier II Capital), taking into consideration their respective prudential adjustments, as required by current regulations. Composition of Referential Equity R$ million 12/31/2019 09/30/2019 12/31/2018 Stokholdes’ eu ity Itaú Uiao Holdig S.A. Cos olidated 131,987 125,719 131,757 Non-controlling interest in subsidiaries 11,110 12,712 12,276 Changes in ownership interest in a subsidiary in capital transactions 259 50 98 Cos olidated Stokholdes’ Euity BACEN 143,356 138,481 144,131 Common Equity Tier I prudential adjustments (26,028) (25,246) (20,773) Common Equity Tier I 117,328 113,235 123,358 Instruments eligible to comprise Additional Tier I 11,266 11,513 7,701 Additional Tier I prudential adjustments 102 108 95 Additional Tier I Capital 11,368 11,621 7,796 Tier I (Common Equity Tier I + Additional Tier I Capital) 128,696 124,856 131,154 Instruments eligible to comprise Tier II 11,833 11,833 15,778 Tier II prudential adjustments 67 66 96 Tier II 11,900 11,899 15,874 Reference Equity (Tier I + Tier II) 140,596 136,755 147,028 The most significant prudential adjustments for Itaú Unibanco are shown in the following table. Together, they account for more than 90% of the prudential adjustments as of December 31, 2019. (2) Further details of Prudential Conglomerate can be found in BACEN Circular No. 3,701, CMN Resolution No. 4,280 or in the link: http://www.bcb.gov.br/?BRPRUDENTIALFINREG. 7 Itaú Unibanco

Risk and Capital Management – Pillar 3 Prudential Adjustments R$ million 12/31/2019 09/30/2019 12/31/2018 Ref. Anexo I Goodwill paid upon the acquisition of investments 6,397 6,143 7,061 (e) Intangible assets 8,341 8,001 7,573 (h) / (i) Tax credits 1,480 4,611 4,211 (b) Mio it shaeholdes’ pia apital suplus 367 383 339 Adjustments related to the market value of derivative financial instruments used to hedge the cash (1,475) (1,794) (1,585) flows of protected items whose mark-to-market adjustments are not recorded in the books Prudential Adjustments subject to exemption limits (deferred tax assets from temporary differences, investments in insurance companies and investments in financial institutions not 10,605 7,682 3,012 consolidated). Others 313 220 162 Total 26,028 25,246 20,773 In 2019, Itaú Unibanco did not buy back its own shares. The shares that were repurchased in the previous periods are shown as Treasury Shares , which reached a balance of R$ (1,274) million as of December 31, 2019. Treasury shares edue ou shaeholdes’ euit, esultig i a deease i the apital ase . In this period, the amount of dividends and Interest on capital paid / provided for, which affects Itaú Uiao’s capital base, was R$ 27,244 million. Dividends and Interest on capital ae deduted fo the istitutio’s shaeholdes’ euit, thus reducing its capital base. Moe details aout Total Capital ae gie i Appedi I Beakdo o f the Total Capital and Information on its Adequacy) in this report. The table below presents subordinated debts and other instruments eligible for Additional Tier I and Tier II capital: R$ million Instruments Eligible for Additional Tier I Capital Maturities 12/31/2019 09/30/2019 12/31/2018 > 5 years or <1 year 1-2 years 2-3 years 3-4 years 4-5 years Name of instrument Total Total Total Perpetual Subordinated Perpetual Debt - - - - - 11 ,266 11,266 11,513 7,702 Instruments Eligible for Additional Tier I Capital (Sep/19) - - - - - 11,266 11,266 11,513 7 ,702 Instruments Eligible for Tier II Capital R$ million Maturities 12/31/2019 09/30/2019 12/31/2018 > 5 years or Name of instrument <1 year 1-2 years 2-3 years 3-4 years 4-5 years Total Total Total Perpetual Financial Bills 51 14 5,024 - - - 5,089 4,992 4,902 Euronotes 4,041 9,322 10,673 7,502 - - 31 ,538 32,584 30,303 Subordinated Debt (Sep/19) 4,092 9,336 15,697 7,502 - - 36,627 37,576 35,205 Subordinated Debt Not Elegible to Capital 6 82 181 208 695 10,397 11,569 6,370 6,406 Subordinated Debt - Total Sep/19) 4,098 9,418 15,878 7,710 695 10,397 48,196 43,946 41,611 Subordinated Debt after Reducer (Sep/19) - 1,867 6,279 4,501 - - 12,647 14,247 19,068 Subordinated Debt after Reducer (Dec/12) - 990 290 4,235 7,093 26,514 39,122 Preferred Shares (Dec/12) - - 323 - - - 323 (1) Threshold Instruments Eligible for Tier II Capital (Dec/12) - 297 184 1,270 2,128 7,954 11,833 Instruments Eligible for Tier II Capital (Sep/19) (2) - 297 184 1,270 2,128 7,954 11,833 Total Instruments Eligible for Capital (Sep/19) - 297 184 1,270 2,128 19,220 23,099 (1) Instruments Eligible for Tier II Capital with application of threshold in accordance with the current rules (Resolution 4,192 - Art 28). (2) According to current legislation, the accounting balance of instruments eligible for Tier II Capital as of December 2012 was used for the calculation of total capital as of September, 2019. In November 2019, Itaú Unibanco Holding issued in the international market US$ 750 million in Subordinated Notes, equivalent to R$ 3,023 million on December 31, 2019, and in the local market R$ 2,330 million in Subordinated Financial Bills. There is a repurchase option for these subordinated debts as from 2024 and they are subject to approval by the Central Bank of Brazil for composition of Itaú Uiao’s Capital Tier II, with an estimated increase of 0.6 p.p. in its Total Capital ratio. For further details of instruments that are part of the Total Capital, please visit the website www.itau.com.br/investor- relations, section Reports, under Pillar 3 and Global Systemically Important Banks – Spreadsheet Support, Appendix I and II – Pillar 3, Appendix II – Main Features of the Total Capital (PR) Instruments. The Circular BACEN 3,751 provides for the calculation of relevant indicators to identify Global Systemically Important Banks (G-SIBs) among financial institutions in Brazil. A institution is considered G-SIB whether its score reaches at least 130, this score was 39 fo Itaú Uiao’s i 8. Information on the values of the G-SIBs indicators can been found at www.itau.com.br/investor-relations, section Reports, Pillar 3 and Global Systemically Important Banks. The compliance of BACEN with the standards recommended by the Basel Committee was assessed at the end of 2013, (3). under the Regulatory Consistency Assessment Programme (RCAP) The rules effective in Brazil were considered compliant—pursuant to the Bank for International Settlements (BIS), Brazil is a compliant jurisdiction—i.e., the capital (3) Regulatory Consistency Assessment Programme (RCAP). Assessment of Basel III regulations in Brazil, December 2013, updated in March 2019. 8 Itaú Unibanco Risk and Capital Management – Pillar 3 Prudential Adjustments R$ million 12/31/2019 09/30/2019 12/31/2018 Ref. Anexo I Goodwill paid upon the acquisition of investments 6,397 6,143 7,061 (e) Intangible assets 8,341 8,001 7,573 (h) / (i) Tax credits 1,480 4,611 4,211 (b) Mio it shaeholdes’ pia apital suplus 367 383 339 Adjustments related to the market value of derivative financial instruments used to hedge the cash (1,475) (1,794) (1,585) flows of protected items whose mark-to-market adjustments are not recorded in the books Prudential Adjustments subject to exemption limits (deferred tax assets from temporary differences, investments in insurance companies and investments in financial institutions not 10,605 7,682 3,012 consolidated). Others 313 220 162 Total 26,028 25,246 20,773 In 2019, Itaú Unibanco did not buy back its own shares. The shares that were repurchased in the previous periods are shown as Treasury Shares , which reached a balance of R$ (1,274) million as of December 31, 2019. Treasury shares edue ou shaeholdes’ euit, esultig i a deease i the apital ase . In this period, the amount of dividends and Interest on capital paid / provided for, which affects Itaú Uiao’s capital base, was R$ 27,244 million. Dividends and Interest on capital ae deduted fo the istitutio’s shaeholdes’ euit, thus reducing its capital base. Moe details aout Total Capital ae gie i Appedi I Beakdo o f the Total Capital and Information on its Adequacy) in this report. The table below presents subordinated debts and other instruments eligible for Additional Tier I and Tier II capital: R$ million Instruments Eligible for Additional Tier I Capital Maturities 12/31/2019 09/30/2019 12/31/2018 > 5 years or <1 year 1-2 years 2-3 years 3-4 years 4-5 years Name of instrument Total Total Total Perpetual Subordinated Perpetual Debt - - - - - 11 ,266 11,266 11,513 7,702 Instruments Eligible for Additional Tier I Capital (Sep/19) - - - - - 11,266 11,266 11,513 7 ,702 Instruments Eligible for Tier II Capital R$ million Maturities 12/31/2019 09/30/2019 12/31/2018 > 5 years or Name of instrument <1 year 1-2 years 2-3 years 3-4 years 4-5 years Total Total Total Perpetual Financial Bills 51 14 5,024 - - - 5,089 4,992 4,902 Euronotes 4,041 9,322 10,673 7,502 - - 31 ,538 32,584 30,303 Subordinated Debt (Sep/19) 4,092 9,336 15,697 7,502 - - 36,627 37,576 35,205 Subordinated Debt Not Elegible to Capital 6 82 181 208 695 10,397 11,569 6,370 6,406 Subordinated Debt - Total Sep/19) 4,098 9,418 15,878 7,710 695 10,397 48,196 43,946 41,611 Subordinated Debt after Reducer (Sep/19) - 1,867 6,279 4,501 - - 12,647 14,247 19,068 Subordinated Debt after Reducer (Dec/12) - 990 290 4,235 7,093 26,514 39,122 Preferred Shares (Dec/12) - - 323 - - - 323 (1) Threshold Instruments Eligible for Tier II Capital (Dec/12) - 297 184 1,270 2,128 7,954 11,833 Instruments Eligible for Tier II Capital (Sep/19) (2) - 297 184 1,270 2,128 7,954 11,833 Total Instruments Eligible for Capital (Sep/19) - 297 184 1,270 2,128 19,220 23,099 (1) Instruments Eligible for Tier II Capital with application of threshold in accordance with the current rules (Resolution 4,192 - Art 28). (2) According to current legislation, the accounting balance of instruments eligible for Tier II Capital as of December 2012 was used for the calculation of total capital as of September, 2019. In November 2019, Itaú Unibanco Holding issued in the international market US$ 750 million in Subordinated Notes, equivalent to R$ 3,023 million on December 31, 2019, and in the local market R$ 2,330 million in Subordinated Financial Bills. There is a repurchase option for these subordinated debts as from 2024 and they are subject to approval by the Central Bank of Brazil for composition of Itaú Uiao’s Capital Tier II, with an estimated increase of 0.6 p.p. in its Total Capital ratio. For further details of instruments that are part of the Total Capital, please visit the website www.itau.com.br/investor- relations, section Reports, under Pillar 3 and Global Systemically Important Banks – Spreadsheet Support, Appendix I and II – Pillar 3, Appendix II – Main Features of the Total Capital (PR) Instruments. The Circular BACEN 3,751 provides for the calculation of relevant indicators to identify Global Systemically Important Banks (G-SIBs) among financial institutions in Brazil. A institution is considered G-SIB whether its score reaches at least 130, this score was 39 fo Itaú Uiao’s i 8. Information on the values of the G-SIBs indicators can been found at www.itau.com.br/investor-relations, section Reports, Pillar 3 and Global Systemically Important Banks. The compliance of BACEN with the standards recommended by the Basel Committee was assessed at the end of 2013, (3). under the Regulatory Consistency Assessment Programme (RCAP) The rules effective in Brazil were considered compliant—pursuant to the Bank for International Settlements (BIS), Brazil is a compliant jurisdiction—i.e., the capital (3) Regulatory Consistency Assessment Programme (RCAP). Assessment of Basel III regulations in Brazil, December 2013, updated in March 2019. 8 Itaú Unibanco

Risk and Capital Management – Pillar 3 standards established in Brazil are also consistent with the internationally accepted minimum requirements. The pointed out discrepancies were considered immaterial. Minimum capital requirement for Insurance The minimum capital requirements for underwriting, credit, operating and market risks for insurers, open private pension entities, premium bonds companies and reinsurers are established by The National Council of Private Insurance (CNSP), through CNSP Resolution 321 e subsequent amendments. 2.6 Risk-Weighted Asset (RWA) According to CMN Resolution 4,193 and subsequent amendments, for assessing the minimum capital requirements, the RWA must be calculated by adding the following risk exposures: RWA = RWA + RWA + RWA CPAD MINT OPAD • RWACPAD = portion related to exposures to credit risk, calculated using standardized approach; • RWAMINT = portion related to the market risk capital requirement, made up of the maximum between the internal model and 80% of the standardized model, and regulated by BACEN Circulars 3,646 and 3,674; • RWAOPAD = portion related to the operational risk capital requirement, calculated using standardized approach. The table below presents the evolution of RWA composition of Itaú Unibanco. Composition of Risk-Weighted Asset R$ million Risk exposures 12/31/2019 09/30/2019 12/31/2018 Risk-Weighted Assets for Credit Risk (RWA ) 784,730 88.0% 759,358 85.6% 714,969 87.4% CPAD Risk-Weighted Assets for Market Risk (RWA ) 25,002 2.8% 46,587 5.2% 30,270 3.7% MINT Risk-Weighted Assets for Operational Risk (RWA ) 81,568 9.2% 81,568 9.2% 72,833 8.9% OPAD Risk-Weighted Assets (RWA) 891,300 100.0% 887,513 100.0% 818,072 100.0% 9 Itaú Unibanco Risk and Capital Management – Pillar 3 standards established in Brazil are also consistent with the internationally accepted minimum requirements. The pointed out discrepancies were considered immaterial. Minimum capital requirement for Insurance The minimum capital requirements for underwriting, credit, operating and market risks for insurers, open private pension entities, premium bonds companies and reinsurers are established by The National Council of Private Insurance (CNSP), through CNSP Resolution 321 e subsequent amendments. 2.6 Risk-Weighted Asset (RWA) According to CMN Resolution 4,193 and subsequent amendments, for assessing the minimum capital requirements, the RWA must be calculated by adding the following risk exposures: RWA = RWA + RWA + RWA CPAD MINT OPAD • RWACPAD = portion related to exposures to credit risk, calculated using standardized approach; • RWAMINT = portion related to the market risk capital requirement, made up of the maximum between the internal model and 80% of the standardized model, and regulated by BACEN Circulars 3,646 and 3,674; • RWAOPAD = portion related to the operational risk capital requirement, calculated using standardized approach. The table below presents the evolution of RWA composition of Itaú Unibanco. Composition of Risk-Weighted Asset R$ million Risk exposures 12/31/2019 09/30/2019 12/31/2018 Risk-Weighted Assets for Credit Risk (RWA ) 784,730 88.0% 759,358 85.6% 714,969 87.4% CPAD Risk-Weighted Assets for Market Risk (RWA ) 25,002 2.8% 46,587 5.2% 30,270 3.7% MINT Risk-Weighted Assets for Operational Risk (RWA ) 81,568 9.2% 81,568 9.2% 72,833 8.9% OPAD Risk-Weighted Assets (RWA) 891,300 100.0% 887,513 100.0% 818,072 100.0% 9 Itaú Unibanco

Risk and Capital Management – Pillar 3 Risk-Weighted Assets for Credit Risk (RWA ) CPAD The table below presents the credit risk-weighted assets (RWA ), regulated by BACEN Circular 3,644, segregated by risk CPAD weighting factor and by asset type: Composition of Risk-Weighted Assets for Credit Risk (RWA ) CPAD R$ million 12/31/2019 09/30/2019 12/31/2018 Risk exposures Exposure weighted by credit risk (RWA ) 7 84,730 7 59,358 7 14,969 CPAD a) Per Weighting Factor (FPR): FPR at 2% 147 113 134 FPR at 4% 431 445 401 FPR at 10% - - 145 FPR at 20% 9,581 8,412 8,103 FPR at 35% 21,939 21,838 1 9,787 FPR at 50% 58,178 55,410 45,937 FPR at 75% 177,372 172,036 1 58,397 FPR at 85% 120,402 110,820 66,313 FPR at 100% 334,064 322,190 3 44,938 (1) 126 133 - FPR de 150% FPR at 250% 43,998 42,463 4 6,259 FPR at 300% 6,401 12,002 9,506 FPR up to 1250% 1,064 718 2,000 Deiaties – Vaiatio o f the oute pat edit u alit 3,494 4,050 5,417 Default Funds 15 11 9 Securitization 7,518 8,717 7,623 Exposure weighted by credit risk (RWA ) 7 84,730 759,358 7 14,969 CPAD b) Per Type: Securities 54,715 50,730 40,276 Loan operations - Retail 139,522 134,245 1 24,356 Loan operations - Non-retail 274,324 277,256 2 56,958 Joint liabilities - Retail 150 134 140 Joint liabilities - Non-retail 45,657 44,131 4 3,288 Loan commitments - Retail 37,700 37,658 3 3,871 Loan commitments - Non-retail 11,138 11,435 1 0,673 Derivatives - Future potential gain 4,787 4,782 4,193 Intermediation Operations 2,422 2,040 3,330 Other exposures 214,315 196,947 1 97,884 (1) As from january 2019, Circular 3,921 became effective, changing the rules of RW (FPR) for exposures to foreign sovereigns. Risk-Weighted Assets for Market Risk (RWA ) MINT st From September 1 , 2016, BACEN has authorized Itaú Unibanco to use internal market risk models to determine the total amount of regulatory capital (RWA ), replacing the RWA , as set out in BACEN Circular 3,646. MINT MPAD Among the foreign units, Argentina has its market capital calculated through the internal approach, while the others (Chile, Itaú BBA International, Colombia, Paraguay and Uruguay) use the standardized approach. The following table presents the values of market risk weighted assets (RWAMINT) which is regulated by BACEN Circulars 3,646 and 3,674. 10 Itaú Unibanco Risk and Capital Management – Pillar 3 Risk-Weighted Assets for Credit Risk (RWA ) CPAD The table below presents the credit risk-weighted assets (RWA ), regulated by BACEN Circular 3,644, segregated by risk CPAD weighting factor and by asset type: Composition of Risk-Weighted Assets for Credit Risk (RWA ) CPAD R$ million 12/31/2019 09/30/2019 12/31/2018 Risk exposures Exposure weighted by credit risk (RWA ) 7 84,730 7 59,358 7 14,969 CPAD a) Per Weighting Factor (FPR): FPR at 2% 147 113 134 FPR at 4% 431 445 401 FPR at 10% - - 145 FPR at 20% 9,581 8,412 8,103 FPR at 35% 21,939 21,838 1 9,787 FPR at 50% 58,178 55,410 45,937 FPR at 75% 177,372 172,036 1 58,397 FPR at 85% 120,402 110,820 66,313 FPR at 100% 334,064 322,190 3 44,938 (1) 126 133 - FPR de 150% FPR at 250% 43,998 42,463 4 6,259 FPR at 300% 6,401 12,002 9,506 FPR up to 1250% 1,064 718 2,000 Deiaties – Vaiatio o f the oute pat edit u alit 3,494 4,050 5,417 Default Funds 15 11 9 Securitization 7,518 8,717 7,623 Exposure weighted by credit risk (RWA ) 7 84,730 759,358 7 14,969 CPAD b) Per Type: Securities 54,715 50,730 40,276 Loan operations - Retail 139,522 134,245 1 24,356 Loan operations - Non-retail 274,324 277,256 2 56,958 Joint liabilities - Retail 150 134 140 Joint liabilities - Non-retail 45,657 44,131 4 3,288 Loan commitments - Retail 37,700 37,658 3 3,871 Loan commitments - Non-retail 11,138 11,435 1 0,673 Derivatives - Future potential gain 4,787 4,782 4,193 Intermediation Operations 2,422 2,040 3,330 Other exposures 214,315 196,947 1 97,884 (1) As from january 2019, Circular 3,921 became effective, changing the rules of RW (FPR) for exposures to foreign sovereigns. Risk-Weighted Assets for Market Risk (RWA ) MINT st From September 1 , 2016, BACEN has authorized Itaú Unibanco to use internal market risk models to determine the total amount of regulatory capital (RWA ), replacing the RWA , as set out in BACEN Circular 3,646. MINT MPAD Among the foreign units, Argentina has its market capital calculated through the internal approach, while the others (Chile, Itaú BBA International, Colombia, Paraguay and Uruguay) use the standardized approach. The following table presents the values of market risk weighted assets (RWAMINT) which is regulated by BACEN Circulars 3,646 and 3,674. 10 Itaú Unibanco

Risk and Capital Management – Pillar 3 Composition of Risk-Weighted Assets for Market Risk (RWA ) MINT R$ million 12/31/2019 09/30/2019 12/31/2018 Risk-Weighted Assets for Market Risk - Standard Aproach (RWAMPAD) 28,328 58,233 37,838 Operations subject to interest rate variation 24,724 55,468 30,286 Fixed income interest rate denominated in reais 5 ,273 3 ,200 2 ,026 Foreign exchange linked interest rate 1 3,118 4 3,697 1 9,633 Price index linked interest rate 6 ,333 8 ,571 8 ,627 Interest rate linked interest rate - - 0 Operations subject to commodity price variation 1 ,087 858 389 Operations subject to stock price variation 1 ,162 751 362 Operations subject to the risk of exposures in gold, foreign currency and foreign exchange variations 1 ,355 1 ,156 6 ,801 (1) Minimum Market Risk Weighted Assets - Standard Aproach (RWAMPAD) (a) 22,663 46,587 30,270 Market Risk Weighted Assets calculated based on internal methodology (b) 25,002 44,837 22,871 Reduction of Market Risk Weighted Assets due to Internal Models Aproach (IMA) (3,327) (11,646) (7,568) Market Risk Weighted Assets (RWAMINT) - maximum of (a) and (b) 25,002 46,587 30,270 (1) Market risk weighted-assets calculated based on internal models, with a maximum saving possibility of 20% of the standard model. On December 31, 2019, RWAMINT reached R$ 25,002 million, that corresponds to the need of capital calculated through the internal approach, above the value of 80% of RWA , that was R$ 22,663 million. MPAD Risk-Weighted Assets for Operational Risk (RWA ) OPAD BACEN Circulars 3,640, 3,316 and subsequent amendments established the criteria for determining the portion of risk- weighted assets related to the capital required for operational risk (RWAOPAD). Itaú Unibanco uses the Alternative Standardised Approach. In accordance with current regulation, the exposure of RWAOPAD is calculated on a semiannual basis, related to June 30 and December 31. The following table presents the values of RWA for operational risk: Composition of Risk-Weighted Assets for Operational Risk (RWA ) OPAD R$ million 12/31/2019 09/30/2019 12/31/2018 Risk-Weighted Assets for Operational Risk (RWA ) 81,568 81,568 72,833 OPAD Retail 14,005 14,005 12,822 Commercial 27,536 27,536 26,214 Corporate finance 2,746 2,746 2,697 Negotiation and sales 15,430 15,430 11,736 Payments and settlements 8,802 8,802 8,282 Financial agent services 4,641 4,641 4,343 Asset management 8,101 8,101 6,715 Retail brokerage 307 307 24 2.7 Additional Capital Buffers A requirement for Additional Capital Buffers (ACP) came into effect in the first quarter of 2016. Details of its components are shown below: Additional Capital Buffers (ACP) R$ million 12/31/2019 09/30/2019 12/31/2018 Additional Capital Buffers (ACP ) 31,195 31,063 19,429 requirement conservation 22 ,282 22 ,188 15 ,339 countercyclical - - - systemically importance 8,9 13 8,8 75 4,0 90 BACEN Circular 3,769 describes the method for calculating the ACPcountercyclical. Details of its portions are shown below for the relevant jurisdictions: (1) (2) Additional Capital Buffers (ACP ) R$ million countercyclical 12/31/2019 09/30/2019 12/31/2018 RWA CPrNBi Brazil 5 19,410 4 95,987 4 39,924 (3) Chile 82,831 86,710 88,112 Total 6 02,241 5 82,697 5 28,036 (1) Portion of the RWA balance for credit risk exposure to the non-banking private sector in the relevant jurisdictions. (2) Percentage amount of the Additional Common Equity Tier I countercyclical for the principal jurisdictions is zero. (3) Method of calculating countercyclical buffer not announced in this jurisdiction. According to Article 2 of BACEN Circular No. 3,769 the ACCP of Brazil value should be used. 11 Itaú Unibanco Risk and Capital Management – Pillar 3 Composition of Risk-Weighted Assets for Market Risk (RWA ) MINT R$ million 12/31/2019 09/30/2019 12/31/2018 Risk-Weighted Assets for Market Risk - Standard Aproach (RWAMPAD) 28,328 58,233 37,838 Operations subject to interest rate variation 24,724 55,468 30,286 Fixed income interest rate denominated in reais 5 ,273 3 ,200 2 ,026 Foreign exchange linked interest rate 1 3,118 4 3,697 1 9,633 Price index linked interest rate 6 ,333 8 ,571 8 ,627 Interest rate linked interest rate - - 0 Operations subject to commodity price variation 1 ,087 858 389 Operations subject to stock price variation 1 ,162 751 362 Operations subject to the risk of exposures in gold, foreign currency and foreign exchange variations 1 ,355 1 ,156 6 ,801 (1) Minimum Market Risk Weighted Assets - Standard Aproach (RWAMPAD) (a) 22,663 46,587 30,270 Market Risk Weighted Assets calculated based on internal methodology (b) 25,002 44,837 22,871 Reduction of Market Risk Weighted Assets due to Internal Models Aproach (IMA) (3,327) (11,646) (7,568) Market Risk Weighted Assets (RWAMINT) - maximum of (a) and (b) 25,002 46,587 30,270 (1) Market risk weighted-assets calculated based on internal models, with a maximum saving possibility of 20% of the standard model. On December 31, 2019, RWAMINT reached R$ 25,002 million, that corresponds to the need of capital calculated through the internal approach, above the value of 80% of RWA , that was R$ 22,663 million. MPAD Risk-Weighted Assets for Operational Risk (RWA ) OPAD BACEN Circulars 3,640, 3,316 and subsequent amendments established the criteria for determining the portion of risk- weighted assets related to the capital required for operational risk (RWAOPAD). Itaú Unibanco uses the Alternative Standardised Approach. In accordance with current regulation, the exposure of RWAOPAD is calculated on a semiannual basis, related to June 30 and December 31. The following table presents the values of RWA for operational risk: Composition of Risk-Weighted Assets for Operational Risk (RWA ) OPAD R$ million 12/31/2019 09/30/2019 12/31/2018 Risk-Weighted Assets for Operational Risk (RWA ) 81,568 81,568 72,833 OPAD Retail 14,005 14,005 12,822 Commercial 27,536 27,536 26,214 Corporate finance 2,746 2,746 2,697 Negotiation and sales 15,430 15,430 11,736 Payments and settlements 8,802 8,802 8,282 Financial agent services 4,641 4,641 4,343 Asset management 8,101 8,101 6,715 Retail brokerage 307 307 24 2.7 Additional Capital Buffers A requirement for Additional Capital Buffers (ACP) came into effect in the first quarter of 2016. Details of its components are shown below: Additional Capital Buffers (ACP) R$ million 12/31/2019 09/30/2019 12/31/2018 Additional Capital Buffers (ACP ) 31,195 31,063 19,429 requirement conservation 22 ,282 22 ,188 15 ,339 countercyclical - - - systemically importance 8,9 13 8,8 75 4,0 90 BACEN Circular 3,769 describes the method for calculating the ACPcountercyclical. Details of its portions are shown below for the relevant jurisdictions: (1) (2) Additional Capital Buffers (ACP ) R$ million countercyclical 12/31/2019 09/30/2019 12/31/2018 RWA CPrNBi Brazil 5 19,410 4 95,987 4 39,924 (3) Chile 82,831 86,710 88,112 Total 6 02,241 5 82,697 5 28,036 (1) Portion of the RWA balance for credit risk exposure to the non-banking private sector in the relevant jurisdictions. (2) Percentage amount of the Additional Common Equity Tier I countercyclical for the principal jurisdictions is zero. (3) Method of calculating countercyclical buffer not announced in this jurisdiction. According to Article 2 of BACEN Circular No. 3,769 the ACCP of Brazil value should be used. 11 Itaú Unibanco

Risk and Capital Management – Pillar 3 2.8 Capital Adequacy Itaú Unibanco, through ICAAP process, assesses the adequacy of its capital to face the incurred risks, composed by regulatory capital for credit, market and operational risks and by the necessary capital to face other risks. In order to ensure the soundness of Itaú Unibanco and the availability of capital to support business growth, Itaú Unibanco maintains capital levels above the minimum requirements, according to the Common Equity Tier I, Additional Tier I Capital, and Tier II minimum ratios. On December 31, 2019, the Total Capital (PR) reached R$ 140,596 million, R$ 128,696 million of Tier I and R$ 11,900 million of Tier II. Capital Adequacy R$ million 12/31/2019 09/30/2019 12/31/2018 Required Current Required Required Current Required Required Current Required Current Ratio Current Ratio Current Ratio Amount Amount Ratio Amount Amount Ratio Amount Amount Ratio Common Equity Tier I 40,108 117,328 4.5% 13.2% 39,938 113,235 4.5% 12.8% 36,813 123,358 4.5% 15.1% Additional Tier I Capital - 11,368 - - - 11,621 - - - 7,796 - - Tier I 53,478 128,696 6.0% 14.4% 53,251 124,856 6.0% 14.1% 49,084 131,154 6.0% 16.0% Tier II - 11,900 - - - 11,899 - - - 15,874 - - Referential Equity (Tier I + Tier II) 71,304 140,596 8.0% 15.8% 71,001 136,755 8.0% 15.4% 70,559 147,028 8.625% 18.0% Additional Capital Buffers 31,195 3.5% 31,063 3.5% 19,429 2.375% The Total Capital Ratio reached 15.8% on December 31, 2019, increasing 40 basis points relatively to September 30, 2019, mainly driven by the result of the period. Besides, Itaú Unibanco has an R$ 69,292 million capital excess in relation to its required Total Capital, higher than the Additional Capital Buffers requirement of R$ 31,195 million, largely covered by total capital available. The Fixed Assets Ratio Ídie de Ioilização idiates the lee l of Total Capital committed to adjusted permanent assets. Itaú Unibanco is within the maximum limit of 50% of the adjusted Total Capital, as established by BACEN. On December 31, 2019, the Fixed Assets Ratio reached 27.9%, which presents a buffer of R$ 31,104 million. On December 31, 2019, the Tier I capital ratio reached 14,4%. The CET 1 capital ratio reached 13,2%. Tier I Capital Ratio 12 Itaú Unibanco Risk and Capital Management – Pillar 3 2.8 Capital Adequacy Itaú Unibanco, through ICAAP process, assesses the adequacy of its capital to face the incurred risks, composed by regulatory capital for credit, market and operational risks and by the necessary capital to face other risks. In order to ensure the soundness of Itaú Unibanco and the availability of capital to support business growth, Itaú Unibanco maintains capital levels above the minimum requirements, according to the Common Equity Tier I, Additional Tier I Capital, and Tier II minimum ratios. On December 31, 2019, the Total Capital (PR) reached R$ 140,596 million, R$ 128,696 million of Tier I and R$ 11,900 million of Tier II. Capital Adequacy R$ million 12/31/2019 09/30/2019 12/31/2018 Required Current Required Required Current Required Required Current Required Current Ratio Current Ratio Current Ratio Amount Amount Ratio Amount Amount Ratio Amount Amount Ratio Common Equity Tier I 40,108 117,328 4.5% 13.2% 39,938 113,235 4.5% 12.8% 36,813 123,358 4.5% 15.1% Additional Tier I Capital - 11,368 - - - 11,621 - - - 7,796 - - Tier I 53,478 128,696 6.0% 14.4% 53,251 124,856 6.0% 14.1% 49,084 131,154 6.0% 16.0% Tier II - 11,900 - - - 11,899 - - - 15,874 - - Referential Equity (Tier I + Tier II) 71,304 140,596 8.0% 15.8% 71,001 136,755 8.0% 15.4% 70,559 147,028 8.625% 18.0% Additional Capital Buffers 31,195 3.5% 31,063 3.5% 19,429 2.375% The Total Capital Ratio reached 15.8% on December 31, 2019, increasing 40 basis points relatively to September 30, 2019, mainly driven by the result of the period. Besides, Itaú Unibanco has an R$ 69,292 million capital excess in relation to its required Total Capital, higher than the Additional Capital Buffers requirement of R$ 31,195 million, largely covered by total capital available. The Fixed Assets Ratio Ídie de Ioilização idiates the lee l of Total Capital committed to adjusted permanent assets. Itaú Unibanco is within the maximum limit of 50% of the adjusted Total Capital, as established by BACEN. On December 31, 2019, the Fixed Assets Ratio reached 27.9%, which presents a buffer of R$ 31,104 million. On December 31, 2019, the Tier I capital ratio reached 14,4%. The CET 1 capital ratio reached 13,2%. Tier I Capital Ratio 12 Itaú Unibanco

Risk and Capital Management – Pillar 3 2.8.1 IRRBB – Interest Rate Risk in the Banking Book BACEN’s Cetal Bak of Bazil Ciula ,, pulished i Jaua , sta tes o e thodologies ad poedues fo evaluation of the capital adequacy, held to cover interest rates risk from instruments held in the banking book. For the purposes of this Circular, are defined: • ∆EVE Delta Eooi Value of Euit is defied as the diffeee ete e the peset al ue of the su of repricing flows of instruments subject to IRRBB in a base scenario, and the present value of the sum of repricing flows of the same instruments in an interest-rate shocked scenario; • ∆NII Delta Net Iteest Ioe is defied as the diffeee etee the es ult of fiaial iteediatio of instruments subject to IRRBB in a base scenario, and the result of financial intermediation of the same instruments in an interest-rate shocked scenario. The sensibility analysis introduced here are just a static evaluation of the portfolio interest rate exposure, and, therefore, don´t consider the dynamic management of the treasury desk and risk control areas, which hold the responsibility for measures to mitigate risk under an adverse situation, minimizing significant losses. Moreover, it is highlighted, though, the results presented do not translate into accountable or economic results for certain, because this analysis has, only, an interest rate risk disclosure purpose and to demonstrate the principle protection actions, considering the instruments fair value, apart from any accounting practices adopted by Itaú Unibanco. The istitutio uses a iteal o del to e asue ∆EVE ad ∆NII. ∆E VE esults do ot epeset iediate ip at i the stokholdes’ euit. Meahile, ∆NII esults idiate potetial olatilit i the pojeted iteest ates esults. In compliance with the circular 3,876, the following demonstrates qualitative and quantitative details of risk management for IRRBB in Itaú Unibanco. Framework and Treatment Interest rate risk in the banking book refers to the potential risk of impact on capital sufficiency and/or on the results of financial intermediation due to adverse movements in interest rates, taking into account the principal flows of instruments held in the banking book. The main point of assets and liabilities management is to maximize the risk-return ratio of positions held in the banking ook, takig ito aout the eooi al ue of these assets/liaili ties ad the ip at o atual ad futue ak’s results. The interest rate risk managing on transactions held in the banking book occurs within the governance and hierarchy of decision-making bodies and under a limits structure and alerts approved specifically for these purpose, which is sensitive due to different levels and classes of market risk. The management structure of IRRBB has it os isk poliies ad otols iteded to esue adheee to the ak’s isk appetite. The IRRBB framework has granular management limits for several other risk metrics and consolidated limits for ∆EVE ad ∆NII esults, esides the lii ts assoiated i th stress tests. The asset and liability management unit is responsible for managing timing mismatches between asset and liability flows, and minimizes interest rate risk by through strategies as economic hedge and accounting hedge. All the models associated with IRRBB have a robust independent validation process and are approved by a CTAM (Technical Model Assessment Commission). In addition, all the models and processes are assessed by internal audit. The interest rate risk framework in the banking book uses management measurements that are calculated daily for limit otol. The ∆EVE ad ∆NII e tis ae alulated aodig to the isk appetite lii ts ad the othe isk e tis i tes of management risk limits. In the process of managing interest rate risk of the banking book, transactions subject to automatic options are calculated according to internal market models which split the products, as far as possible, into linear and non-linear payoffs. The linear payoffs are treated similarly to any other instruments without options, and for non-linear payoffs an additional al ue is op uted ad added o the ∆EVE ad ∆NII e tis. In general terms, transactions subject to behavioral options are classified as deposits with no contractual maturity date defined or products subject to early repayment. Non-maturity deposits are classified according to their nature and stability to guarantee compliance with regulatory limits. A survival analysis model treats the products subject to pre- payment, using the historical dataset to calibrate its parameters. The instruments flows with homogeneous characteristics are adjusted by specific models to reflect, in the most appropriate way, the repricing flows of the instruments. The banking book consists of asset and liability transactions originating in different commercial channels (retail and wholesale) of Itaú Unibanco. The market risk exposures inherent in the banking book consists of various risk factors, 13 Itaú Unibanco Risk and Capital Management – Pillar 3 2.8.1 IRRBB – Interest Rate Risk in the Banking Book BACEN’s Cetal Bak of Bazil Ciula ,, pulished i Jaua , sta tes o e thodologies ad poedues fo evaluation of the capital adequacy, held to cover interest rates risk from instruments held in the banking book. For the purposes of this Circular, are defined: • ∆EVE Delta Eooi Value of Euit is defied as the diffeee ete e the peset al ue of the su of repricing flows of instruments subject to IRRBB in a base scenario, and the present value of the sum of repricing flows of the same instruments in an interest-rate shocked scenario; • ∆NII Delta Net Iteest Ioe is defied as the diffeee etee the es ult of fiaial iteediatio of instruments subject to IRRBB in a base scenario, and the result of financial intermediation of the same instruments in an interest-rate shocked scenario. The sensibility analysis introduced here are just a static evaluation of the portfolio interest rate exposure, and, therefore, don´t consider the dynamic management of the treasury desk and risk control areas, which hold the responsibility for measures to mitigate risk under an adverse situation, minimizing significant losses. Moreover, it is highlighted, though, the results presented do not translate into accountable or economic results for certain, because this analysis has, only, an interest rate risk disclosure purpose and to demonstrate the principle protection actions, considering the instruments fair value, apart from any accounting practices adopted by Itaú Unibanco. The istitutio uses a iteal o del to e asue ∆EVE ad ∆NII. ∆E VE esults do ot epeset iediate ip at i the stokholdes’ euit. Meahile, ∆NII esults idiate potetial olatilit i the pojeted iteest ates esults. In compliance with the circular 3,876, the following demonstrates qualitative and quantitative details of risk management for IRRBB in Itaú Unibanco. Framework and Treatment Interest rate risk in the banking book refers to the potential risk of impact on capital sufficiency and/or on the results of financial intermediation due to adverse movements in interest rates, taking into account the principal flows of instruments held in the banking book. The main point of assets and liabilities management is to maximize the risk-return ratio of positions held in the banking ook, takig ito aout the eooi al ue of these assets/liaili ties ad the ip at o atual ad futue ak’s results. The interest rate risk managing on transactions held in the banking book occurs within the governance and hierarchy of decision-making bodies and under a limits structure and alerts approved specifically for these purpose, which is sensitive due to different levels and classes of market risk. The management structure of IRRBB has it os isk poliies ad otols iteded to esue adheee to the ak’s isk appetite. The IRRBB framework has granular management limits for several other risk metrics and consolidated limits for ∆EVE ad ∆NII esults, esides the lii ts assoiated i th stress tests. The asset and liability management unit is responsible for managing timing mismatches between asset and liability flows, and minimizes interest rate risk by through strategies as economic hedge and accounting hedge. All the models associated with IRRBB have a robust independent validation process and are approved by a CTAM (Technical Model Assessment Commission). In addition, all the models and processes are assessed by internal audit. The interest rate risk framework in the banking book uses management measurements that are calculated daily for limit otol. The ∆EVE ad ∆NII e tis ae alulated aodig to the isk appetite lii ts ad the othe isk e tis i tes of management risk limits. In the process of managing interest rate risk of the banking book, transactions subject to automatic options are calculated according to internal market models which split the products, as far as possible, into linear and non-linear payoffs. The linear payoffs are treated similarly to any other instruments without options, and for non-linear payoffs an additional al ue is op uted ad added o the ∆EVE ad ∆NII e tis. In general terms, transactions subject to behavioral options are classified as deposits with no contractual maturity date defined or products subject to early repayment. Non-maturity deposits are classified according to their nature and stability to guarantee compliance with regulatory limits. A survival analysis model treats the products subject to pre- payment, using the historical dataset to calibrate its parameters. The instruments flows with homogeneous characteristics are adjusted by specific models to reflect, in the most appropriate way, the repricing flows of the instruments. The banking book consists of asset and liability transactions originating in different commercial channels (retail and wholesale) of Itaú Unibanco. The market risk exposures inherent in the banking book consists of various risk factors, 13 Itaú Unibanco

Risk and Capital Management – Pillar 3 which are primary components of the market in price formation. IRRBB also includes hedging transactions intended to minimize risks deriving from strong fluctuations of market risk factors and their accounting asymmetries. Market risk generated from structural mismatches is managed by a variety of financial instruments, such as exchange- traded and over-the-counter derivatives. In some cases, operations using derivative financial instruments can be classified as accounting hedges, depending on their risk and cash flow characteristics. In these cases, the supporting documentation is analyzed to enable the effectiveness of the hedge and other changes in the accounting process to be continuously monitored. The accounting and administrative procedures for hedging are defined in BACEN Circular 3,082. The IRRBB model includes a series of premises: • ∆EVE ad ∆NII ae e asued o the asis of the ash flos of the a kig ook istuets, oke do ito their risk factors to isolate the effect of the interest rate and the spread components; • For non-maturity deposits, the models are classified according to their nature and stability and distributed over time considering the regulatory limits; • The institution uses survival analysis models to handle credit transactions subject to prepayment, and empirical models for transactions subject to early redemption; • The medium-term repricing attributed to non-maturity deposits is defined as 1.23 years; • The maximum-term repricing attributed to non-maturity deposits is defined as 33 years. The article 39 of the circular defines the need to pulish ∆EVE ad ∆NII, usig the stadad shok seaios desied i article 11. Itaú Unibanco has opted to an additional disclosure of the metrics above, considering the internal scenarios, because of the understanding that the standard approach shocks and is application are too conservative. The institution understands that is owns internal scenarios, defined by statistical methodologies, which consider the interest rate historical distribution behavior represent in a more appropriate way the potential risk embedded in the interest rates volatility. Additionally, internal model is more adherent with the way Itaú Unibanco manages its own risks. The table below are presented the main results due the change in the interest rates over the banking book in the standardized scenarios, and, also, in the internal scenarios. It is important to note that, following the normative rules, the potential losses are represented by positive values and potential gains by negative values (between parentheses). • Parallel Up: increasing in the short-term and in the long-term interest rates; • Parallel Down: decreasing in the short-term and in the long-term interest rates; • Short-term increase: increasing in the short-term interest rates; • Short-term reduction: decreasing in the short-term interest rates; • Steepener: decreasing in the short-term interest rates and increasing the in the long-term interest rates; • Flattener: increasing in the short-term interest rates and decreasing the in the long-term interest rates; (1) Potential Loss of Instruments Classified in the Banking Book arising from Interest Rate Variation Scenarios (Losses are represented by positive values, while gains are represented by negative values (between parentheses)) R$ million 12/31/2019 09/30/2019 ΔEVE ΔNII ΔEVE ΔNII (2) (3) (2) (3) (2) (3) (2) (3) Standard Internal Standard Internal Standard Internal Standard Internal Scenarios Shocks Shocks Shocks Shocks Shocks Shocks Shocks Shocks Parallel Up 8,903 4,635 450 163 7,410 3,805 (1,657) (912) Parallel Down (11,308) (4,500) (645) (322) (8,558) (3,707) 1,482 651 Short rate Up 7,509 3,766 6,080 2,940 Short rate Down (7,997) (3,488) (6,510) (2,738) Steepener (3,033) (1,388) (2,285) (954) Flattener 4,220 2,019 3,618 1,546 Maximum 8,903 4,635 450 163 7,410 3,805 1,482 651 Tier I 128,696 124,856 (1) Losses in variation measurements are shown as positive values, as per Art. 13 §3º of Circular 3,876. (2) Values are calculated using internal models and standard regulatory shocks, as per Art. 39 §1º II of Circular 3,876. (3) Values are calculated using internal models and shocks , as per Art. 7º of Circular 3,876. 14 Itaú Unibanco Risk and Capital Management – Pillar 3 which are primary components of the market in price formation. IRRBB also includes hedging transactions intended to minimize risks deriving from strong fluctuations of market risk factors and their accounting asymmetries. Market risk generated from structural mismatches is managed by a variety of financial instruments, such as exchange- traded and over-the-counter derivatives. In some cases, operations using derivative financial instruments can be classified as accounting hedges, depending on their risk and cash flow characteristics. In these cases, the supporting documentation is analyzed to enable the effectiveness of the hedge and other changes in the accounting process to be continuously monitored. The accounting and administrative procedures for hedging are defined in BACEN Circular 3,082. The IRRBB model includes a series of premises: • ∆EVE ad ∆NII ae e asued o the asis of the ash flos of the a kig ook istuets, oke do ito their risk factors to isolate the effect of the interest rate and the spread components; • For non-maturity deposits, the models are classified according to their nature and stability and distributed over time considering the regulatory limits; • The institution uses survival analysis models to handle credit transactions subject to prepayment, and empirical models for transactions subject to early redemption; • The medium-term repricing attributed to non-maturity deposits is defined as 1.23 years; • The maximum-term repricing attributed to non-maturity deposits is defined as 33 years. The article 39 of the circular defines the need to pulish ∆EVE ad ∆NII, usig the stadad shok seaios desied i article 11. Itaú Unibanco has opted to an additional disclosure of the metrics above, considering the internal scenarios, because of the understanding that the standard approach shocks and is application are too conservative. The institution understands that is owns internal scenarios, defined by statistical methodologies, which consider the interest rate historical distribution behavior represent in a more appropriate way the potential risk embedded in the interest rates volatility. Additionally, internal model is more adherent with the way Itaú Unibanco manages its own risks. The table below are presented the main results due the change in the interest rates over the banking book in the standardized scenarios, and, also, in the internal scenarios. It is important to note that, following the normative rules, the potential losses are represented by positive values and potential gains by negative values (between parentheses). • Parallel Up: increasing in the short-term and in the long-term interest rates; • Parallel Down: decreasing in the short-term and in the long-term interest rates; • Short-term increase: increasing in the short-term interest rates; • Short-term reduction: decreasing in the short-term interest rates; • Steepener: decreasing in the short-term interest rates and increasing the in the long-term interest rates; • Flattener: increasing in the short-term interest rates and decreasing the in the long-term interest rates; (1) Potential Loss of Instruments Classified in the Banking Book arising from Interest Rate Variation Scenarios (Losses are represented by positive values, while gains are represented by negative values (between parentheses)) R$ million 12/31/2019 09/30/2019 ΔEVE ΔNII ΔEVE ΔNII (2) (3) (2) (3) (2) (3) (2) (3) Standard Internal Standard Internal Standard Internal Standard Internal Scenarios Shocks Shocks Shocks Shocks Shocks Shocks Shocks Shocks Parallel Up 8,903 4,635 450 163 7,410 3,805 (1,657) (912) Parallel Down (11,308) (4,500) (645) (322) (8,558) (3,707) 1,482 651 Short rate Up 7,509 3,766 6,080 2,940 Short rate Down (7,997) (3,488) (6,510) (2,738) Steepener (3,033) (1,388) (2,285) (954) Flattener 4,220 2,019 3,618 1,546 Maximum 8,903 4,635 450 163 7,410 3,805 1,482 651 Tier I 128,696 124,856 (1) Losses in variation measurements are shown as positive values, as per Art. 13 §3º of Circular 3,876. (2) Values are calculated using internal models and standard regulatory shocks, as per Art. 39 §1º II of Circular 3,876. (3) Values are calculated using internal models and shocks , as per Art. 7º of Circular 3,876. 14 Itaú Unibanco

Risk and Capital Management – Pillar 3 The maxiu a iatio of ∆EVE, i th iteal shoks, as R$ , i llios as of De ee , , osideig the Parallel Up Scenario shocks, an increase of 21.8% when compared to September 30, 2019. Fo the outlie test, the a iu a iatio of the ∆EVE, i th standardized shocks was R$ 8,903 million as of December 31, 2019, corresponding to a potential loss of 6.92% of Tier I, which is less than 15% - percentage that defines the institution as outlier (according to Art. 44 of Circular 3,876). The ∆NII, with internal shocks, for a horizon of a year, has maximum loss of R$ 163 million in the Parallel Up Scenario. 15 Itaú Unibanco Risk and Capital Management – Pillar 3 The maxiu a iatio of ∆EVE, i th iteal shoks, as R$ , i llios as of De ee , , osideig the Parallel Up Scenario shocks, an increase of 21.8% when compared to September 30, 2019. Fo the outlie test, the a iu a iatio of the ∆EVE, i th standardized shocks was R$ 8,903 million as of December 31, 2019, corresponding to a potential loss of 6.92% of Tier I, which is less than 15% - percentage that defines the institution as outlier (according to Art. 44 of Circular 3,876). The ∆NII, with internal shocks, for a horizon of a year, has maximum loss of R$ 163 million in the Parallel Up Scenario. 15 Itaú Unibanco

Risk and Capital Management – Pillar 3 2.9 Leverage Ratio The Leverage Ratio is defined as the ratio between Tier I Capital and Total Exposure, calculated according to BACEN Circular 3,748. The ratio is intended to be a simple measure of non-risk-sensitive leverage, and so it does not take into account risk weighs or risk mitigation. As required by BACEN Circular Letter 3,706, Itaú Unibanco has since October 2015 been reporting the Leverage Ratio to st BACEN monthly. As from January 1 , 2018, the Resolution 4,615 was put into force and established minimum requirement at 3% for the Leverage Ratio. The following information is based on the methodology and standard format introduced by BACEN Circular 3,748. Comparative Summary of Published Financial Statements and Leverage Ratio R$ Thousand 12/31/2019 09/30/2019 12/31/2018 1 Total assets according to published financial statements 1,738,713,009 1,738,339,230 1,649,613,394 2 Adjustment for differences in consolidation of accounts (206,207,020) (205,038,525) (193,686,629) 3 Adjustment for assets assigned or transferred with substantial transfer of risks and benefits and recognized (2 ,208,342) (2 ,834,610) (3,531,977) 4 Adjustment for changes in reference values and potential future gains on derivative financial instruments 18,978,183 13,250,188 3,762,182 5 Adjustment for repurchase transactions and securities lending 12,458,242 12,440,751 10,581,273 6 Adjustment for transactions not booked in prudential conglomerate's total assets 1 21,974,309 1 18,915,114 1 11,392,609 7 Other adjustments (137,144,541) (165,900,414) (119,399,124) 8 Total Exposure 1,546,563,840 1,509,171,735 1,458,731,726 Disclosure of information on Leverage Ratio R$ Thousand 12/31/2019 09/30/2019 12/31/2018 Items shown in the Balance Sheet Balance sheet items other than derivative financial instruments, securities received on loan and resales for 1 1,189,661,430 1,127,583,485 1,061,278,745 settlement under repurchase transactions 2 Adjustments for equity items deducted in calculating Level I Capital (3 4,260,362) (3 4,650,350) (3 0,373,825) 3 Total exposure shown in the Balance Sheet 1,155,401,067 1,092,933,136 1,030,904,920 Transactions using Derivative Financial Instruments 4 Replacement value for derivatives transactions 28,149,414 27,618,846 23,838,639 5 Potential future gains from derivatives transactions 13,128,113 10,369,048 5,880,983 6 Adjustment for collateral in derivatives transactions - - - 7 Adjustment for daily margin held as collateral - - - Derivatives in the name of customers where there is no contractual obligation to reimburse in the event of 8 (6 ,080,133) (1 5,028,163) (8 ,126,140) bankruptcy or default of the entities responsible for the settlement system 9 Reference value adjusted for credit derivatives 10,444,041 10,684,670 6,852,704 10 Adjustment of reference value calculated for credit derivatives (706,453) (737,182) (845,365) 11 Total exposure for derivative financial instruments 4 4,934,982 3 2,907,218 2 7,600,821 Repurchase Transactions and Securities Lending (TVM) 12 Investments in repurchase transactions and securities lending 1 96,504,018 2 39,150,129 2 72,924,200 13 Adjustment for repurchases for settlement and creditors of securities lending - - - 14 Amount of counterparty credit risk 12,458,242 12,440,751 10,581,273 15 Amount of counterparty credit risk in transactions as intermediary 15,291,222 12,825,386 5,327,903 16 Total exposure for repurchase transactions and securities lending 2 24,253,482 2 64,416,267 2 88,833,376 Off-balance sheet items 17 Reference value of off-balance sheet transactions 3 75,391,357 3 73,386,012 3 40,901,467 18 Adjustment for application of FCC specific to off-balance sheet transactions (253,417,047) (254,470,898) (229,508,858) 19 Total off-balance sheet exposure 1 21,974,309 1 18,915,114 1 11,392,609 Capital and Total Exposure 20 Level I 1 28,696,398 1 24,856,381 1 31,154,464 21 Total Exposure 1,546,563,840 1,509,171,735 1,458,731,726 Leverage Ratio 22 Basel III Leverage Ratio 8.3% 8.3% 9.0% 16 Itaú Unibanco Risk and Capital Management – Pillar 3 2.9 Leverage Ratio The Leverage Ratio is defined as the ratio between Tier I Capital and Total Exposure, calculated according to BACEN Circular 3,748. The ratio is intended to be a simple measure of non-risk-sensitive leverage, and so it does not take into account risk weighs or risk mitigation. As required by BACEN Circular Letter 3,706, Itaú Unibanco has since October 2015 been reporting the Leverage Ratio to st BACEN monthly. As from January 1 , 2018, the Resolution 4,615 was put into force and established minimum requirement at 3% for the Leverage Ratio. The following information is based on the methodology and standard format introduced by BACEN Circular 3,748. Comparative Summary of Published Financial Statements and Leverage Ratio R$ Thousand 12/31/2019 09/30/2019 12/31/2018 1 Total assets according to published financial statements 1,738,713,009 1,738,339,230 1,649,613,394 2 Adjustment for differences in consolidation of accounts (206,207,020) (205,038,525) (193,686,629) 3 Adjustment for assets assigned or transferred with substantial transfer of risks and benefits and recognized (2 ,208,342) (2 ,834,610) (3,531,977) 4 Adjustment for changes in reference values and potential future gains on derivative financial instruments 18,978,183 13,250,188 3,762,182 5 Adjustment for repurchase transactions and securities lending 12,458,242 12,440,751 10,581,273 6 Adjustment for transactions not booked in prudential conglomerate's total assets 1 21,974,309 1 18,915,114 1 11,392,609 7 Other adjustments (137,144,541) (165,900,414) (119,399,124) 8 Total Exposure 1,546,563,840 1,509,171,735 1,458,731,726 Disclosure of information on Leverage Ratio R$ Thousand 12/31/2019 09/30/2019 12/31/2018 Items shown in the Balance Sheet Balance sheet items other than derivative financial instruments, securities received on loan and resales for 1 1,189,661,430 1,127,583,485 1,061,278,745 settlement under repurchase transactions 2 Adjustments for equity items deducted in calculating Level I Capital (3 4,260,362) (3 4,650,350) (3 0,373,825) 3 Total exposure shown in the Balance Sheet 1,155,401,067 1,092,933,136 1,030,904,920 Transactions using Derivative Financial Instruments 4 Replacement value for derivatives transactions 28,149,414 27,618,846 23,838,639 5 Potential future gains from derivatives transactions 13,128,113 10,369,048 5,880,983 6 Adjustment for collateral in derivatives transactions - - - 7 Adjustment for daily margin held as collateral - - - Derivatives in the name of customers where there is no contractual obligation to reimburse in the event of 8 (6 ,080,133) (1 5,028,163) (8 ,126,140) bankruptcy or default of the entities responsible for the settlement system 9 Reference value adjusted for credit derivatives 10,444,041 10,684,670 6,852,704 10 Adjustment of reference value calculated for credit derivatives (706,453) (737,182) (845,365) 11 Total exposure for derivative financial instruments 4 4,934,982 3 2,907,218 2 7,600,821 Repurchase Transactions and Securities Lending (TVM) 12 Investments in repurchase transactions and securities lending 1 96,504,018 2 39,150,129 2 72,924,200 13 Adjustment for repurchases for settlement and creditors of securities lending - - - 14 Amount of counterparty credit risk 12,458,242 12,440,751 10,581,273 15 Amount of counterparty credit risk in transactions as intermediary 15,291,222 12,825,386 5,327,903 16 Total exposure for repurchase transactions and securities lending 2 24,253,482 2 64,416,267 2 88,833,376 Off-balance sheet items 17 Reference value of off-balance sheet transactions 3 75,391,357 3 73,386,012 3 40,901,467 18 Adjustment for application of FCC specific to off-balance sheet transactions (253,417,047) (254,470,898) (229,508,858) 19 Total off-balance sheet exposure 1 21,974,309 1 18,915,114 1 11,392,609 Capital and Total Exposure 20 Level I 1 28,696,398 1 24,856,381 1 31,154,464 21 Total Exposure 1,546,563,840 1,509,171,735 1,458,731,726 Leverage Ratio 22 Basel III Leverage Ratio 8.3% 8.3% 9.0% 16 Itaú Unibanco

Risk and Capital Management – Pillar 3 3 Balance Sheet and Institutions 3.1 Balance Sheet The following table presents a comparison between the Balance Sheet of Itaú Unibanco Holding S.A. presented in the Financial Statements and of Prudential Consolidation. Cop aiso of alae sheets – Assets R$ million Consolidated (1) (2) Differences Prudential Ref. Appedix I Balanced Sheet Assets 12/31/2019 Current assets and Long-term receivables 1, 702,123 ( 230,566) 1, 471,557 Cash and cash equivalents 30,367 (140) 30,226 Interbank investments 232, 362 ( 1,283) 231, 079 Securities and derivative financial instruments 545, 286 ( 225,255) 320, 031 Interbank accounts 135, 126 - 135, 126 Interbranch accounts 373 - 373 Loan, lease and other credit operations 544, 129 785 544, 914 Other receivables 210, 951 ( 4,591) 206, 360 Tax credit and Actuarial Assets - - 18,569 Tax credits arising from income tax losses and social contribution - - 1,480 (b) Credits resulting from temporary differences - - 16,998 (c) Actuarial assets related to defined benefit pension funds - - 91 (d) Other - - 187,791 Other assets 3,529 ( 82) 3,448 Permanent assets 36,590 24,359 60,949 Investments 15,853 25,094 40,947 Goodwill based on the expectation of future profitability - - 764 (e) investments in the capital of companies that are similar to non-consolidated financial institutions and - - 7,940 (f) insurance companies investments in the capital of financial institutions - - 10,390 (a) Other - - 21,853 Real estate in use 6,412 (508) 5,904 Deferred permanent assets - - - (g) Other - - 5,904 Goodwill 925 ( 94) 831 Goodwill based on the expectation of future profitability - - 831 (e) Intangible assets 13,401 (134) 13,268 Acquisition of rights to credit payroll 1,850 - 1,850 (h)/(i) Other intangible assets 24,026 12,083 36,109 Intangible assets 14,187 (h)/(i) Goodwill based on the expectation of future profitability - - 21,342 (e) Deferred permanent assets - - 456 (g) Other - - 124 (Accumulated amortization) ( 12,475) ( 12,216) ( 24,691) Intangible assets ( 7,696) (h/i) Goodwill based on the expectation of future profitability - - ( 16,539) (e) Deferred permanent assets - - (456) (g) Total assets 1, 738,713 ( 206,207) 1, 532,506 (1) Differences are mainly due to non-consolidation of non financial companies (highlighting the following companies: Insurance, Pension Plan and Premium Bonds) within the Prudential Conglomerate and also by the eliminations of transactions with related parties. (2) Prudential information that is presented in Appedix I of this document. 17 Itaú Unibanco Risk and Capital Management – Pillar 3 3 Balance Sheet and Institutions 3.1 Balance Sheet The following table presents a comparison between the Balance Sheet of Itaú Unibanco Holding S.A. presented in the Financial Statements and of Prudential Consolidation. Cop aiso of alae sheets – Assets R$ million Consolidated (1) (2) Differences Prudential Ref. Appedix I Balanced Sheet Assets 12/31/2019 Current assets and Long-term receivables 1, 702,123 ( 230,566) 1, 471,557 Cash and cash equivalents 30,367 (140) 30,226 Interbank investments 232, 362 ( 1,283) 231, 079 Securities and derivative financial instruments 545, 286 ( 225,255) 320, 031 Interbank accounts 135, 126 - 135, 126 Interbranch accounts 373 - 373 Loan, lease and other credit operations 544, 129 785 544, 914 Other receivables 210, 951 ( 4,591) 206, 360 Tax credit and Actuarial Assets - - 18,569 Tax credits arising from income tax losses and social contribution - - 1,480 (b) Credits resulting from temporary differences - - 16,998 (c) Actuarial assets related to defined benefit pension funds - - 91 (d) Other - - 187,791 Other assets 3,529 ( 82) 3,448 Permanent assets 36,590 24,359 60,949 Investments 15,853 25,094 40,947 Goodwill based on the expectation of future profitability - - 764 (e) investments in the capital of companies that are similar to non-consolidated financial institutions and - - 7,940 (f) insurance companies investments in the capital of financial institutions - - 10,390 (a) Other - - 21,853 Real estate in use 6,412 (508) 5,904 Deferred permanent assets - - - (g) Other - - 5,904 Goodwill 925 ( 94) 831 Goodwill based on the expectation of future profitability - - 831 (e) Intangible assets 13,401 (134) 13,268 Acquisition of rights to credit payroll 1,850 - 1,850 (h)/(i) Other intangible assets 24,026 12,083 36,109 Intangible assets 14,187 (h)/(i) Goodwill based on the expectation of future profitability - - 21,342 (e) Deferred permanent assets - - 456 (g) Other - - 124 (Accumulated amortization) ( 12,475) ( 12,216) ( 24,691) Intangible assets ( 7,696) (h/i) Goodwill based on the expectation of future profitability - - ( 16,539) (e) Deferred permanent assets - - (456) (g) Total assets 1, 738,713 ( 206,207) 1, 532,506 (1) Differences are mainly due to non-consolidation of non financial companies (highlighting the following companies: Insurance, Pension Plan and Premium Bonds) within the Prudential Conglomerate and also by the eliminations of transactions with related parties. (2) Prudential information that is presented in Appedix I of this document. 17 Itaú Unibanco

Risk and Capital Management – Pillar 3 Cop aiso of alae sheets – Liailities R$ million Consolidated (1) (2) Prudential Differences Ref. Appedix I Balanced Sheet Liabilities 12/31/2019 Current and Long-term Liabilities 1, 593,167 ( 206,725) 1, 386,442 Deposits 507, 060 11,622 518, 682 Deposits received under securities repurchase agreements 269, 838 410 270, 248 Funds from acceptances and issuance of securities 143, 569 - 143, 569 Interbank accounts 48,771 - 48,771 Interbranch accounts 5,410 2 5,412 Borrowings and onlending 76,393 - 76,392 Derivative financial instruments 47,815 ( 17) 47,798 Technical provision for insurance, pension plan and capitalization 220, 666 ( 220,666) - Other liabilities 273, 647 1,924 275, 571 Social and statutory 18,705 (2,808) 15,897 Tax credits arising from income tax losses and social contribution - - 4,991 (b)/(c) Provision of Actuarial assets related to defined benefit pension funds - - 291 (d) Other - - 10,614 Other - - 259,674 Deferred income 2,698 10 2,708 Non-controlling interest in subsidiaries 10,861 250 11,110 Non-controlling interest in subsidiaries that are part of the conglomerate - - 11,110 (j) Stockholders' equity 131, 987 258 132, 246 Capital 97,148 - 97,148 Eligible Instruments - - 97,148 (k) Capital reserves 1,979 - 1,979 Capital reserves - - 1,979 (m) Revenue reserves 36,569 (996) 35,573 Revenue reserves - - 35,573 (l) Asset valuation adjustment ( 2,434) 1,254 ( 1,180) Other revenue and other reserve - - ( 1,180) (m) (Treasury shares) ( 1,274) - ( 1,274) Shares or other instruments issued by the bank - - ( 1,274) (n) Total liabilities and stockholders' equity 1, 738,713 ( 206,207) 1, 532,506 (1) Differences are mainly due to non-consolidation of non financial companies (highlighting the following companies: Insurance, Pension Plan and Premium Bonds) within the Prudencial Conglomerate and also by the eliminations of transactions with related parties. (2) Prudential information that is presented in Appedix I of this document. 18 Itaú Unibanco Risk and Capital Management – Pillar 3 Cop aiso of alae sheets – Liailities R$ million Consolidated (1) (2) Prudential Differences Ref. Appedix I Balanced Sheet Liabilities 12/31/2019 Current and Long-term Liabilities 1, 593,167 ( 206,725) 1, 386,442 Deposits 507, 060 11,622 518, 682 Deposits received under securities repurchase agreements 269, 838 410 270, 248 Funds from acceptances and issuance of securities 143, 569 - 143, 569 Interbank accounts 48,771 - 48,771 Interbranch accounts 5,410 2 5,412 Borrowings and onlending 76,393 - 76,392 Derivative financial instruments 47,815 ( 17) 47,798 Technical provision for insurance, pension plan and capitalization 220, 666 ( 220,666) - Other liabilities 273, 647 1,924 275, 571 Social and statutory 18,705 (2,808) 15,897 Tax credits arising from income tax losses and social contribution - - 4,991 (b)/(c) Provision of Actuarial assets related to defined benefit pension funds - - 291 (d) Other - - 10,614 Other - - 259,674 Deferred income 2,698 10 2,708 Non-controlling interest in subsidiaries 10,861 250 11,110 Non-controlling interest in subsidiaries that are part of the conglomerate - - 11,110 (j) Stockholders' equity 131, 987 258 132, 246 Capital 97,148 - 97,148 Eligible Instruments - - 97,148 (k) Capital reserves 1,979 - 1,979 Capital reserves - - 1,979 (m) Revenue reserves 36,569 (996) 35,573 Revenue reserves - - 35,573 (l) Asset valuation adjustment ( 2,434) 1,254 ( 1,180) Other revenue and other reserve - - ( 1,180) (m) (Treasury shares) ( 1,274) - ( 1,274) Shares or other instruments issued by the bank - - ( 1,274) (n) Total liabilities and stockholders' equity 1, 738,713 ( 206,207) 1, 532,506 (1) Differences are mainly due to non-consolidation of non financial companies (highlighting the following companies: Insurance, Pension Plan and Premium Bonds) within the Prudencial Conglomerate and also by the eliminations of transactions with related parties. (2) Prudential information that is presented in Appedix I of this document. 18 Itaú Unibanco

Risk and Capital Management – Pillar 3 3.2 Institutions that comprise the Financial Statements of Itaú Unibanco Holding The lists below provide the institutions that comprise the financial statements and the Prudential Consolidation of Itaú Unibanco Holding S.A.. Institutions that comprise the Financial Statements of Itaú Unibanco Holding (1) (2) Institutions that comprise the financial statements and the Prudential Consolidation Country % Equity share in capital Aj Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI Brazil 97.96% Banco Investcred Unibanco S.A. Brazil 50.00% Banco Itaú (Suisse) SA Switzerland 100.00% Banco Itaú Argentina S.A. Argentina 100.00% Banco Itaú BBA S.A. Brazil 100.00% Banco Itaú Consignado S.A. Brazil 100.00% Banco Itaú International United States 100.00% Banco Itaú Paraguay S.A. Paraguay 100.00% Banco Itaú Uruguay S.A. Uruguay 100.00% Banco Itaú Veículos S.A. Brazil 100.00% Banco ItauBank S.A. Brazil 100.00% Banco Itaucard S.A. Brazil 100.00% Banco Itauleasing S.A. Brazil 100.00% CorpBanca New York Branch United States 38.14% Dibens Leasing S.A. - Arrendamento Mercantil Brazil 100.00% FIDC NP América Multicarteira Brazil 100.00% Fideicomisos Financiero Privados BHSA Argentina 100.00% Financeira Itaú CBD S.A. Crédito, Financiamento e Investimento Brazil 50.00% Fundo De Invest Dir Creditórios Não Padron NPL II Brazil 100.00% Fundo de Investimento em Direitos Creditórios Não-Padronizados Barzel Brazil 100.00% Fundo Fortaleza de Investimento Imobiliário Brazil 100.00% Hipercard Banco Múltiplo S.A. Brazil 100.00% Intrag Distribuidora de Títulos e Valores Mobiliários Ltda. Brazil 100.00% Iresolve Companhia Securitizadora de Créditos Financeiros S.A. Brazil 100.00% Itaú (Panamá) S.A. Panama 33.22% Itaú Administradora de Consórcios Ltda. Brazil 100.00% Itaú Asset Management Colombia S.A. Sociedad Fiduciaria Colombia 33.21% Itaú Bank & Trust Bahamas Ltd. Bahamas 100.00% Itaú Bank & Trust Cayman Ltd. Cayman Islands 100.00% Itau Bank, Ltd. Cayman Islands 100.00% Itau BBA International Plc United Kingdom 100.00% Itau BBA USA Securities Inc. United States 100.00% Itaú Casa de Valores S.A. Panama 33.32% Itaú Cia. Securitizadora de Créditos Financeiros Brazil 100.00% Itaú Comisionista de Bolsa Colombia S.A. Colombia 33.32% Itaú Corpbanca Chile 38.14% Itaú CorpBanca Colombia S.A. Colombia 33.22% Itaú Corredores de Bolsa Limitada Chile 38.14% Itaú Corretora de Valores S.A. Brazil 100.00% Itaú Distribuidora de Títulos e Valores Mobiliários S.A. Brazil 100.00% Itaú EU Lux-Itaú Latin America Equity Fund Luxembourg 68.62% Itaú International Securities Inc. United States 100.00% Itaú Kinea Private Equity Multimercado Fundo de Investimento em Cotas de Fundos de Investimento Crédito Privado Brazil 100.00% Itau Middle East Limited United Arab Emirates 100.00% Itaú Securities Services Colombia S.A. Sociedad Fiduciaria Colombia 33.49% Itaú Unibanco Holding S.A. Brazil 100.00% Itaú Unibanco Holding S.A., Grand Cayman Branch Cayman Islands 100.00% Itaú Unibanco S.A. Brazil 100.00% Itaú Unibanco S.A. - Tokyo Branch Japan 100.00% Itaú Unibanco S.A. - Nassau Branch Bahamas 100.00% Itaú Unibanco S.A. Grand Cayman Branch Cayman Islands 100.00% Itaú Unibanco S.A. New York Branch United States 100.00% Itaú Unibanco Veículos Administradora de Consórcios Ltda. Brazil 100.00% Itaú Valores S.A. Argentina 100.00% Itauvest Distribuidora de Títulos e Val. Mobiliários S.A. Brazil 100.00% ITB Holding Ltd. Cayman Islands 100.00% Kinea Ações Fundo de Investimento em Ações Brazil 100.00% Kinea Ações Fundo de Investimento em Cotas de Fundos de Investimento em Ações Brazil 98.68% Kinea CO-investimento Fundo de Investimento Imobiliario Brazil 99.33% Kinea I Private Equity FIP Multiestrategia Brazil 100.00% Kinea I Total Return Equity - Fundo de Investimento em Cotas de Fundos de Investimento Multimercado Brazil 100.00% Kinea II Macro Fundo de Investimento Multimercado Crédito Privado Brazil 100.00% Licania Fund Limited Cayman Islands 100.00% Luizacred S.A. Sociedade de Crédito, Financiamento e Investimento Brazil 50.00% MCC S.A. Corredores de Bolsa Chile 100.00% Microinvest S.A. Soc. de Crédito a Microempreendedor Brazil 100.00% (1) As of December 2019, the funds Crédito Universitário FIDC I and Crédito Universitário FIDC II were consolidated in the Itaú Unibanco Holding S.A Prudential Conglomerate. (2) The institutions operate in their respective countries of origin. 19 Itaú Unibanco Risk and Capital Management – Pillar 3 3.2 Institutions that comprise the Financial Statements of Itaú Unibanco Holding The lists below provide the institutions that comprise the financial statements and the Prudential Consolidation of Itaú Unibanco Holding S.A.. Institutions that comprise the Financial Statements of Itaú Unibanco Holding (1) (2) Institutions that comprise the financial statements and the Prudential Consolidation Country % Equity share in capital Aj Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI Brazil 97.96% Banco Investcred Unibanco S.A. Brazil 50.00% Banco Itaú (Suisse) SA Switzerland 100.00% Banco Itaú Argentina S.A. Argentina 100.00% Banco Itaú BBA S.A. Brazil 100.00% Banco Itaú Consignado S.A. Brazil 100.00% Banco Itaú International United States 100.00% Banco Itaú Paraguay S.A. Paraguay 100.00% Banco Itaú Uruguay S.A. Uruguay 100.00% Banco Itaú Veículos S.A. Brazil 100.00% Banco ItauBank S.A. Brazil 100.00% Banco Itaucard S.A. Brazil 100.00% Banco Itauleasing S.A. Brazil 100.00% CorpBanca New York Branch United States 38.14% Dibens Leasing S.A. - Arrendamento Mercantil Brazil 100.00% FIDC NP América Multicarteira Brazil 100.00% Fideicomisos Financiero Privados BHSA Argentina 100.00% Financeira Itaú CBD S.A. Crédito, Financiamento e Investimento Brazil 50.00% Fundo De Invest Dir Creditórios Não Padron NPL II Brazil 100.00% Fundo de Investimento em Direitos Creditórios Não-Padronizados Barzel Brazil 100.00% Fundo Fortaleza de Investimento Imobiliário Brazil 100.00% Hipercard Banco Múltiplo S.A. Brazil 100.00% Intrag Distribuidora de Títulos e Valores Mobiliários Ltda. Brazil 100.00% Iresolve Companhia Securitizadora de Créditos Financeiros S.A. Brazil 100.00% Itaú (Panamá) S.A. Panama 33.22% Itaú Administradora de Consórcios Ltda. Brazil 100.00% Itaú Asset Management Colombia S.A. Sociedad Fiduciaria Colombia 33.21% Itaú Bank & Trust Bahamas Ltd. Bahamas 100.00% Itaú Bank & Trust Cayman Ltd. Cayman Islands 100.00% Itau Bank, Ltd. Cayman Islands 100.00% Itau BBA International Plc United Kingdom 100.00% Itau BBA USA Securities Inc. United States 100.00% Itaú Casa de Valores S.A. Panama 33.32% Itaú Cia. Securitizadora de Créditos Financeiros Brazil 100.00% Itaú Comisionista de Bolsa Colombia S.A. Colombia 33.32% Itaú Corpbanca Chile 38.14% Itaú CorpBanca Colombia S.A. Colombia 33.22% Itaú Corredores de Bolsa Limitada Chile 38.14% Itaú Corretora de Valores S.A. Brazil 100.00% Itaú Distribuidora de Títulos e Valores Mobiliários S.A. Brazil 100.00% Itaú EU Lux-Itaú Latin America Equity Fund Luxembourg 68.62% Itaú International Securities Inc. United States 100.00% Itaú Kinea Private Equity Multimercado Fundo de Investimento em Cotas de Fundos de Investimento Crédito Privado Brazil 100.00% Itau Middle East Limited United Arab Emirates 100.00% Itaú Securities Services Colombia S.A. Sociedad Fiduciaria Colombia 33.49% Itaú Unibanco Holding S.A. Brazil 100.00% Itaú Unibanco Holding S.A., Grand Cayman Branch Cayman Islands 100.00% Itaú Unibanco S.A. Brazil 100.00% Itaú Unibanco S.A. - Tokyo Branch Japan 100.00% Itaú Unibanco S.A. - Nassau Branch Bahamas 100.00% Itaú Unibanco S.A. Grand Cayman Branch Cayman Islands 100.00% Itaú Unibanco S.A. New York Branch United States 100.00% Itaú Unibanco Veículos Administradora de Consórcios Ltda. Brazil 100.00% Itaú Valores S.A. Argentina 100.00% Itauvest Distribuidora de Títulos e Val. Mobiliários S.A. Brazil 100.00% ITB Holding Ltd. Cayman Islands 100.00% Kinea Ações Fundo de Investimento em Ações Brazil 100.00% Kinea Ações Fundo de Investimento em Cotas de Fundos de Investimento em Ações Brazil 98.68% Kinea CO-investimento Fundo de Investimento Imobiliario Brazil 99.33% Kinea I Private Equity FIP Multiestrategia Brazil 100.00% Kinea I Total Return Equity - Fundo de Investimento em Cotas de Fundos de Investimento Multimercado Brazil 100.00% Kinea II Macro Fundo de Investimento Multimercado Crédito Privado Brazil 100.00% Licania Fund Limited Cayman Islands 100.00% Luizacred S.A. Sociedade de Crédito, Financiamento e Investimento Brazil 50.00% MCC S.A. Corredores de Bolsa Chile 100.00% Microinvest S.A. Soc. de Crédito a Microempreendedor Brazil 100.00% (1) As of December 2019, the funds Crédito Universitário FIDC I and Crédito Universitário FIDC II were consolidated in the Itaú Unibanco Holding S.A Prudential Conglomerate. (2) The institutions operate in their respective countries of origin. 19 Itaú Unibanco

Risk and Capital Management – Pillar 3 Institutions that comprise the Financial Statements of Itaú Unibanco Holding (1) (2) Institutions that comprise the financial statements and the Prudential Consolidation Country % Equity share in capital OCA S.A. Uruguay 100.00% Oiti Fundo de Investimento Multimercado Crédito Privado Investimento no Exterior Brazil 100.00% RedeCard S.A. Brazil 100.00% Rt Itaú Dj Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI Brazil 100.00% RT Scala Renda Fixa - Fundo de Investimento em Cotas de Fundos de Investimento Brazil 100.00% Rt Voyager Renda Fixa Crédito Privado - Fundo de Investimento Brazil 100.00% Universo FIP Multiestratégia Brazil 100.00% (1) As of December 2019, the funds Crédito Universitário FIDC I and Crédito Universitário FIDC II were consolidated in the Itaú Unibanco Holding S.A Prudential Conglomerate. (2) The institutions operate in their respective countries of origin. Institutions that comprise the Financial Statements of Itaú Unibanco Holding (1) Institutions that comprise only the Financial Statements Country % Equity share on capital AJ II Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI Brazil 57.95% Albarus S.A. Paraguay 100.00% BICSA Holdings, Ltd. Cayman Islands 100.00% Borsen Renda Fixa Crédito Privado - Fundo de Investimento Brazil 100.00% CGB II SPA Chile 100.00% CGB III SPA Chile 100.00% Cia. Itaú de Capitalização Brazil 100.00% Estrel Serviços Administrativos S.A. Brazil 100.00% FC Recovery S.A. Argentina 96.00% FIC Promotora de Vendas Ltda. Brazil 50.00% iCarros Ltda. Brazil 100.00% IGA Participações S.A. Brazil 100.00% Investimentos Bemge S.A. Brazil 86.81% Itaú Administração Previdenciária Ltda. Brazil 100.00% Itaú Administradora General de Fondos S.A. Chile 38.14% Itaú Asesorías Financieras Limitada Chile 38.14% Itau Asia Limited Hong Kong 100.00% Itau Asset Management S.A. Sociedad Gerente de Fondos Comunes de Inversión Argentina 100.00% Itau Bahamas Directors Ltd. Bahamas 100.00% Itau Bahamas Nominees Ltd. Bahamas 100.00% Itaú BBA Colombia S.A. Corporación Financiera Colombia 100.00% Itaú BBA Europe S.A. Portugal 100.00% Itau BBA International (Cayman) Ltd. Cayman Islands 100.00% Itaú BBA México, S.A. de C.V. Mexico 100.00% Itaú BBA Trading S.A. Brazil 100.00% Itaú Chile Compañía de Seguros de Vida S.A. Chile 100.00% Itaú Chile Inversiones, Servicios y Administracion S.A. Chile 100.00% Itaú Consultoria de Valores Mobiliários e Participações S.A. Brazil 100.00% Itaú Corredor de Seguros Colombia S.A. Colombia 30.50% Itaú Corredores de Seguros S.A. Chile 38.14% Itaú Corretora de Seguros S.A. Brazil 100.00% Itaú Europa Luxembourg S.A. Luxembourg 100.00% Itaú Gestão de Vendas Ltda. Brazil 100.00% Itaú Institucional Renda Fixa Curto Prazo Fundo de Investimento Brazil 100.00% Itau International Holding Limited United Kingdom 100.00% Itaú Middle East United Arab Emirates 100.00% Itaú Participação Ltda. Brazil 100.00% Itaú Rent Administração e Participações Ltda. Brazil 100.00% Itaú Seguros S.A. Brazil 100.00% Itau USA Asset Management Inc. United States 100.00% Itaú Vida e Previdência S.A. Brazil 100.00% Itauseg Participações S.A. Brazil 100.00% Itauseg Saúde S.A. Brazil 100.00% ITAUSEG Seguradora S.A. Brazil 100.00% ITB Holding Brasil Participações Ltda. Brazil 100.00% Itrust Servicios Inmobiliarios S.A.I.C. Argentina 100.00% IU Corretora de Seguros Ltda. Brazil 100.00% Karen International Limited Bahamas 100.00% Kinea Investimentos Ltda. Brazil 80.00% (1) The institutions operate in their respective countries of origin. 20 Itaú Unibanco Risk and Capital Management – Pillar 3 Institutions that comprise the Financial Statements of Itaú Unibanco Holding (1) (2) Institutions that comprise the financial statements and the Prudential Consolidation Country % Equity share in capital OCA S.A. Uruguay 100.00% Oiti Fundo de Investimento Multimercado Crédito Privado Investimento no Exterior Brazil 100.00% RedeCard S.A. Brazil 100.00% Rt Itaú Dj Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI Brazil 100.00% RT Scala Renda Fixa - Fundo de Investimento em Cotas de Fundos de Investimento Brazil 100.00% Rt Voyager Renda Fixa Crédito Privado - Fundo de Investimento Brazil 100.00% Universo FIP Multiestratégia Brazil 100.00% (1) As of December 2019, the funds Crédito Universitário FIDC I and Crédito Universitário FIDC II were consolidated in the Itaú Unibanco Holding S.A Prudential Conglomerate. (2) The institutions operate in their respective countries of origin. Institutions that comprise the Financial Statements of Itaú Unibanco Holding (1) Institutions that comprise only the Financial Statements Country % Equity share on capital AJ II Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI Brazil 57.95% Albarus S.A. Paraguay 100.00% BICSA Holdings, Ltd. Cayman Islands 100.00% Borsen Renda Fixa Crédito Privado - Fundo de Investimento Brazil 100.00% CGB II SPA Chile 100.00% CGB III SPA Chile 100.00% Cia. Itaú de Capitalização Brazil 100.00% Estrel Serviços Administrativos S.A. Brazil 100.00% FC Recovery S.A. Argentina 96.00% FIC Promotora de Vendas Ltda. Brazil 50.00% iCarros Ltda. Brazil 100.00% IGA Participações S.A. Brazil 100.00% Investimentos Bemge S.A. Brazil 86.81% Itaú Administração Previdenciária Ltda. Brazil 100.00% Itaú Administradora General de Fondos S.A. Chile 38.14% Itaú Asesorías Financieras Limitada Chile 38.14% Itau Asia Limited Hong Kong 100.00% Itau Asset Management S.A. Sociedad Gerente de Fondos Comunes de Inversión Argentina 100.00% Itau Bahamas Directors Ltd. Bahamas 100.00% Itau Bahamas Nominees Ltd. Bahamas 100.00% Itaú BBA Colombia S.A. Corporación Financiera Colombia 100.00% Itaú BBA Europe S.A. Portugal 100.00% Itau BBA International (Cayman) Ltd. Cayman Islands 100.00% Itaú BBA México, S.A. de C.V. Mexico 100.00% Itaú BBA Trading S.A. Brazil 100.00% Itaú Chile Compañía de Seguros de Vida S.A. Chile 100.00% Itaú Chile Inversiones, Servicios y Administracion S.A. Chile 100.00% Itaú Consultoria de Valores Mobiliários e Participações S.A. Brazil 100.00% Itaú Corredor de Seguros Colombia S.A. Colombia 30.50% Itaú Corredores de Seguros S.A. Chile 38.14% Itaú Corretora de Seguros S.A. Brazil 100.00% Itaú Europa Luxembourg S.A. Luxembourg 100.00% Itaú Gestão de Vendas Ltda. Brazil 100.00% Itaú Institucional Renda Fixa Curto Prazo Fundo de Investimento Brazil 100.00% Itau International Holding Limited United Kingdom 100.00% Itaú Middle East United Arab Emirates 100.00% Itaú Participação Ltda. Brazil 100.00% Itaú Rent Administração e Participações Ltda. Brazil 100.00% Itaú Seguros S.A. Brazil 100.00% Itau USA Asset Management Inc. United States 100.00% Itaú Vida e Previdência S.A. Brazil 100.00% Itauseg Participações S.A. Brazil 100.00% Itauseg Saúde S.A. Brazil 100.00% ITAUSEG Seguradora S.A. Brazil 100.00% ITB Holding Brasil Participações Ltda. Brazil 100.00% Itrust Servicios Inmobiliarios S.A.I.C. Argentina 100.00% IU Corretora de Seguros Ltda. Brazil 100.00% Karen International Limited Bahamas 100.00% Kinea Investimentos Ltda. Brazil 80.00% (1) The institutions operate in their respective countries of origin. 20 Itaú Unibanco

Risk and Capital Management – Pillar 3 Institutions that comprise the Financial Statements of Itaú Unibanco Holding (1) Institutions that comprise only the Financial Statements % Equity share on capital Country Maxipago Serviços de Internet Ltda. Brazil 100.00% MCC Asesorías Limitada Chile 100.00% MCC Securities Inc. Cayman Islands 100.00% Mundostar S.A. Uruguay 100.00% Nevada Woods S.A. Uruguay 100.00% Proserv - Promociones y Servicios, S.A. de C.V. Mexico 100.00% Provar Negócios de Varejo Ltda. Brazil 100.00% Recaudaciones y Cobranzas Limitada Chile 38.14% Recovery do Brasil Consultoria S.A. Brazil 96.00% RT Alm 5 Fundo de Investimento Renda Fixa Brazil 100.00% RT Alm Soberano 2 Fundo de Investimento Renda Fixa Brazil 100.00% Rt Defiant Multimercado - Fundo de Investimento Brazil 100.00% Rt Endeavour Renda Fixa Crédito Privado - Fundo de Investimento Brazil 100.00% Rt Multigestor 4 Fundo de Investimento em Cotas De Fundos de Investimento Multimercado Brazil 100.00% RT Nation Renda Fixa - Fundo de Investimento Brazil 100.00% Rt Valiant Renda Fixa - Fundo de Investimento Brazil 100.00% SAGA II SPA Chile 100.00% SAGA III SPA Chile 100.00% Topaz Holding Ltd. Cayman Islands 100.00% Tulipa S.A. Brazil 100.00% Uni-Investment International Corporation Cayman Islands 100.00% Unión Capital AFAP S.A. Uruguay 100.00% (1) The institutions operate in their respective countries of origin. Non Consolidated Institutions (1) Non consolidated Institutions Country % Equity share on capital BSF Holding S.A. Brazil 49.00% Compañia Uruguaya de Medios de Procesamiento S.A. Uruguay 31.93% Conectcar Soluções de Mobilidade Eletrônica S.A. Brazil 50.00% Gestora de Inteligência de Crédito S.A. Brazil 20.00% IRB- Brasil Resseguros S.A. Brazil 11.20% Kinea Private Equity Investimentos S.A. Brazil 80.00% Olímpia Promoção e Serviços S.A. Brazil 50.00% Porto Seguro Itaú Unibanco Participações S.A. Brazil 42.93% Pravaler S.A. Brazil 52.67% Rias Redbanc S.A Uruguay 25.00% Tecnologia Bancária S.A. Brazil 28.95% XP Inc. Cayman Islands 46.05% (1) The institutions operate in their respective countries of origin. Material entities Total assets, stockholdes’ euit, country and the industries of the material entities, including those subject to the risk weight for the purpose of capital requirements are as follows: Major Institutions R$ million 12/31/2019 09/30/2019 12/31/2018 Institutions Country Activity Total Assets Equity Total Assets Equity Total Assets Equity (1) Banco Itaú Argentina S.A. Argentina Financial institution 5,203 701 5,551 654 6,339 597 (1) Banco Itaú BBA S.A. Brazil Financial institution 3,826 2,926 3,213 2,793 2,786 2,209 (1) Banco Itaú Consignado S.A. Brazil Financial institution 28,359 2,355 28,674 2,287 28,872 2,145 (1) Financial institution 12,701 1,476 12,769 1,392 12,893 1,463 Banco Itaú Paraguay S.A. Paraguay (1) Financial institution 4,784 868 5,894 853 6,975 762 Banco Itaú (Suisse) SA Switzerland (1) Financial institution 18,705 1,835 19,326 2,061 17,066 1,672 Banco Itaú Uruguay S.A. Uruguay (1) Financial institution 117,729 11,242 107,462 10,920 99,639 9,332 Banco Itaucard S.A. Brazil (1) Financial institution 12,510 12,275 12,414 12,191 11,967 11,589 Banco Itauleasing S.A. Brazil Cia. Itaú de Capitalização Brazil Premium Bonds 4,057 315 4,765 841 4,585 782 (1) Dibens Leasing S.A. - Arrendamento Mercantil Brazil Leasing 12,525 5,058 15,160 5,028 32,369 5,309 (1) Consumer Finance Credit 7,045 1,034 6,726 1,039 5,986 838 Financeira Itaú CBD S.A. Crédito, Financiamento e Investimento Brazil (1) Financial institution 16,765 4,675 15,778 4,574 17,684 4,407 Hipercard Banco Múltiplo S.A. Brazil (1) Financial institution 9,766 4,941 10,648 5,010 9,862 4,371 Itau Bank, Ltd. Cayman Islands (1) Financial institution 30,619 5,225 32,427 5,310 32,946 4,665 Itau BBA International plc United Kingdom (1) Itau BBA USA Securities Inc. United States Broker 2,185 1,961 2,206 1,989 2,009 1,856 Itauseg Seguradora S.A. Brazil Insurance 96 79 95 78 93 76 (1) Financial institution 147,035 15,788 152,249 16,945 128,579 16,567 Itaú CorpBanca Chile (1) Financial institution 34,791 4,294 33,919 4,230 36,865 4,018 Itaú Corpbanca Colombia S.A. Colombia (1) Itaú Corretora de Valores S.A. Brazil Broker 11,806 1,513 8,651 1,488 3,856 1,262 Itaú Seguros S.A. Brazil Insurance 5,754 1,389 6,806 2,457 6,572 2,062 (1) Financial institution 1,227,382 87,494 1,239,445 83,839 1,230,424 87,200 Itaú Unibanco S.A. Brazil Itaú Vida e Previdência S.A. Brazil Pension Plan 218,739 3,589 213,781 3,520 200,175 2,610 (1) Consumer Finance Credit 11,208 892 10,360 888 8,323 809 Luizacred S.A. Sociedade de Crédito, Financiamento e Investimento Brazil (1) RedeCard S.A. Brazil Acquirer 71,515 17,127 63,817 17,266 68,624 16,403 (1) Institutions included in the Prudential Conglomerate. 21 Itaú Unibanco Risk and Capital Management – Pillar 3 Institutions that comprise the Financial Statements of Itaú Unibanco Holding (1) Institutions that comprise only the Financial Statements % Equity share on capital Country Maxipago Serviços de Internet Ltda. Brazil 100.00% MCC Asesorías Limitada Chile 100.00% MCC Securities Inc. Cayman Islands 100.00% Mundostar S.A. Uruguay 100.00% Nevada Woods S.A. Uruguay 100.00% Proserv - Promociones y Servicios, S.A. de C.V. Mexico 100.00% Provar Negócios de Varejo Ltda. Brazil 100.00% Recaudaciones y Cobranzas Limitada Chile 38.14% Recovery do Brasil Consultoria S.A. Brazil 96.00% RT Alm 5 Fundo de Investimento Renda Fixa Brazil 100.00% RT Alm Soberano 2 Fundo de Investimento Renda Fixa Brazil 100.00% Rt Defiant Multimercado - Fundo de Investimento Brazil 100.00% Rt Endeavour Renda Fixa Crédito Privado - Fundo de Investimento Brazil 100.00% Rt Multigestor 4 Fundo de Investimento em Cotas De Fundos de Investimento Multimercado Brazil 100.00% RT Nation Renda Fixa - Fundo de Investimento Brazil 100.00% Rt Valiant Renda Fixa - Fundo de Investimento Brazil 100.00% SAGA II SPA Chile 100.00% SAGA III SPA Chile 100.00% Topaz Holding Ltd. Cayman Islands 100.00% Tulipa S.A. Brazil 100.00% Uni-Investment International Corporation Cayman Islands 100.00% Unión Capital AFAP S.A. Uruguay 100.00% (1) The institutions operate in their respective countries of origin. Non Consolidated Institutions (1) Non consolidated Institutions Country % Equity share on capital BSF Holding S.A. Brazil 49.00% Compañia Uruguaya de Medios de Procesamiento S.A. Uruguay 31.93% Conectcar Soluções de Mobilidade Eletrônica S.A. Brazil 50.00% Gestora de Inteligência de Crédito S.A. Brazil 20.00% IRB- Brasil Resseguros S.A. Brazil 11.20% Kinea Private Equity Investimentos S.A. Brazil 80.00% Olímpia Promoção e Serviços S.A. Brazil 50.00% Porto Seguro Itaú Unibanco Participações S.A. Brazil 42.93% Pravaler S.A. Brazil 52.67% Rias Redbanc S.A Uruguay 25.00% Tecnologia Bancária S.A. Brazil 28.95% XP Inc. Cayman Islands 46.05% (1) The institutions operate in their respective countries of origin. Material entities Total assets, stockholdes’ euit, country and the industries of the material entities, including those subject to the risk weight for the purpose of capital requirements are as follows: Major Institutions R$ million 12/31/2019 09/30/2019 12/31/2018 Institutions Country Activity Total Assets Equity Total Assets Equity Total Assets Equity (1) Banco Itaú Argentina S.A. Argentina Financial institution 5,203 701 5,551 654 6,339 597 (1) Banco Itaú BBA S.A. Brazil Financial institution 3,826 2,926 3,213 2,793 2,786 2,209 (1) Banco Itaú Consignado S.A. Brazil Financial institution 28,359 2,355 28,674 2,287 28,872 2,145 (1) Financial institution 12,701 1,476 12,769 1,392 12,893 1,463 Banco Itaú Paraguay S.A. Paraguay (1) Financial institution 4,784 868 5,894 853 6,975 762 Banco Itaú (Suisse) SA Switzerland (1) Financial institution 18,705 1,835 19,326 2,061 17,066 1,672 Banco Itaú Uruguay S.A. Uruguay (1) Financial institution 117,729 11,242 107,462 10,920 99,639 9,332 Banco Itaucard S.A. Brazil (1) Financial institution 12,510 12,275 12,414 12,191 11,967 11,589 Banco Itauleasing S.A. Brazil Cia. Itaú de Capitalização Brazil Premium Bonds 4,057 315 4,765 841 4,585 782 (1) Dibens Leasing S.A. - Arrendamento Mercantil Brazil Leasing 12,525 5,058 15,160 5,028 32,369 5,309 (1) Consumer Finance Credit 7,045 1,034 6,726 1,039 5,986 838 Financeira Itaú CBD S.A. Crédito, Financiamento e Investimento Brazil (1) Financial institution 16,765 4,675 15,778 4,574 17,684 4,407 Hipercard Banco Múltiplo S.A. Brazil (1) Financial institution 9,766 4,941 10,648 5,010 9,862 4,371 Itau Bank, Ltd. Cayman Islands (1) Financial institution 30,619 5,225 32,427 5,310 32,946 4,665 Itau BBA International plc United Kingdom (1) Itau BBA USA Securities Inc. United States Broker 2,185 1,961 2,206 1,989 2,009 1,856 Itauseg Seguradora S.A. Brazil Insurance 96 79 95 78 93 76 (1) Financial institution 147,035 15,788 152,249 16,945 128,579 16,567 Itaú CorpBanca Chile (1) Financial institution 34,791 4,294 33,919 4,230 36,865 4,018 Itaú Corpbanca Colombia S.A. Colombia (1) Itaú Corretora de Valores S.A. Brazil Broker 11,806 1,513 8,651 1,488 3,856 1,262 Itaú Seguros S.A. Brazil Insurance 5,754 1,389 6,806 2,457 6,572 2,062 (1) Financial institution 1,227,382 87,494 1,239,445 83,839 1,230,424 87,200 Itaú Unibanco S.A. Brazil Itaú Vida e Previdência S.A. Brazil Pension Plan 218,739 3,589 213,781 3,520 200,175 2,610 (1) Consumer Finance Credit 11,208 892 10,360 888 8,323 809 Luizacred S.A. Sociedade de Crédito, Financiamento e Investimento Brazil (1) RedeCard S.A. Brazil Acquirer 71,515 17,127 63,817 17,266 68,624 16,403 (1) Institutions included in the Prudential Conglomerate. 21 Itaú Unibanco

Risk and Capital Management – Pillar 3 4 Investments in other entities not classified in the trading book The financial statements of Itaú Unibanco and its subsidiaries have been prepared in accordance with the Corporate Law Lei das Sociedades por Ações , as amended, and with the rulings issued by BACEN, CMN, CVM, SUSEP, CNSP and PREVIC, as applicable, which include accounting practices and estimates for the establishment of provisions and the valuation of financial assets. The interests held in other entities valued at acquisition price are classified in Permanent Assets, when there is the intention to hold them, and then are tested for impairment on a six-month basis. Investments in other companies which are not intended to be held for a long term are classified as Securities, and measured at market value. Itaú Unibanco applies its policies on a systematic basis, ensuring the consistency and comparability of its information. In the fourth quarter of 2019, there were no significant amendments to policies related to investments in other entities. Itaú Unibanco holds corporate interests mainly for strategic reasons and to obtain capital gains. Fo futhe ifoat io o Itaú Uiao’s aou ting policies, please see Note 3 – Sua of the ai aoutig paties, to the Cop lete Financial Statements, which is available on the website www.itau.com.br/investor-relations. The assessment of equity risk not included in the trading book, designated financial investment risk, is done on ICAAP process. This assessment simulates asset losses in a stress scenario. The table below shows the investments in other entities not classified in the trading book. On December 31, 2019, the capital required for these investments was R$ 203.8 million. Investments in other entities R$ million 12/31/2019 09/30/2019 12/31/2018 Carrying Amount 2, 788.3 1,177.3 1, 228.6 Public 238.5 285.5 526.1 Private 2,549.8 891.8 702.5 Fair value 2,834.8 1,215.1 1, 260.8 Public 258.9 300.2 541.3 Private 2,575.9 914.8 719.5 Gain or losses arising on investments in other entities 0.2 0.8 0.3 Recognized and unrealized gain or losses (60.4) (36.0) (40.9) Unrecognized and unrealized gain or losses 46.7 37.9 32.2 22 Itaú Unibanco Risk and Capital Management – Pillar 3 4 Investments in other entities not classified in the trading book The financial statements of Itaú Unibanco and its subsidiaries have been prepared in accordance with the Corporate Law Lei das Sociedades por Ações , as amended, and with the rulings issued by BACEN, CMN, CVM, SUSEP, CNSP and PREVIC, as applicable, which include accounting practices and estimates for the establishment of provisions and the valuation of financial assets. The interests held in other entities valued at acquisition price are classified in Permanent Assets, when there is the intention to hold them, and then are tested for impairment on a six-month basis. Investments in other companies which are not intended to be held for a long term are classified as Securities, and measured at market value. Itaú Unibanco applies its policies on a systematic basis, ensuring the consistency and comparability of its information. In the fourth quarter of 2019, there were no significant amendments to policies related to investments in other entities. Itaú Unibanco holds corporate interests mainly for strategic reasons and to obtain capital gains. Fo futhe ifoat io o Itaú Uiao’s aou ting policies, please see Note 3 – Sua of the ai aoutig paties, to the Cop lete Financial Statements, which is available on the website www.itau.com.br/investor-relations. The assessment of equity risk not included in the trading book, designated financial investment risk, is done on ICAAP process. This assessment simulates asset losses in a stress scenario. The table below shows the investments in other entities not classified in the trading book. On December 31, 2019, the capital required for these investments was R$ 203.8 million. Investments in other entities R$ million 12/31/2019 09/30/2019 12/31/2018 Carrying Amount 2, 788.3 1,177.3 1, 228.6 Public 238.5 285.5 526.1 Private 2,549.8 891.8 702.5 Fair value 2,834.8 1,215.1 1, 260.8 Public 258.9 300.2 541.3 Private 2,575.9 914.8 719.5 Gain or losses arising on investments in other entities 0.2 0.8 0.3 Recognized and unrealized gain or losses (60.4) (36.0) (40.9) Unrecognized and unrealized gain or losses 46.7 37.9 32.2 22 Itaú Unibanco

Risk and Capital Management – Pillar 3 5 Credit Risk 5.1 Framework and Treatment Itaú Unibanco defines credit risk as the risk of loss associated with: failure by a borrower, issuer or counterparty to fulfill their respective financial obligations as defined in the contracts; value loss of credit agreements resulting from deterioration of the ooe ’s , issue’s o outepat’s edit atig; edutio of pofits o io e; eefits gated upon subsequent renegotiations; or debt recovery costs. The management of credit risk is intended to preserve the quality of the loan portfolio at levels compatible with the istitutio’s isk appetite fo eah a ket sege t i hih e opeate. The governance of credit risk is managed through corporate bodies, which report to the Board of Directors or to the Itaú Unibanco executive structure. Such corporate bodies act primarily by assessing the competitive market conditions, setting the credit limits for the institution, reviewing control practices and policies, and approving these actions at the respective authority levels. The risk communication and reporting process, including disclosure of institutional and supplementary policies on credit risk management, are responsibility of this structure. Itaú Unibanco manages the credit risk to which it is exposed during the entire credit cycle, from before approval, during the monitoring process and up to the collection or recovery phase. There is a credit risk management and control structure, centralized and independent of the business units which defines operational limits, risk mitigation mechanisms and processes, and instruments to measure, monitor and control the credit risk inherent to all products, portfolio concentrations and impacts to potential changes in the economic environment. The edit’s potfolio, polii es ad stategies ae otiuousl o itoed so as to esue opliae i th the ules ad las in effect in each country. The key assignments of the business units are (i) monitoring of the portfolios under their responsibility, (ii) granting of credit, taking into account current approval levels, market conditions, the macroeconomic prospects and changes in markets and products, and (iii) credit risk management aimed at making the business sustainable. Itaú Uiao’s edit poli is ased o iteal fatos, suh as: liet atig iteia, pefoa e ad eo lutio of the portfolio, default levels, return rates and allocated economic capital, among others; and also take into account external factors such as: interest rates, market default indicators, inflation and changes in consumption, among others. With respect to individuals, small and medium companies, credit ratings are assigned based on statistical application (in the early stages of relationship with a customer) and behavior score (used for customers with whom Itaú Unibanco already has a relationship) models. For large companies, classification is based on ifoat io suh as the outepat’s eooi ad fiaial situatio, its cash-generating capacity, and the business group to which it belongs, the current and prospective situation of the economic sector in which it operates. Credit proposals are analyzed on a case-by-case basis through the approval governance. The concentrations are monitored continuously for economic sectors and largest debtors, allowing preventive measures to be taken to avoid the violation of the established limits. Itaú Unibanco also strictly controls credit exposure to clients and counterparties, acting to reverse occasional limit breaches. In this sense, contractual covenants may be used, such as the right to demand early payment or require additional collateral. To measure credit risk, Itaú Unibanco takes into account the probability of default by the borrower, issuer or counterparty, the estimated amount of exposure in the event of default, past losses from default and concentration of borrowers. Quantifying these risk components is part of the lending process, portfolio management and definition of limits. The models used by Itaú Unibanco are independently validated, to ensure that the databases used in constructing the models are complete and accurate, and that the method of estimating parameters is adequate. Itaú Unibanco counts on a specific structure and processes aimed at ensuring that the country risk is managed and controlled, desied i ite Othe Risks. In compliance with CMN Resolution 4,557, the doue t Puli Aess Repot - Cedit Risk, h ih desies the guidelines established in the institutional ruling on credit risk control, can be viewed on the website www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Reports. 23 Itaú Unibanco Risk and Capital Management – Pillar 3 5 Credit Risk 5.1 Framework and Treatment Itaú Unibanco defines credit risk as the risk of loss associated with: failure by a borrower, issuer or counterparty to fulfill their respective financial obligations as defined in the contracts; value loss of credit agreements resulting from deterioration of the ooe ’s , issue’s o outepat’s edit atig; edutio of pofits o io e; eefits gated upon subsequent renegotiations; or debt recovery costs. The management of credit risk is intended to preserve the quality of the loan portfolio at levels compatible with the istitutio’s isk appetite fo eah a ket sege t i hih e opeate. The governance of credit risk is managed through corporate bodies, which report to the Board of Directors or to the Itaú Unibanco executive structure. Such corporate bodies act primarily by assessing the competitive market conditions, setting the credit limits for the institution, reviewing control practices and policies, and approving these actions at the respective authority levels. The risk communication and reporting process, including disclosure of institutional and supplementary policies on credit risk management, are responsibility of this structure. Itaú Unibanco manages the credit risk to which it is exposed during the entire credit cycle, from before approval, during the monitoring process and up to the collection or recovery phase. There is a credit risk management and control structure, centralized and independent of the business units which defines operational limits, risk mitigation mechanisms and processes, and instruments to measure, monitor and control the credit risk inherent to all products, portfolio concentrations and impacts to potential changes in the economic environment. The edit’s potfolio, polii es ad stategies ae otiuousl o itoed so as to esue opliae i th the ules ad las in effect in each country. The key assignments of the business units are (i) monitoring of the portfolios under their responsibility, (ii) granting of credit, taking into account current approval levels, market conditions, the macroeconomic prospects and changes in markets and products, and (iii) credit risk management aimed at making the business sustainable. Itaú Uiao’s edit poli is ased o iteal fatos, suh as: liet atig iteia, pefoa e ad eo lutio of the portfolio, default levels, return rates and allocated economic capital, among others; and also take into account external factors such as: interest rates, market default indicators, inflation and changes in consumption, among others. With respect to individuals, small and medium companies, credit ratings are assigned based on statistical application (in the early stages of relationship with a customer) and behavior score (used for customers with whom Itaú Unibanco already has a relationship) models. For large companies, classification is based on ifoat io suh as the outepat’s eooi ad fiaial situatio, its cash-generating capacity, and the business group to which it belongs, the current and prospective situation of the economic sector in which it operates. Credit proposals are analyzed on a case-by-case basis through the approval governance. The concentrations are monitored continuously for economic sectors and largest debtors, allowing preventive measures to be taken to avoid the violation of the established limits. Itaú Unibanco also strictly controls credit exposure to clients and counterparties, acting to reverse occasional limit breaches. In this sense, contractual covenants may be used, such as the right to demand early payment or require additional collateral. To measure credit risk, Itaú Unibanco takes into account the probability of default by the borrower, issuer or counterparty, the estimated amount of exposure in the event of default, past losses from default and concentration of borrowers. Quantifying these risk components is part of the lending process, portfolio management and definition of limits. The models used by Itaú Unibanco are independently validated, to ensure that the databases used in constructing the models are complete and accurate, and that the method of estimating parameters is adequate. Itaú Unibanco counts on a specific structure and processes aimed at ensuring that the country risk is managed and controlled, desied i ite Othe Risks. In compliance with CMN Resolution 4,557, the doue t Puli Aess Repot - Cedit Risk, h ih desies the guidelines established in the institutional ruling on credit risk control, can be viewed on the website www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Reports. 23 Itaú Unibanco

Risk and Capital Management – Pillar 3 5.2 Credit Portfolio Analysis The information presented in the following tables allow the analysis of the credit portfolio, and its behavior, from different dimensions. Operations with Credit Granting Characteristics by Countries and by Brazil Geographic Regions (1) Operations with Credit Granting Characteristics by Countries: Exposure R$ million 12/31/2019 09/30/2019 United United Brazil Argentina Chile Colombia Paraguay Switzerland Uruguay Other Total Total States of Kingdon America Individuals 2 59,876 854 45,787 8,620 - 3,071 - - 3,613 41 321,862 317,921 Rural Loans 79 - - - - - - - - - 79 80 Real State 45,812 112 25,150 1 ,694 - 453 - - 402 - 73,623 7 3,156 Payroll 4 6,663 - - - - - - - - - 46,663 4 6,920 Vehicle and Leasing 18,197 - - 56 - 99 - - - - 18,352 1 7,429 Credit card 107,917 590 3 ,259 979 - 826 - - 2,257 - 115,828 110,822 Financial Guarantees Provided 911 - 17 1 - - - - 3 4 936 927 Personal Loans (Other) 4 0,297 152 17,361 5 ,890 - 1,693 - - 951 37 66,381 6 8,587 212,551 2,631 60,658 1 8,177 8,524 4,538 16,650 3,001 7,452 1,269 335,451 336,825 Companies Rural Loans 9,568 - - - - - - - - - 9,568 10,435 Investments 25,279 19 4,596 4,083 - 6 13 - 30 24 34,050 3 4,409 Import and Export 35,814 174 74 284 4,608 - 7,798 2,756 173 - 51,681 54,075 Working Capital, Discount Bonds and Secured Line of Credit 100,831 1 ,902 4 8,012 1 1,518 3,377 4,062 8,174 - 6,725 1,167 185,768 184,435 Financial Guarantees Provided 3 6,950 536 7 ,622 2,182 539 470 665 245 426 78 49,713 47,852 Other 4 ,109 - 354 110 - - - - 98 - 4 ,671 5,619 Total 4 72,427 3 ,485 106,445 26,797 8,524 7,609 16,650 3 ,001 11,065 1,310 657,313 654,746 (1) The amounts include financial guarantees provided and committed loans, do not include securities and are net of allowance for loan losses. (1) Operations with Credit Granting Characteristics by Countries: Quarterly Average Exposure R$ million 12/31/2019 09/30/2019 United United Brazil Argentina Chile Colombia Paraguay Switzerland Uruguay Other Total Total States of Kingdon America Individuals 2 56,706 854 4 7,031 8,561 - 3,112 - - 3,586 40 3 19,890 313,331 Rural Loans 80 - - - - - - - - - 80 67 Real State 45,301 109 25,461 1,667 - 455 - - 395 - 73,388 72,213 Payroll 46,791 - - - - - - - - - 4 6,791 4 6,885 Vehicle and Leasing 17,722 - - 61 - 106 - - - - 17,889 17,077 Credit card 1 05,415 582 3,308 958 - 834 - - 2 ,229 - 113,326 109,034 Financial Guarantees Provided 906 - 17 1 - - - - 3 4 931 945 Personal Loans (Other) 40,491 163 18,245 5,874 - 1 ,717 - - 959 36 67,485 6 7,110 Companies 211,414 2 ,650 6 1,794 1 8,171 8,611 4,716 1 6,895 3 ,151 7,315 1,416 336,133 329,404 Rural Loans 10,000 - - - - - - - - - 1 0,000 1 0,720 Investments 25,423 20 4,725 3 ,982 - 7 14 - 31 27 34,229 34,507 Import and Export 3 6,213 195 210 400 4 ,707 - 8 ,026 2 ,950 177 - 5 2,878 5 2,131 Working Capital, Discount Bonds and Secured Line of Credit 98,738 1,865 4 8,992 1 1,722 3,321 4,269 8,312 - 6 ,569 1,314 185,102 179,542 Financial Guarantees Provided 3 6,508 570 7,507 1 ,954 583 440 543 201 400 75 48,781 4 7,011 Other 4,532 - 360 113 - - - - 138 - 5,143 5,493 Total 468,120 3 ,504 108,825 26,732 8,611 7,828 1 6,895 3 ,151 1 0,901 1,456 656,023 642,735 (1) The amounts include financial guarantees provided and committed loans, do not include securities and are net of allowance for loan losses. (1) Operations with Credit Granting Characteristics in Brazil: Exposure R$ million 12/31/2019 09/30/2019 Southeast South North Northeast Midwest Brazil Brazil Individuals 1 67,138 30,526 8,609 3 7,754 1 5,849 259,876 2 53,541 Rural Loans 65 8 - 3 3 79 80 Real State 38,050 3 ,721 412 1 ,674 1,955 4 5,812 44,792 Payroll 2 6,520 5 ,877 3 ,311 7,987 2,968 4 6,663 46,920 Vehicle and Leasing 8 ,964 2 ,989 1 ,174 2 ,833 2 ,237 18,197 17,249 Credit card 6 2,724 1 3,400 2,944 2 2,645 6 ,204 1 07,917 1 02,914 Financial Guarantees Provided 879 16 1 7 8 911 903 Personal Loans (Other) 29,936 4 ,515 767 2 ,605 2,474 4 0,297 40,683 Companies 172,561 20,622 2,221 9 ,227 7,920 2 12,551 2 10,283 Rural Loans 5 ,242 3 ,313 22 226 765 9 ,568 1 0,435 Investments 1 6,656 4 ,365 536 2 ,009 1,713 2 5,279 25,569 Import and Export 33,014 1 ,786 235 491 288 3 5,814 36,611 Working Capital, Discount Bonds and Secured Line of Credit 7 8,480 1 0,237 1,281 5,946 4 ,887 1 00,831 9 6,645 Financial Guarantees Provided 36,219 391 61 212 67 3 6,950 3 6,067 Other 2 ,950 530 86 343 200 4,109 4 ,956 Total 3 39,699 51,148 1 0,830 4 6,981 2 3,769 472,427 4 63,824 (1) The amounts include financial guarantees provided and committed loans, do not include securities and are net of allowance for loan losses. 24 Itaú Unibanco Risk and Capital Management – Pillar 3 5.2 Credit Portfolio Analysis The information presented in the following tables allow the analysis of the credit portfolio, and its behavior, from different dimensions. Operations with Credit Granting Characteristics by Countries and by Brazil Geographic Regions (1) Operations with Credit Granting Characteristics by Countries: Exposure R$ million 12/31/2019 09/30/2019 United United Brazil Argentina Chile Colombia Paraguay Switzerland Uruguay Other Total Total States of Kingdon America Individuals 2 59,876 854 45,787 8,620 - 3,071 - - 3,613 41 321,862 317,921 Rural Loans 79 - - - - - - - - - 79 80 Real State 45,812 112 25,150 1 ,694 - 453 - - 402 - 73,623 7 3,156 Payroll 4 6,663 - - - - - - - - - 46,663 4 6,920 Vehicle and Leasing 18,197 - - 56 - 99 - - - - 18,352 1 7,429 Credit card 107,917 590 3 ,259 979 - 826 - - 2,257 - 115,828 110,822 Financial Guarantees Provided 911 - 17 1 - - - - 3 4 936 927 Personal Loans (Other) 4 0,297 152 17,361 5 ,890 - 1,693 - - 951 37 66,381 6 8,587 212,551 2,631 60,658 1 8,177 8,524 4,538 16,650 3,001 7,452 1,269 335,451 336,825 Companies Rural Loans 9,568 - - - - - - - - - 9,568 10,435 Investments 25,279 19 4,596 4,083 - 6 13 - 30 24 34,050 3 4,409 Import and Export 35,814 174 74 284 4,608 - 7,798 2,756 173 - 51,681 54,075 Working Capital, Discount Bonds and Secured Line of Credit 100,831 1 ,902 4 8,012 1 1,518 3,377 4,062 8,174 - 6,725 1,167 185,768 184,435 Financial Guarantees Provided 3 6,950 536 7 ,622 2,182 539 470 665 245 426 78 49,713 47,852 Other 4 ,109 - 354 110 - - - - 98 - 4 ,671 5,619 Total 4 72,427 3 ,485 106,445 26,797 8,524 7,609 16,650 3 ,001 11,065 1,310 657,313 654,746 (1) The amounts include financial guarantees provided and committed loans, do not include securities and are net of allowance for loan losses. (1) Operations with Credit Granting Characteristics by Countries: Quarterly Average Exposure R$ million 12/31/2019 09/30/2019 United United Brazil Argentina Chile Colombia Paraguay Switzerland Uruguay Other Total Total States of Kingdon America Individuals 2 56,706 854 4 7,031 8,561 - 3,112 - - 3,586 40 3 19,890 313,331 Rural Loans 80 - - - - - - - - - 80 67 Real State 45,301 109 25,461 1,667 - 455 - - 395 - 73,388 72,213 Payroll 46,791 - - - - - - - - - 4 6,791 4 6,885 Vehicle and Leasing 17,722 - - 61 - 106 - - - - 17,889 17,077 Credit card 1 05,415 582 3,308 958 - 834 - - 2 ,229 - 113,326 109,034 Financial Guarantees Provided 906 - 17 1 - - - - 3 4 931 945 Personal Loans (Other) 40,491 163 18,245 5,874 - 1 ,717 - - 959 36 67,485 6 7,110 Companies 211,414 2 ,650 6 1,794 1 8,171 8,611 4,716 1 6,895 3 ,151 7,315 1,416 336,133 329,404 Rural Loans 10,000 - - - - - - - - - 1 0,000 1 0,720 Investments 25,423 20 4,725 3 ,982 - 7 14 - 31 27 34,229 34,507 Import and Export 3 6,213 195 210 400 4 ,707 - 8 ,026 2 ,950 177 - 5 2,878 5 2,131 Working Capital, Discount Bonds and Secured Line of Credit 98,738 1,865 4 8,992 1 1,722 3,321 4,269 8,312 - 6 ,569 1,314 185,102 179,542 Financial Guarantees Provided 3 6,508 570 7,507 1 ,954 583 440 543 201 400 75 48,781 4 7,011 Other 4,532 - 360 113 - - - - 138 - 5,143 5,493 Total 468,120 3 ,504 108,825 26,732 8,611 7,828 1 6,895 3 ,151 1 0,901 1,456 656,023 642,735 (1) The amounts include financial guarantees provided and committed loans, do not include securities and are net of allowance for loan losses. (1) Operations with Credit Granting Characteristics in Brazil: Exposure R$ million 12/31/2019 09/30/2019 Southeast South North Northeast Midwest Brazil Brazil Individuals 1 67,138 30,526 8,609 3 7,754 1 5,849 259,876 2 53,541 Rural Loans 65 8 - 3 3 79 80 Real State 38,050 3 ,721 412 1 ,674 1,955 4 5,812 44,792 Payroll 2 6,520 5 ,877 3 ,311 7,987 2,968 4 6,663 46,920 Vehicle and Leasing 8 ,964 2 ,989 1 ,174 2 ,833 2 ,237 18,197 17,249 Credit card 6 2,724 1 3,400 2,944 2 2,645 6 ,204 1 07,917 1 02,914 Financial Guarantees Provided 879 16 1 7 8 911 903 Personal Loans (Other) 29,936 4 ,515 767 2 ,605 2,474 4 0,297 40,683 Companies 172,561 20,622 2,221 9 ,227 7,920 2 12,551 2 10,283 Rural Loans 5 ,242 3 ,313 22 226 765 9 ,568 1 0,435 Investments 1 6,656 4 ,365 536 2 ,009 1,713 2 5,279 25,569 Import and Export 33,014 1 ,786 235 491 288 3 5,814 36,611 Working Capital, Discount Bonds and Secured Line of Credit 7 8,480 1 0,237 1,281 5,946 4 ,887 1 00,831 9 6,645 Financial Guarantees Provided 36,219 391 61 212 67 3 6,950 3 6,067 Other 2 ,950 530 86 343 200 4,109 4 ,956 Total 3 39,699 51,148 1 0,830 4 6,981 2 3,769 472,427 4 63,824 (1) The amounts include financial guarantees provided and committed loans, do not include securities and are net of allowance for loan losses. 24 Itaú Unibanco

Risk and Capital Management – Pillar 3 (1) Operations with Credit Granting Characteristics in Brazil: Quarterly Average Exposure R$ million 12/31/2019 09/30/2019 Southeast South North Northeast Midwest Brazil Brazil Individuals 165,037 30,101 8,557 3 7,295 1 5,716 256,706 2 49,820 Rural Loans 64 10 - 3 3 80 67 3 7,623 3 ,652 411 1 ,658 1,957 4 5,301 44,363 Real State Payroll 2 6,396 5 ,917 3 ,353 8 ,125 3,000 4 6,791 46,885 Vehicle and Leasing 8 ,777 2 ,882 1 ,146 2,741 2 ,176 17,722 16,889 Credit card 6 1,325 1 3,049 2,865 2 2,113 6 ,063 1 05,415 1 01,265 875 16 1 6 8 906 919 Financial Guarantees Provided Personal Loans (Other) 29,977 4 ,575 781 2 ,649 2,509 4 0,491 39,432 Companies 171,923 20,530 2,121 8 ,971 7,869 2 11,414 2 05,841 Rural Loans 5,334 3 ,547 20 236 863 1 0,000 10,720 Investments 1 7,191 4 ,217 499 1 ,892 1,624 2 5,423 25,738 Import and Export 3 3,490 1 ,729 223 481 290 3 6,213 35,072 Working Capital, Discount Bonds and Secured Line of Credit 76,766 1 0,105 1,237 5 ,808 4 ,822 98,738 93,889 Financial Guarantees Provided 35,799 383 55 205 66 3 6,508 3 5,520 Other 3,343 549 87 349 204 4,532 4 ,902 Total 3 36,960 50,631 1 0,678 4 6,266 2 3,585 4 68,120 4 55,661 (1) The amounts include financial guarantees provided and committed loans, do not include securities and are net of allowance for loan losses. Operations with Credit Granting Characteristics by Economic Sector (1) Operations with Credit Granting Characteristics in Brazil : Exposure R$ million 12/31/2019 09/30/2019 Financial Vehicle and Personal Loans Individuals Rural Loans Real State Payroll Credit Card Guarantees Total Total Leasing (Other) Provided Total 79 73,623 46,663 18,352 115,828 936 66,381 321,862 317,921 (1) The amounts include financial guarantees provided and committed loans, do not include securities and are net of allowance for loan losses. (1) Operations with Credit Granting Characteristics in Brazil: Exposure R$ million 12/31/2019 09/30/2019 Working Capital, Financial Discount Bonds and Rural Loans Investments Import and Export Guarantees Other Total Total Guaranteed Provided Account Companies Total % Total % Total % Total % Total % Total % Total % Total % Public Sector - 0.0% 212 0.6% 62 0.1% 916 0.5% 1,413 2.8% - 0.0% 2,603 0.8% 1,434 0.4% Energy - 0.0% - 0.0% - 0.0% - 0.0% 1 0.0% - 0.0% 1 0.0% 1 0.0% Petrochemical and Chemical - 0.0% 194 0.6% - 0.0% 6 0.0% 1,405 2.8% - 0.0% 1,605 0.5% 1,124 0.3% Sundry - 0.0% 18 0.1% 62 0.1% 910 0.5% 7 0.0% - 0.0% 997 0.3% 309 0.1% Private Sector 9,568 100.0% 33,838 99.4% 51,619 99.9% 184,852 99.5% 48,300 97.2% 4,671 100.0% 332,848 99.2% 335,391 99.6% Sugar and Alcohol 292 3.1% 867 2.5% 1,580 3.1% 1,036 0.6% 132 0.3% 13 0.3% 3,920 1.2% 4,492 1.3% Agribusiness and Fertilizers 2,679 28.0% 750 2.2% 4,076 7.9% 10,325 5.6% 474 1.0% 170 3.6% 18,474 5.5% 18,610 5.5% Food and Beverage 1,409 14.7% 1,782 5.2% 4,304 8.3% 9,385 5.1% 2,357 4.7% 257 5.5% 19,494 5.8% 19,185 5.7% Banks and Other Financial Institutions 3 0.0% 691 2.0% 1,321 2.6% 9,499 5.1% 3,094 6.2% 19 0.4% 14,627 4.4% 14,228 4.2% Capital Assets 75 0.8% 255 0.7% 1,177 2.3% 3,873 2.1% 1,025 2.1% 130 2.8% 6,535 1.9% 6,927 2.1% Pulp and Paper 26 0.3% 218 0.6% 482 0.9% 952 0.5% 739 1.5% 35 0.7% 2,452 0.7% 2,021 0.6% Electronic and IT - 0.0% 247 0.7% 1,146 2.2% 4,099 2.2% 1,386 2.8% 170 3.6% 7,048 2.1% 7,023 2.1% Packaging 3 0.0% 90 0.3% 983 1.9% 1,410 0.8% 149 0.3% 24 0.5% 2,659 0.8% 2,573 0.8% Energy and Sewage - 0.0% 2,423 7.1% 1,793 3.5% 3,128 1.7% 8,282 16.7% 4 0.1% 15,630 4.7% 15,165 4.5% Education 7 0.1% 276 0.8% 50 0.1% 1,976 1.1% 1,284 2.6% 76 1.6% 3,669 1.1% 3,367 1.0% Pharmaceuticals and Cosmetics 9 0.1% 244 0.7% 1,933 3.7% 4,382 2.4% 1,353 2.7% 151 3.2% 8,072 2.4% 8,060 2.4% Real Estate Agents 28 0.3% 9,198 27.0% 402 0.8% 12,549 6.8% 1,555 3.1% 304 6.5% 24,036 7.2% 23,534 7.0% Entertainment and Tourism - 0.0% 563 1.7% 205 0.4% 4,428 2.4% 480 1.0% 327 7.0% 6,003 1.8% 5,915 1.8% Wood and Furniture 35 0.4% 280 0.8% 687 1.3% 2,294 1.2% 82 0.2% 112 2.4% 3,490 1.0% 3,393 1.0% Construction Material 7 0.1% 448 1.3% 1,499 2.9% 2,698 1.5% 1,098 2.2% 132 2.8% 5,882 1.8% 6,388 1.9% Steel and Metallurgy 32 0.3% 329 1.0% 1,321 2.6% 7,062 3.8% 598 1.2% 195 4.2% 9,537 2.8% 9,303 2.8% Media - 0.0% 101 0.3% 46 0.1% 600 0.3% 502 1.0% 7 0.1% 1,256 0.4% 1,163 0.3% Mining 3 0.0% 313 0.9% 691 1.3% 3,508 1.9% 3,535 7.1% 33 0.7% 8,083 2.4% 8,015 2.4% Infrastructure Work 18 0.2% 595 1.7% 794 1.5% 5,734 3.1% 1,927 3.9% 134 2.9% 9,202 2.7% 9,640 2.9% (2) 35 0.4% 505 1.5% 1,038 2.0% 4,725 2.5% 806 1.6% 61 1.3% 7,170 2.1% 6,910 2.1% Oil and Gas Petrochemical and Chemical 336 3.5% 464 1.4% 3,211 6.2% 5,842 3.1% 1,572 3.2% 159 3.4% 11,584 3.5% 11,942 3.5% Health Care - 0.0% 361 1.1% 531 1.0% 2,800 1.5% 407 0.8% 43 0.9% 4,142 1.2% 3,911 1.2% Insurance and Reinsurance and Pension Plans - 0.0% 11 0.0% - 0.0% 9 0.0% 76 0.2% - 0.0% 96 0.0% 110 0.0% Telecommunications - 0.0% 84 0.2% 190 0.4% 2,505 1.3% 3,319 6.7% 13 0.3% 6,111 1.8% 6,234 1.9% Clothing and Footwear 53 0.6% 215 0.6% 1,329 2.6% 2,735 1.5% 177 0.4% 105 2.2% 4,614 1.4% 4,623 1.4% Trading 30 0.3% 101 0.3% 992 1.9% 711 0.4% 171 0.3% 20 0.4% 2,025 0.6% 2,234 0.7% Transportation 37 0.4% 7,127 20.9% 1,768 3.4% 4,980 2.7% 1,264 2.5% 239 5.1% 15,415 4.6% 13,998 4.2% Domestic Appliances 3 0.0% 46 0.1% 624 1.2% 1,967 1.1% 272 0.5% 19 0.4% 2,931 0.9% 2,649 0.8% Vehicles and Autoparts 14 0.1% 1,109 3.3% 3,106 6.0% 8,848 4.8% 2,157 4.3% 219 4.7% 15,453 4.6% 15,153 4.5% Third Sector - 0.0% 19 0.1% - 0.0% 1,734 0.9% 9 0.0% 2 0.0% 1,764 0.5% 1,820 0.5% Publishing and Printing - 0.0% 109 0.3% 63 0.1% 1,083 0.6% 103 0.2% 66 1.4% 1,424 0.4% 1,397 0.4% Commerce - Sundry 7 0.1% 1,165 3.4% 2,355 4.6% 16,870 9.1% 1,740 3.5% 720 15.4% 22,857 6.8% 22,849 6.8% Industry - Sundry - 0.0% 47 0.1% 6,097 11.8% 3,368 1.8% 210 0.4% 17 0.4% 9,739 2.9% 10,680 3.2% Sundry Services 50 0.5% 2,043 6.0% 3,912 7.6% 30,143 16.2% 3,849 7.7% 540 11.6% 40,537 12.1% 44,137 13.1% Sundry 4,377 45.7% 762 2.2% 1,913 3.7% 7,594 4.1% 2,116 4.3% 155 3.3% 16,917 5.0% 17,742 5.3% 9,568 100.0% 34,050 100.0% 51,681 100.0% 185,768 100.0% 49,713 100.0% 4,671 100.0% 335,451 100.0% 336,825 100.0% Total (1) The amounts include financial guarantees provided and committed loans, do not include securities and are net of allowance for loan losses. (2) Comprises trade of fuel. 25 Itaú Unibanco Risk and Capital Management – Pillar 3 (1) Operations with Credit Granting Characteristics in Brazil: Quarterly Average Exposure R$ million 12/31/2019 09/30/2019 Southeast South North Northeast Midwest Brazil Brazil Individuals 165,037 30,101 8,557 3 7,295 1 5,716 256,706 2 49,820 Rural Loans 64 10 - 3 3 80 67 3 7,623 3 ,652 411 1 ,658 1,957 4 5,301 44,363 Real State Payroll 2 6,396 5 ,917 3 ,353 8 ,125 3,000 4 6,791 46,885 Vehicle and Leasing 8 ,777 2 ,882 1 ,146 2,741 2 ,176 17,722 16,889 Credit card 6 1,325 1 3,049 2,865 2 2,113 6 ,063 1 05,415 1 01,265 875 16 1 6 8 906 919 Financial Guarantees Provided Personal Loans (Other) 29,977 4 ,575 781 2 ,649 2,509 4 0,491 39,432 Companies 171,923 20,530 2,121 8 ,971 7,869 2 11,414 2 05,841 Rural Loans 5,334 3 ,547 20 236 863 1 0,000 10,720 Investments 1 7,191 4 ,217 499 1 ,892 1,624 2 5,423 25,738 Import and Export 3 3,490 1 ,729 223 481 290 3 6,213 35,072 Working Capital, Discount Bonds and Secured Line of Credit 76,766 1 0,105 1,237 5 ,808 4 ,822 98,738 93,889 Financial Guarantees Provided 35,799 383 55 205 66 3 6,508 3 5,520 Other 3,343 549 87 349 204 4,532 4 ,902 Total 3 36,960 50,631 1 0,678 4 6,266 2 3,585 4 68,120 4 55,661 (1) The amounts include financial guarantees provided and committed loans, do not include securities and are net of allowance for loan losses. Operations with Credit Granting Characteristics by Economic Sector (1) Operations with Credit Granting Characteristics in Brazil : Exposure R$ million 12/31/2019 09/30/2019 Financial Vehicle and Personal Loans Individuals Rural Loans Real State Payroll Credit Card Guarantees Total Total Leasing (Other) Provided Total 79 73,623 46,663 18,352 115,828 936 66,381 321,862 317,921 (1) The amounts include financial guarantees provided and committed loans, do not include securities and are net of allowance for loan losses. (1) Operations with Credit Granting Characteristics in Brazil: Exposure R$ million 12/31/2019 09/30/2019 Working Capital, Financial Discount Bonds and Rural Loans Investments Import and Export Guarantees Other Total Total Guaranteed Provided Account Companies Total % Total % Total % Total % Total % Total % Total % Total % Public Sector - 0.0% 212 0.6% 62 0.1% 916 0.5% 1,413 2.8% - 0.0% 2,603 0.8% 1,434 0.4% Energy - 0.0% - 0.0% - 0.0% - 0.0% 1 0.0% - 0.0% 1 0.0% 1 0.0% Petrochemical and Chemical - 0.0% 194 0.6% - 0.0% 6 0.0% 1,405 2.8% - 0.0% 1,605 0.5% 1,124 0.3% Sundry - 0.0% 18 0.1% 62 0.1% 910 0.5% 7 0.0% - 0.0% 997 0.3% 309 0.1% Private Sector 9,568 100.0% 33,838 99.4% 51,619 99.9% 184,852 99.5% 48,300 97.2% 4,671 100.0% 332,848 99.2% 335,391 99.6% Sugar and Alcohol 292 3.1% 867 2.5% 1,580 3.1% 1,036 0.6% 132 0.3% 13 0.3% 3,920 1.2% 4,492 1.3% Agribusiness and Fertilizers 2,679 28.0% 750 2.2% 4,076 7.9% 10,325 5.6% 474 1.0% 170 3.6% 18,474 5.5% 18,610 5.5% Food and Beverage 1,409 14.7% 1,782 5.2% 4,304 8.3% 9,385 5.1% 2,357 4.7% 257 5.5% 19,494 5.8% 19,185 5.7% Banks and Other Financial Institutions 3 0.0% 691 2.0% 1,321 2.6% 9,499 5.1% 3,094 6.2% 19 0.4% 14,627 4.4% 14,228 4.2% Capital Assets 75 0.8% 255 0.7% 1,177 2.3% 3,873 2.1% 1,025 2.1% 130 2.8% 6,535 1.9% 6,927 2.1% Pulp and Paper 26 0.3% 218 0.6% 482 0.9% 952 0.5% 739 1.5% 35 0.7% 2,452 0.7% 2,021 0.6% Electronic and IT - 0.0% 247 0.7% 1,146 2.2% 4,099 2.2% 1,386 2.8% 170 3.6% 7,048 2.1% 7,023 2.1% Packaging 3 0.0% 90 0.3% 983 1.9% 1,410 0.8% 149 0.3% 24 0.5% 2,659 0.8% 2,573 0.8% Energy and Sewage - 0.0% 2,423 7.1% 1,793 3.5% 3,128 1.7% 8,282 16.7% 4 0.1% 15,630 4.7% 15,165 4.5% Education 7 0.1% 276 0.8% 50 0.1% 1,976 1.1% 1,284 2.6% 76 1.6% 3,669 1.1% 3,367 1.0% Pharmaceuticals and Cosmetics 9 0.1% 244 0.7% 1,933 3.7% 4,382 2.4% 1,353 2.7% 151 3.2% 8,072 2.4% 8,060 2.4% Real Estate Agents 28 0.3% 9,198 27.0% 402 0.8% 12,549 6.8% 1,555 3.1% 304 6.5% 24,036 7.2% 23,534 7.0% Entertainment and Tourism - 0.0% 563 1.7% 205 0.4% 4,428 2.4% 480 1.0% 327 7.0% 6,003 1.8% 5,915 1.8% Wood and Furniture 35 0.4% 280 0.8% 687 1.3% 2,294 1.2% 82 0.2% 112 2.4% 3,490 1.0% 3,393 1.0% Construction Material 7 0.1% 448 1.3% 1,499 2.9% 2,698 1.5% 1,098 2.2% 132 2.8% 5,882 1.8% 6,388 1.9% Steel and Metallurgy 32 0.3% 329 1.0% 1,321 2.6% 7,062 3.8% 598 1.2% 195 4.2% 9,537 2.8% 9,303 2.8% Media - 0.0% 101 0.3% 46 0.1% 600 0.3% 502 1.0% 7 0.1% 1,256 0.4% 1,163 0.3% Mining 3 0.0% 313 0.9% 691 1.3% 3,508 1.9% 3,535 7.1% 33 0.7% 8,083 2.4% 8,015 2.4% Infrastructure Work 18 0.2% 595 1.7% 794 1.5% 5,734 3.1% 1,927 3.9% 134 2.9% 9,202 2.7% 9,640 2.9% (2) 35 0.4% 505 1.5% 1,038 2.0% 4,725 2.5% 806 1.6% 61 1.3% 7,170 2.1% 6,910 2.1% Oil and Gas Petrochemical and Chemical 336 3.5% 464 1.4% 3,211 6.2% 5,842 3.1% 1,572 3.2% 159 3.4% 11,584 3.5% 11,942 3.5% Health Care - 0.0% 361 1.1% 531 1.0% 2,800 1.5% 407 0.8% 43 0.9% 4,142 1.2% 3,911 1.2% Insurance and Reinsurance and Pension Plans - 0.0% 11 0.0% - 0.0% 9 0.0% 76 0.2% - 0.0% 96 0.0% 110 0.0% Telecommunications - 0.0% 84 0.2% 190 0.4% 2,505 1.3% 3,319 6.7% 13 0.3% 6,111 1.8% 6,234 1.9% Clothing and Footwear 53 0.6% 215 0.6% 1,329 2.6% 2,735 1.5% 177 0.4% 105 2.2% 4,614 1.4% 4,623 1.4% Trading 30 0.3% 101 0.3% 992 1.9% 711 0.4% 171 0.3% 20 0.4% 2,025 0.6% 2,234 0.7% Transportation 37 0.4% 7,127 20.9% 1,768 3.4% 4,980 2.7% 1,264 2.5% 239 5.1% 15,415 4.6% 13,998 4.2% Domestic Appliances 3 0.0% 46 0.1% 624 1.2% 1,967 1.1% 272 0.5% 19 0.4% 2,931 0.9% 2,649 0.8% Vehicles and Autoparts 14 0.1% 1,109 3.3% 3,106 6.0% 8,848 4.8% 2,157 4.3% 219 4.7% 15,453 4.6% 15,153 4.5% Third Sector - 0.0% 19 0.1% - 0.0% 1,734 0.9% 9 0.0% 2 0.0% 1,764 0.5% 1,820 0.5% Publishing and Printing - 0.0% 109 0.3% 63 0.1% 1,083 0.6% 103 0.2% 66 1.4% 1,424 0.4% 1,397 0.4% Commerce - Sundry 7 0.1% 1,165 3.4% 2,355 4.6% 16,870 9.1% 1,740 3.5% 720 15.4% 22,857 6.8% 22,849 6.8% Industry - Sundry - 0.0% 47 0.1% 6,097 11.8% 3,368 1.8% 210 0.4% 17 0.4% 9,739 2.9% 10,680 3.2% Sundry Services 50 0.5% 2,043 6.0% 3,912 7.6% 30,143 16.2% 3,849 7.7% 540 11.6% 40,537 12.1% 44,137 13.1% Sundry 4,377 45.7% 762 2.2% 1,913 3.7% 7,594 4.1% 2,116 4.3% 155 3.3% 16,917 5.0% 17,742 5.3% 9,568 100.0% 34,050 100.0% 51,681 100.0% 185,768 100.0% 49,713 100.0% 4,671 100.0% 335,451 100.0% 336,825 100.0% Total (1) The amounts include financial guarantees provided and committed loans, do not include securities and are net of allowance for loan losses. (2) Comprises trade of fuel. 25 Itaú Unibanco

Risk and Capital Management – Pillar 3 Remaining maturity of loan transactions (1) Remaining maturities of loan transactions R$ million 12/31/2019 09/30/2019 up to 6 6 to 12 1 to 5 up to 6 6 to 12 1 to 5 above 5 above 5 years Total Total months months years months months years years Individuals 9 6,966 5,789 6 6,283 104,358 273,396 91,215 4,520 6 7,711 104,579 268,025 Rural Loans 17 21 29 3 70 28 27 17 4 76 Real State 54 40 1 ,410 7 2,115 73,619 57 41 1,387 71,674 7 3,159 Payroll 921 779 2 1,291 23,681 46,672 232 632 2 2,506 2 3,540 46,910 Vehicle and Leasing 227 813 1 7,294 21 18,355 250 736 16,417 22 17,425 Credit card 8 7,536 - - - 8 7,536 8 1,454 - - - 81,454 Financial Guarantees Provided 48 598 74 205 925 70 10 615 223 918 Personal Loans (Other) 8,163 3,538 2 6,185 8,333 4 6,219 9,124 3,074 2 6,769 9,116 4 8,083 Companies 109,754 36,639 1 18,455 52,738 317,586 1 08,704 37,933 115,858 5 6,472 3 18,967 Rural Loans 4,560 3,330 777 632 9 ,299 4 ,033 4,574 903 615 10,125 Investments 1,991 1,984 1 9,136 8,533 3 1,644 2,440 1,852 1 8,801 9,319 3 2,412 Import and Export 22,205 5,546 22,020 1 ,908 51,679 2 2,635 7,690 21,017 2,734 54,076 Working Capital, Discount Bonds and Guaranteed Account 6 9,079 17,194 61,372 22,920 170,565 6 7,561 16,589 6 1,417 2 3,308 1 68,875 Financial Guarantees Provided 1 1,599 8,301 11,337 1 8,489 49,726 1 1,691 6,903 9,581 1 9,686 47,861 Other 320 284 3 ,813 256 4 ,673 344 325 4 ,139 810 5 ,618 Total 2 06,720 42,428 1 84,738 157,096 590,982 1 99,919 42,453 1 83,569 161,051 586,992 (1) Do not include loan commitments. Concentration on the Major Debtors Concentration of Largest Clients with Credit Granting Characteristics R$ million 12/31/2019 09/30/2019 12/31/2018 (1) Loan, Lease and Other Credit Operations Exposure % of portfolio Exposure % of portfolio Exposure % of portfolio Largest debtor 5 ,389 0.8% 5 ,699 0.9% 5 ,193 0.9% 10 largest debtors 29,340 4.5% 29,090 4.5% 31,564 5.3% 20 largest debtors 44,712 6.9% 44,256 6.9% 47,430 7.9% 50 largest debtors 71,975 11.1% 72,185 11.2% 73,355 12.3% 100 largest debtors 97,705 15.0% 99,092 15.4% 98,672 16.5% (1) The amounts include financial guarantees provided. Do not include loan commitments. Concentration of Largest Clients with Credit Granting Characteristics R$ million 12/31/2019 09/30/2019 12/31/2018 (1) Exposure % of portfolio Exposure % of portfolio Exposure % of portfolio Loan, Lease and Other Credit Operations and Securities Largest debtor 6 ,509 0.8% 6 ,265 0.8% 7 ,675 1.1% 10 largest debtors 49,084 6.3% 47,122 6.3% 43,959 6.4% 20 largest debtors 76,607 9.9% 74,175 9.9% 68,262 10.0% 50 largest debtors 129,688 16.7% 125,207 16.6% 108,645 15.9% 100 largest debtors 172,814 22.3% 166,133 22.1% 143,269 21.0% (1) The amounts include financial guarantees provided. Do not include loan commitments. Overdue Amounts Overdue Amounts: by Brazil Regions and Countries R$ million 12/31/2019 09/30/2019 61 to 90 91 to 180 181 to 360 Above 360 61 to 90 91 to 180 181 to 360 Above 360 15 to 60 days Total 15 to 60 days Total days days days days days days days days Southeast 5,024 1,779 3,919 4,555 395 15,672 4,498 1,643 4,238 4,208 828 15,415 South 795 315 712 860 92 2,774 750 284 687 764 81 2,566 North 246 83 191 227 35 782 252 78 185 219 36 770 Northeast 800 484 1,026 1,426 109 3,845 812 362 1,009 1,227 104 3,514 Midwest 502 200 399 467 43 1,611 489 164 375 409 42 1,479 Brazil 7,367 2,861 6,247 7,535 674 24,684 6,801 2,531 6,494 6,827 1,091 23,744 Foreign 2,832 636 1,682 980 203 6,333 3,333 645 1,022 886 267 6,153 Total 10,199 3,497 7,929 8,515 877 31,017 10,134 3,176 7,516 7,713 1,358 29,897 Overdue Amounts: by Economic Sector R$ million 12/31/2019 09/30/2019 61 to 90 91 to 180 181 to 360 Above 360 61 to 90 91 to 180 181 to 360 Above 360 15 to 60 days Total 15 to 60 days Total days days days days days days days days Public Sector 13 - - - - 13 - - - - - - Private Sector 10,186 3,497 7,929 8,515 877 31,004 10,134 3,176 7,516 7,713 1,358 2 9,897 Companies 2,611 870 2,184 1,774 191 7 ,630 2,435 659 1,922 1,671 678 7 ,365 Industry and Commerce 1,002 305 736 964 131 3,138 1,203 305 674 917 173 3,272 Services 1,547 513 927 698 56 3,741 1,140 340 1,032 677 499 3 ,688 Primary 61 52 38 111 4 266 92 14 216 76 6 404 Other 1 - 483 1 - 485 - - - 1 - 1 Individuals 7,575 2,627 5,745 6,741 686 23,374 7,699 2,517 5,594 6,042 680 2 2,532 Total 10,199 3,497 7,929 8,515 877 3 1,017 10,134 3,176 7,516 7,713 1,358 2 9,897 Allowance for Loan Losses In order to be hedged against losses arising from loan operations, Itaú Unibanco takes into consideration all the aspects that deteie the liet’s edit isk to estalish the poi sio leel that is appopiate to the isk iued i eah operation. For each operation, the assessment and the client or economic group rating, the operation rating, and the possible existence of overdue amounts are taken into account and the volume of the regulatory provision is determined. 26 Itaú Unibanco Risk and Capital Management – Pillar 3 Remaining maturity of loan transactions (1) Remaining maturities of loan transactions R$ million 12/31/2019 09/30/2019 up to 6 6 to 12 1 to 5 up to 6 6 to 12 1 to 5 above 5 above 5 years Total Total months months years months months years years Individuals 9 6,966 5,789 6 6,283 104,358 273,396 91,215 4,520 6 7,711 104,579 268,025 Rural Loans 17 21 29 3 70 28 27 17 4 76 Real State 54 40 1 ,410 7 2,115 73,619 57 41 1,387 71,674 7 3,159 Payroll 921 779 2 1,291 23,681 46,672 232 632 2 2,506 2 3,540 46,910 Vehicle and Leasing 227 813 1 7,294 21 18,355 250 736 16,417 22 17,425 Credit card 8 7,536 - - - 8 7,536 8 1,454 - - - 81,454 Financial Guarantees Provided 48 598 74 205 925 70 10 615 223 918 Personal Loans (Other) 8,163 3,538 2 6,185 8,333 4 6,219 9,124 3,074 2 6,769 9,116 4 8,083 Companies 109,754 36,639 1 18,455 52,738 317,586 1 08,704 37,933 115,858 5 6,472 3 18,967 Rural Loans 4,560 3,330 777 632 9 ,299 4 ,033 4,574 903 615 10,125 Investments 1,991 1,984 1 9,136 8,533 3 1,644 2,440 1,852 1 8,801 9,319 3 2,412 Import and Export 22,205 5,546 22,020 1 ,908 51,679 2 2,635 7,690 21,017 2,734 54,076 Working Capital, Discount Bonds and Guaranteed Account 6 9,079 17,194 61,372 22,920 170,565 6 7,561 16,589 6 1,417 2 3,308 1 68,875 Financial Guarantees Provided 1 1,599 8,301 11,337 1 8,489 49,726 1 1,691 6,903 9,581 1 9,686 47,861 Other 320 284 3 ,813 256 4 ,673 344 325 4 ,139 810 5 ,618 Total 2 06,720 42,428 1 84,738 157,096 590,982 1 99,919 42,453 1 83,569 161,051 586,992 (1) Do not include loan commitments. Concentration on the Major Debtors Concentration of Largest Clients with Credit Granting Characteristics R$ million 12/31/2019 09/30/2019 12/31/2018 (1) Loan, Lease and Other Credit Operations Exposure % of portfolio Exposure % of portfolio Exposure % of portfolio Largest debtor 5 ,389 0.8% 5 ,699 0.9% 5 ,193 0.9% 10 largest debtors 29,340 4.5% 29,090 4.5% 31,564 5.3% 20 largest debtors 44,712 6.9% 44,256 6.9% 47,430 7.9% 50 largest debtors 71,975 11.1% 72,185 11.2% 73,355 12.3% 100 largest debtors 97,705 15.0% 99,092 15.4% 98,672 16.5% (1) The amounts include financial guarantees provided. Do not include loan commitments. Concentration of Largest Clients with Credit Granting Characteristics R$ million 12/31/2019 09/30/2019 12/31/2018 (1) Exposure % of portfolio Exposure % of portfolio Exposure % of portfolio Loan, Lease and Other Credit Operations and Securities Largest debtor 6 ,509 0.8% 6 ,265 0.8% 7 ,675 1.1% 10 largest debtors 49,084 6.3% 47,122 6.3% 43,959 6.4% 20 largest debtors 76,607 9.9% 74,175 9.9% 68,262 10.0% 50 largest debtors 129,688 16.7% 125,207 16.6% 108,645 15.9% 100 largest debtors 172,814 22.3% 166,133 22.1% 143,269 21.0% (1) The amounts include financial guarantees provided. Do not include loan commitments. Overdue Amounts Overdue Amounts: by Brazil Regions and Countries R$ million 12/31/2019 09/30/2019 61 to 90 91 to 180 181 to 360 Above 360 61 to 90 91 to 180 181 to 360 Above 360 15 to 60 days Total 15 to 60 days Total days days days days days days days days Southeast 5,024 1,779 3,919 4,555 395 15,672 4,498 1,643 4,238 4,208 828 15,415 South 795 315 712 860 92 2,774 750 284 687 764 81 2,566 North 246 83 191 227 35 782 252 78 185 219 36 770 Northeast 800 484 1,026 1,426 109 3,845 812 362 1,009 1,227 104 3,514 Midwest 502 200 399 467 43 1,611 489 164 375 409 42 1,479 Brazil 7,367 2,861 6,247 7,535 674 24,684 6,801 2,531 6,494 6,827 1,091 23,744 Foreign 2,832 636 1,682 980 203 6,333 3,333 645 1,022 886 267 6,153 Total 10,199 3,497 7,929 8,515 877 31,017 10,134 3,176 7,516 7,713 1,358 29,897 Overdue Amounts: by Economic Sector R$ million 12/31/2019 09/30/2019 61 to 90 91 to 180 181 to 360 Above 360 61 to 90 91 to 180 181 to 360 Above 360 15 to 60 days Total 15 to 60 days Total days days days days days days days days Public Sector 13 - - - - 13 - - - - - - Private Sector 10,186 3,497 7,929 8,515 877 31,004 10,134 3,176 7,516 7,713 1,358 2 9,897 Companies 2,611 870 2,184 1,774 191 7 ,630 2,435 659 1,922 1,671 678 7 ,365 Industry and Commerce 1,002 305 736 964 131 3,138 1,203 305 674 917 173 3,272 Services 1,547 513 927 698 56 3,741 1,140 340 1,032 677 499 3 ,688 Primary 61 52 38 111 4 266 92 14 216 76 6 404 Other 1 - 483 1 - 485 - - - 1 - 1 Individuals 7,575 2,627 5,745 6,741 686 23,374 7,699 2,517 5,594 6,042 680 2 2,532 Total 10,199 3,497 7,929 8,515 877 3 1,017 10,134 3,176 7,516 7,713 1,358 2 9,897 Allowance for Loan Losses In order to be hedged against losses arising from loan operations, Itaú Unibanco takes into consideration all the aspects that deteie the liet’s edit isk to estalish the poi sio leel that is appopiate to the isk iued i eah operation. For each operation, the assessment and the client or economic group rating, the operation rating, and the possible existence of overdue amounts are taken into account and the volume of the regulatory provision is determined. 26 Itaú Unibanco

Risk and Capital Management – Pillar 3 Allowance for Loan Losses - Quarterly evolution R$ million 12/31/2019 09/30/2019 Necessary Necessary (1) (1) Opening Balance Write-Off Opening Balance Write-Off accounting net Final Balance accounting net Final Balance provisions provisions Public Sector (2) (1) - (3) (1) (1) - (2) Private Sector (34,475) (9,864) 4,550 (39,789) (33,090) (5,534) 4,149 (34,475) Companies (15,071) (2,429) 1,062 (16,438) (14,236) (1,912) 1,077 (15,071) Industry and Commerce (4,178) (992) 495 (4,675) (4,036) (596) 454 (4,178) Services (8,757) (1,171) 374 (9,554) (7,921) (1,246) 410 (8,757) Primary (1,000) (31) 192 (839) (1,316) 104 212 (1,000) Other (1,136) (235) 1 (1,370) (963) (174) 1 (1,136) Individuals (19,404) (7,435) 3,488 (23,351) (18,854) (3,622) 3,072 (19,404) Total (34,477) (9,865) 4,550 (39,792) (33,091) (5,535) 4,149 (34,477) (1) Comprises provisions for financial guarantees provided of R$ 858 in Dec/19 and R$ 1,010 in Sep/19, registered in the liabilities, according to CMN Resolution 4,512 and BACEN Circular Letter 3,782. Mitigating Instruments Itaú Unibanco uses guarantees aiming at increasing resilience in operations with credit risk. The using guarantees can be personal guarantees, secured guarantees, legal structures with mitigating power and netting arrangements. To be considered as credit risk mitigation instrument, the guarantees need to comply with requirements and determinations of the regulations that govern them whether internal or external and be legally valid (effective), enforceable and regularly evaluated. In the case of secured guarantees, legal structures with mitigating effects and netting arrangements, mitigation depends on established methods approved by the business units responsible for managing credit risk and the central credit risk control area. Such methods take into account factors relating to the legal enforcement of the security, the costs involved in the process and the expected execution value, considering market volatility and liquidity. Additionally, concentration of these instruments in the credit portfolio is monitored on a regular basis. Lastly, personal guarantees and the purchase of protection through credit derivatives mitigate credit risk by sustitutig the take’s isk paaetes ith those of the guaato. Itaú Unibanco also uses credit derivatives to mitigate the credit risk of its portfolios of securities. These instruments are priced based on models that use the fair value of market inputs, such as credit spreads, recovery rates, correlations and interest rates. In order to use each type of mitigating instrument to calculate the regulatory capital, Itaú Unibanco compares the specifications of the instrument to the requirements provided for in the prudential regulations in force. In this process, the institution assesses the coverage level of mitigated exposures, the risk weights (FPR) of the mitigation instruments, maturity terms, and currencies of denomination or indexation, among other aspects. In the case of credit transactions mitigated by fiduciary transfer or 1st-degree mortgage on residential property, mitigation is definite by the FPR applied to the exposure, as provided for in BACEN Circular 3,644. Therefore, these transactions are not subject to the provisions set forth in BACEN Circular 3,809. The table below presents the total amount covered by mitigation instruments (collaterals and guarantees), calculated in accordance with BACEN Circular 3,809. As provided for in the Circular, at the beginning of each fiscal year, the institution must choose between the Simple or Comprehensive Approach for credit risk mitigation. Itaú Unibanco began to use the Comprehensive Approach as from January, 2019. Total Mitigation R$ million 12/31/2019 09/30/2019 12/31/2018 (1) (2) 282,744 3 03,751 4 28,104 Collateral Other Guarantees 4 5,680 4 7,538 4 6,968 FPR 0% 6,978 8,664 7,219 FPR 20% 24 - 1 ,720 FPR 50% 3 7,898 37,839 37,312 FPR 85% 780 1,034 717 (1) (2) Netting 43,474 3 9,684 388,327 (1) As from Jan/19, the Comprehensive Approach was adopted for the application of mitigating instruments (2) As from June 2019, the calculation of the exposure value of the Counterparty Credit Risk for derivatives considers the Standardized Approach to Counterparty Credit Risk (SA-CCR). In this approach the reported values represent the impacts of mitigators on exposures, not on the notional value of the derivatives. Applying the same methodology to the reference date of December 2018, the amounts corresponding to the Collateral, to the Other Guarantees and to the Netting would be R$ 337,285 million, R$ 45,270 million and R$ 13,758 million, respectively. 27 Itaú Unibanco Risk and Capital Management – Pillar 3 Allowance for Loan Losses - Quarterly evolution R$ million 12/31/2019 09/30/2019 Necessary Necessary (1) (1) Opening Balance Write-Off Opening Balance Write-Off accounting net Final Balance accounting net Final Balance provisions provisions Public Sector (2) (1) - (3) (1) (1) - (2) Private Sector (34,475) (9,864) 4,550 (39,789) (33,090) (5,534) 4,149 (34,475) Companies (15,071) (2,429) 1,062 (16,438) (14,236) (1,912) 1,077 (15,071) Industry and Commerce (4,178) (992) 495 (4,675) (4,036) (596) 454 (4,178) Services (8,757) (1,171) 374 (9,554) (7,921) (1,246) 410 (8,757) Primary (1,000) (31) 192 (839) (1,316) 104 212 (1,000) Other (1,136) (235) 1 (1,370) (963) (174) 1 (1,136) Individuals (19,404) (7,435) 3,488 (23,351) (18,854) (3,622) 3,072 (19,404) Total (34,477) (9,865) 4,550 (39,792) (33,091) (5,535) 4,149 (34,477) (1) Comprises provisions for financial guarantees provided of R$ 858 in Dec/19 and R$ 1,010 in Sep/19, registered in the liabilities, according to CMN Resolution 4,512 and BACEN Circular Letter 3,782. Mitigating Instruments Itaú Unibanco uses guarantees aiming at increasing resilience in operations with credit risk. The using guarantees can be personal guarantees, secured guarantees, legal structures with mitigating power and netting arrangements. To be considered as credit risk mitigation instrument, the guarantees need to comply with requirements and determinations of the regulations that govern them whether internal or external and be legally valid (effective), enforceable and regularly evaluated. In the case of secured guarantees, legal structures with mitigating effects and netting arrangements, mitigation depends on established methods approved by the business units responsible for managing credit risk and the central credit risk control area. Such methods take into account factors relating to the legal enforcement of the security, the costs involved in the process and the expected execution value, considering market volatility and liquidity. Additionally, concentration of these instruments in the credit portfolio is monitored on a regular basis. Lastly, personal guarantees and the purchase of protection through credit derivatives mitigate credit risk by sustitutig the take’s isk paaetes ith those of the guaato. Itaú Unibanco also uses credit derivatives to mitigate the credit risk of its portfolios of securities. These instruments are priced based on models that use the fair value of market inputs, such as credit spreads, recovery rates, correlations and interest rates. In order to use each type of mitigating instrument to calculate the regulatory capital, Itaú Unibanco compares the specifications of the instrument to the requirements provided for in the prudential regulations in force. In this process, the institution assesses the coverage level of mitigated exposures, the risk weights (FPR) of the mitigation instruments, maturity terms, and currencies of denomination or indexation, among other aspects. In the case of credit transactions mitigated by fiduciary transfer or 1st-degree mortgage on residential property, mitigation is definite by the FPR applied to the exposure, as provided for in BACEN Circular 3,644. Therefore, these transactions are not subject to the provisions set forth in BACEN Circular 3,809. The table below presents the total amount covered by mitigation instruments (collaterals and guarantees), calculated in accordance with BACEN Circular 3,809. As provided for in the Circular, at the beginning of each fiscal year, the institution must choose between the Simple or Comprehensive Approach for credit risk mitigation. Itaú Unibanco began to use the Comprehensive Approach as from January, 2019. Total Mitigation R$ million 12/31/2019 09/30/2019 12/31/2018 (1) (2) 282,744 3 03,751 4 28,104 Collateral Other Guarantees 4 5,680 4 7,538 4 6,968 FPR 0% 6,978 8,664 7,219 FPR 20% 24 - 1 ,720 FPR 50% 3 7,898 37,839 37,312 FPR 85% 780 1,034 717 (1) (2) Netting 43,474 3 9,684 388,327 (1) As from Jan/19, the Comprehensive Approach was adopted for the application of mitigating instruments (2) As from June 2019, the calculation of the exposure value of the Counterparty Credit Risk for derivatives considers the Standardized Approach to Counterparty Credit Risk (SA-CCR). In this approach the reported values represent the impacts of mitigators on exposures, not on the notional value of the derivatives. Applying the same methodology to the reference date of December 2018, the amounts corresponding to the Collateral, to the Other Guarantees and to the Netting would be R$ 337,285 million, R$ 45,270 million and R$ 13,758 million, respectively. 27 Itaú Unibanco

Risk and Capital Management – Pillar 3 Counterparty Credit Risk Counterparty credit risk is the possibility of noncompliance with obligations related to the settlement of transactions that involve the trading of financial assets with a bilateral risk. It encompasses derivative financial instruments, settlement pending transactions, securities lending and repurchase transactions. Itaú Unibanco has well-defined rules for calculating its exposure, and the models designed are used both for controlling the use of counterparty limits and for allocating capital. For derivatives, Itaú Unibanco uses the potential credit risk (PCR) too, interpreted as the value of the potential financial exposure that a transaction can attain upon maturity. After the at uit of a deiat ie otat, Itaú Uiao’s patie is to set up a poi sio fo the aouts eeia le o these instruments. Netting agreements are defined by CMN Resolution 3,263 and, as from January 2017, Itaú Unibanco has been considering this resolution in the calculation of its regulatory capital, in accordance with BACEN Circular 3,809. According to BACEN Circular 3,644, for the calculation of the net global exposure to the counterparty credit risk arising from unsettled operations, the application of the Unsettled Operation Credit Conversion Factor (FCL) is considered. According to BACEN Circular 3,904, as of June 2019, the exposure value of the Counterparty Credit Risk arising from operations with derivative financial instruments shall be calculated using the SA-CCR Approach (Standardized Approach to Counterparty Credit Risk). Derivative Contracts Subject to Counterparty Credit Risk R$ million 12/31/2019 09/30/2019 12/31/2018 (1) 7 ,340 6,598 6,623 Settled in a settlement system (Stock Exchange) Notional Value 1,921,308 1,632,913 1 ,056,925 Potential Future Exposures 1,547 3,252 1,942 Gross Positive Value 1 4,617 1 4,019 4,680 Effects of netting agreements 8,824 10,673 - Not settled i a settl eet syste Oe-the-Coute – ith ollateal - - - Notional Value 690,058 5 69,380 248,754 Potential Future Exposures 5 ,361 3,031 3,263 Gross Positive Value 15,607 15,117 6,695 Effects of netting agreements 1 9,836 1 7,570 6,043 Effect of collateral 1 ,131 578 3,914 Not settled i a settl eet syste Oe-the-Coute – ithout ollateal 13,727 1 6,104 20,065 Notional Value 3 87,919 4 96,325 1 ,151,793 Potential Future Exposures 3 ,937 4,256 8,224 Gross Positive Value 9 ,790 11,848 11,841 (2) 2 1,067 2 2,702 26,687 Net exposure to derivatives (1) Amounts regarding contracts settled in a clearing and settlement system in which the clearinghouse operates as central counterparty. (2) As from June 2019, the SA-CCR Approach (Standardized Approach to Counterparty Credit Risk) was adopted for the calculation of the exposure values to Counterparty Credit Risk for derivatives. Previously, the exposure value was calculated using the Current Exposure Method (CEM) approach. Transactions carried out on behalf of Clients Subject to Counterparty Credit Risk R$ million 12/31/2019 09/30/2019 12/31/2018 (1) Derivatives Contracts 812 916 1,155 Notional Value 4,710,179 3,393,049 1,279,432 Potential Future Exposures 3,547 3,832 3,783 Gross Positive Value 12,025 8,525 4,343 Effects of netting agreements 14,760 11,441 - Collaterals - - 6,972 Security lending and borrowing 1,348 791 2,207 Notional Value 15,291 12,825 5,328 Collaterals 13,943 12,034 3,121 Net exposure 2 ,159 1,707 3,361 (1) As from June 2019, the SA-CCR Approach (Standardized Approach to Counterparty Credit Risk) was adopted for the calculation of the exposure values to Counterparty Credit Risk for derivatives. Previously, the exposure value was calculated using the Current Exposure Method (CEM) approach. Itaú Unibanco considers that there is counterparty credit risk in reverse repo agreements (purchase with resale commitment) when the difference between the amount paid and the security received (when the latter is eligible as a mitigator) is positive; and in repo agreements (sale with repurchase commitment), when the difference between the security delivered and the amount received is positive. 28 Itaú Unibanco Risk and Capital Management – Pillar 3 Counterparty Credit Risk Counterparty credit risk is the possibility of noncompliance with obligations related to the settlement of transactions that involve the trading of financial assets with a bilateral risk. It encompasses derivative financial instruments, settlement pending transactions, securities lending and repurchase transactions. Itaú Unibanco has well-defined rules for calculating its exposure, and the models designed are used both for controlling the use of counterparty limits and for allocating capital. For derivatives, Itaú Unibanco uses the potential credit risk (PCR) too, interpreted as the value of the potential financial exposure that a transaction can attain upon maturity. After the at uit of a deiat ie otat, Itaú Uiao’s patie is to set up a poi sio fo the aouts eeia le o these instruments. Netting agreements are defined by CMN Resolution 3,263 and, as from January 2017, Itaú Unibanco has been considering this resolution in the calculation of its regulatory capital, in accordance with BACEN Circular 3,809. According to BACEN Circular 3,644, for the calculation of the net global exposure to the counterparty credit risk arising from unsettled operations, the application of the Unsettled Operation Credit Conversion Factor (FCL) is considered. According to BACEN Circular 3,904, as of June 2019, the exposure value of the Counterparty Credit Risk arising from operations with derivative financial instruments shall be calculated using the SA-CCR Approach (Standardized Approach to Counterparty Credit Risk). Derivative Contracts Subject to Counterparty Credit Risk R$ million 12/31/2019 09/30/2019 12/31/2018 (1) 7 ,340 6,598 6,623 Settled in a settlement system (Stock Exchange) Notional Value 1,921,308 1,632,913 1 ,056,925 Potential Future Exposures 1,547 3,252 1,942 Gross Positive Value 1 4,617 1 4,019 4,680 Effects of netting agreements 8,824 10,673 - Not settled i a settl eet syste Oe-the-Coute – ith ollateal - - - Notional Value 690,058 5 69,380 248,754 Potential Future Exposures 5 ,361 3,031 3,263 Gross Positive Value 15,607 15,117 6,695 Effects of netting agreements 1 9,836 1 7,570 6,043 Effect of collateral 1 ,131 578 3,914 Not settled i a settl eet syste Oe-the-Coute – ithout ollateal 13,727 1 6,104 20,065 Notional Value 3 87,919 4 96,325 1 ,151,793 Potential Future Exposures 3 ,937 4,256 8,224 Gross Positive Value 9 ,790 11,848 11,841 (2) 2 1,067 2 2,702 26,687 Net exposure to derivatives (1) Amounts regarding contracts settled in a clearing and settlement system in which the clearinghouse operates as central counterparty. (2) As from June 2019, the SA-CCR Approach (Standardized Approach to Counterparty Credit Risk) was adopted for the calculation of the exposure values to Counterparty Credit Risk for derivatives. Previously, the exposure value was calculated using the Current Exposure Method (CEM) approach. Transactions carried out on behalf of Clients Subject to Counterparty Credit Risk R$ million 12/31/2019 09/30/2019 12/31/2018 (1) Derivatives Contracts 812 916 1,155 Notional Value 4,710,179 3,393,049 1,279,432 Potential Future Exposures 3,547 3,832 3,783 Gross Positive Value 12,025 8,525 4,343 Effects of netting agreements 14,760 11,441 - Collaterals - - 6,972 Security lending and borrowing 1,348 791 2,207 Notional Value 15,291 12,825 5,328 Collaterals 13,943 12,034 3,121 Net exposure 2 ,159 1,707 3,361 (1) As from June 2019, the SA-CCR Approach (Standardized Approach to Counterparty Credit Risk) was adopted for the calculation of the exposure values to Counterparty Credit Risk for derivatives. Previously, the exposure value was calculated using the Current Exposure Method (CEM) approach. Itaú Unibanco considers that there is counterparty credit risk in reverse repo agreements (purchase with resale commitment) when the difference between the amount paid and the security received (when the latter is eligible as a mitigator) is positive; and in repo agreements (sale with repurchase commitment), when the difference between the security delivered and the amount received is positive. 28 Itaú Unibanco

Risk and Capital Management – Pillar 3 Repurchase Agreements Subject to Counterparty Credit Risk R$ million 12/31/2019 09/30/2019 12/31/2018 (1) Settled in a settlement system 3,776 3 ,802 2,804 Reverse repo agreements - - 2,221 (2) 1 95,232 237,645 277,241 Notional Value Effect of collateral 1 95,232 237,645 275,020 Repo agreements 3,776 3 ,802 583 (2) Notional Value 204,171 228,414 230,390 Effect of collateral 200,396 224,612 229,807 Not settled in a settlement system 8 ,129 7 ,631 4,855 Reverse repo agreements 305 368 164 (2) 1,272 1 ,505 345 Notional Value Effect of collateral 967 1,137 181 Repo agreements 7,824 7 ,263 4,691 (2) Notional Value 55,204 46,290 6 4,808 Effect of collateral 47,380 3 9,027 60,117 Net exposure to repurchase agreements 11,905 11,433 7,659 (1) Amounts regarding contracts settled in a clearing and settlement system (Stock Exchange, Selic or similar). (2) The notional value of repurchase agreements is similar to their positive gross value. (1) Other Agreements Subject to Counterparty Credit Risk R$ million 12/31/2019 09/30/2019 12/31/2018 (2) 1 3,170 16,276 1 4,218 Notional Value Collateral posted in favor of clearing houses 13,231 12,730 9,166 Effects of netting agreements - - - Effect of collateral - - - (3) Net exposure 1 4,395 13,506 9 ,897 (1) Includes securities agreements to be settled, as well as forex agreements, and rights on securities lending (2) The notional value of these agreements is similar to their positive gross value. (3) Exposure amount after the application of FCL, according to BACEN Circular 3,644. Exposure to Counterparty Credit Risk R$ million 12/31/2019 09/30/2019 12/31/2018 Net global exposure to counterparty credit risk 49,526 4 9,348 4 7,605 (1) 21,067 2 2,702 26,687 Net exposure to derivatives Net exposure to repurchase agreements 1 1,905 1 1,433 7 ,659 Net exposure to other agreements subject to counterparty credit risk 1 4,395 13,506 9 ,897 Net exposure by transactions carried out on behalf of Clients 2,159 1,707 3,361 (1) As from June 2019, the SA-CCR Approach (Standardized Approach to Counterparty Credit Risk) was adopted for the calculation of the exposure values to Counterparty Credit Risk for derivatives. Previously, the exposure value was calculated using the Current Exposure Method (CEM) approach. Acquisitions, Sale or Transfer of Financial Assets The acquisition of financial assets follows the same policies and the same credit governance established for the portfolios originated at Itaú Unibanco. Financial asset acquisitions aim at increasing loan portfolio diversification and meeting the liets’ dea ds fo liuidit. The pupose of the sale ad ta sfe of fiaial assets is to e et iesto dea d fo credit assets or work as a portfolio credit risk management instrument. Credit assignments (transfers of receivables) carried out through December 2011 were recorded in accordance with current regulation together with income recognition at the time of the assignment, regardless of the risks and rewards being retained or not. Since January 2012, as determined by CMN Resolution 3,533 and supplementary regulation, accounting records take into consideration the retention or non-retention of risks and benefits on sale or transfers of financial assets. Sale or Transfer of Financial Assets R$ million 12/31/2019 09/30/2019 12/31/2018 Sale of exposures with co-obligation registered in memorandum accounts 66 71 85 Balance of sale of exposure with substantial retention of risks and benefits 2,455 3,172 4,003 Securitization Companies 2,4 25 3,142 3,9 70 Financial institutions 30 30 33 29 Itaú Unibanco Risk and Capital Management – Pillar 3 Repurchase Agreements Subject to Counterparty Credit Risk R$ million 12/31/2019 09/30/2019 12/31/2018 (1) Settled in a settlement system 3,776 3 ,802 2,804 Reverse repo agreements - - 2,221 (2) 1 95,232 237,645 277,241 Notional Value Effect of collateral 1 95,232 237,645 275,020 Repo agreements 3,776 3 ,802 583 (2) Notional Value 204,171 228,414 230,390 Effect of collateral 200,396 224,612 229,807 Not settled in a settlement system 8 ,129 7 ,631 4,855 Reverse repo agreements 305 368 164 (2) 1,272 1 ,505 345 Notional Value Effect of collateral 967 1,137 181 Repo agreements 7,824 7 ,263 4,691 (2) Notional Value 55,204 46,290 6 4,808 Effect of collateral 47,380 3 9,027 60,117 Net exposure to repurchase agreements 11,905 11,433 7,659 (1) Amounts regarding contracts settled in a clearing and settlement system (Stock Exchange, Selic or similar). (2) The notional value of repurchase agreements is similar to their positive gross value. (1) Other Agreements Subject to Counterparty Credit Risk R$ million 12/31/2019 09/30/2019 12/31/2018 (2) 1 3,170 16,276 1 4,218 Notional Value Collateral posted in favor of clearing houses 13,231 12,730 9,166 Effects of netting agreements - - - Effect of collateral - - - (3) Net exposure 1 4,395 13,506 9 ,897 (1) Includes securities agreements to be settled, as well as forex agreements, and rights on securities lending (2) The notional value of these agreements is similar to their positive gross value. (3) Exposure amount after the application of FCL, according to BACEN Circular 3,644. Exposure to Counterparty Credit Risk R$ million 12/31/2019 09/30/2019 12/31/2018 Net global exposure to counterparty credit risk 49,526 4 9,348 4 7,605 (1) 21,067 2 2,702 26,687 Net exposure to derivatives Net exposure to repurchase agreements 1 1,905 1 1,433 7 ,659 Net exposure to other agreements subject to counterparty credit risk 1 4,395 13,506 9 ,897 Net exposure by transactions carried out on behalf of Clients 2,159 1,707 3,361 (1) As from June 2019, the SA-CCR Approach (Standardized Approach to Counterparty Credit Risk) was adopted for the calculation of the exposure values to Counterparty Credit Risk for derivatives. Previously, the exposure value was calculated using the Current Exposure Method (CEM) approach. Acquisitions, Sale or Transfer of Financial Assets The acquisition of financial assets follows the same policies and the same credit governance established for the portfolios originated at Itaú Unibanco. Financial asset acquisitions aim at increasing loan portfolio diversification and meeting the liets’ dea ds fo liuidit. The pupose of the sale ad ta sfe of fiaial assets is to e et iesto dea d fo credit assets or work as a portfolio credit risk management instrument. Credit assignments (transfers of receivables) carried out through December 2011 were recorded in accordance with current regulation together with income recognition at the time of the assignment, regardless of the risks and rewards being retained or not. Since January 2012, as determined by CMN Resolution 3,533 and supplementary regulation, accounting records take into consideration the retention or non-retention of risks and benefits on sale or transfers of financial assets. Sale or Transfer of Financial Assets R$ million 12/31/2019 09/30/2019 12/31/2018 Sale of exposures with co-obligation registered in memorandum accounts 66 71 85 Balance of sale of exposure with substantial retention of risks and benefits 2,455 3,172 4,003 Securitization Companies 2,4 25 3,142 3,9 70 Financial institutions 30 30 33 29 Itaú Unibanco

Risk and Capital Management – Pillar 3 Sale or Transfer of Financial Assets R$ million 4th quarter 3rd quarter 2nd quarter 1st quarter 4th quarter 2019 2019 2019 2019 2018 Flow of sale exposure in the quarter with substantial transfer of risks and rewards 821 327 207 177 1,564 Credit rights Investments Fund (FIDC) 212 274 94 40 674 Securitization Companies - 39 35 4 53 Financial institutions - - - - 217 Specific Purpose Company (SPE) 30 - - - - (1) 579 14 78 133 620 Other (1) Operations with the public sector and other legal entities Sale or Transfer of Financial Assets R$ million 4th quarter 3rd quarter 2nd quarter 1st quarter 4th quarter 2019 2019 2019 2019 2018 Total exposures acquired WITH retention of assignor's risks and rewards 300 125 111 104 102 Acquisition of Financial Assets R$ million 12/31/2019 09/30/2019 12/31/2018 Acquisitions of loan portfolios WITH the retention of assignor's risks and rewards a) By type of exposure 510 266 472 Individuals - Vehicle and Leasing 498 227 338 Companies -Loans (CCB) - - 1 Companies - Other 12 39 133 b) By type of assignor 510 266 472 Financial institutions 510 266 472 Acquisition of Financial Assets R$ million 12/31/2019 09/30/2019 12/31/2018 Acquisitions of loan portfolios with NO retention of assignor's risks and rewards a) By type of exposure 1 ,069 1,138 1,490 Individuals - Payroll 1 ,069 1 ,138 1,490 b) By type of assignor 1,069 1,138 1,490 Financial institutions 1 ,069 1 ,138 1,490 Operations of Securitization Itaú Uiao’s potfolio iludes seuities aisig fo seuitizatio poesses. The potfolio is ad e up of Seuitized Real Estate Loans (CRI), quotas of Credit Rights Investment Funds (FIDC) and Agribusiness Receivables Certificate (CRA) and debentures with securitization characteristics (issues whose flow of receipts is dependent on the performance of the underlying receivables). Exposure to securitization of FIDC, in the consolidated accounts, includes only fund units not consolidated in the Prudential Conglomerate. According to BACEN Circular 3,701, FIDC units when the institution has control or retains risks and rewards must be consolidated in the Prudential Conglomerate. Itaú Unibanco classifies securities arising from securitization processes based on the governance of products determined, and the credit is approved at the proper authority levels. Itaú Unibanco follows risk retention guidelines of CMN Resolution 3,533. The balances of these operations are presented below. 30 Itaú Unibanco Risk and Capital Management – Pillar 3 Sale or Transfer of Financial Assets R$ million 4th quarter 3rd quarter 2nd quarter 1st quarter 4th quarter 2019 2019 2019 2019 2018 Flow of sale exposure in the quarter with substantial transfer of risks and rewards 821 327 207 177 1,564 Credit rights Investments Fund (FIDC) 212 274 94 40 674 Securitization Companies - 39 35 4 53 Financial institutions - - - - 217 Specific Purpose Company (SPE) 30 - - - - (1) 579 14 78 133 620 Other (1) Operations with the public sector and other legal entities Sale or Transfer of Financial Assets R$ million 4th quarter 3rd quarter 2nd quarter 1st quarter 4th quarter 2019 2019 2019 2019 2018 Total exposures acquired WITH retention of assignor's risks and rewards 300 125 111 104 102 Acquisition of Financial Assets R$ million 12/31/2019 09/30/2019 12/31/2018 Acquisitions of loan portfolios WITH the retention of assignor's risks and rewards a) By type of exposure 510 266 472 Individuals - Vehicle and Leasing 498 227 338 Companies -Loans (CCB) - - 1 Companies - Other 12 39 133 b) By type of assignor 510 266 472 Financial institutions 510 266 472 Acquisition of Financial Assets R$ million 12/31/2019 09/30/2019 12/31/2018 Acquisitions of loan portfolios with NO retention of assignor's risks and rewards a) By type of exposure 1 ,069 1,138 1,490 Individuals - Payroll 1 ,069 1 ,138 1,490 b) By type of assignor 1,069 1,138 1,490 Financial institutions 1 ,069 1 ,138 1,490 Operations of Securitization Itaú Uiao’s potfolio iludes seuities aisig fo seuitizatio poesses. The potfolio is ad e up of Seuitized Real Estate Loans (CRI), quotas of Credit Rights Investment Funds (FIDC) and Agribusiness Receivables Certificate (CRA) and debentures with securitization characteristics (issues whose flow of receipts is dependent on the performance of the underlying receivables). Exposure to securitization of FIDC, in the consolidated accounts, includes only fund units not consolidated in the Prudential Conglomerate. According to BACEN Circular 3,701, FIDC units when the institution has control or retains risks and rewards must be consolidated in the Prudential Conglomerate. Itaú Unibanco classifies securities arising from securitization processes based on the governance of products determined, and the credit is approved at the proper authority levels. Itaú Unibanco follows risk retention guidelines of CMN Resolution 3,533. The balances of these operations are presented below. 30 Itaú Unibanco

Risk and Capital Management – Pillar 3 (1) Securitization Exposures R$ million 12/31/2019 09/30/2019 12/31/2018 CRI 7 ,291 9 ,151 11,086 Mortgage Loans 7,291 9 ,151 11,086 Single-Tranche 6 ,260 7 ,951 9,684 Subordinated 1,031 1 ,200 1,402 CRA 519 274 170 519 274 170 Credit Related to Agribusiness Single-Tranche 519 274 170 FIDC 2 ,764 2 ,978 225 Credit Rights 2 ,764 2 ,978 225 Senior 2,764 2 ,978 225 Debenture 103 103 82 Loan portfolio 103 103 82 Single-Tranche 103 103 82 Total 1 0,677 1 2,507 11,563 (1) Traditional securitization. The table below presents the summary of the securitization activity in the period: (1) Securitization Activities in the Period R$ million 4th quarter 3rd quarter 2nd quarter 1st quarter 4th quarter 2019 2019 2019 2019 2018 CRI 195 612 150 75 62 Mortgage Loans 195 612 150 75 62 FIDC 366 90 1, 851 575 - 366 90 1,851 575 - Credit Rights CRA 322 381 446 130 - 322 381 446 130 - Credit Related to Agribusiness Total 883 1, 084 2,447 780 62 (1) Traditional securitization. It should be noted that the portion of RWA attributable to securitization exposure did not exceed 5% of the total on CPAD December 31, 2019. Itaú Unibanco ascertains its gains and losses with the securitization process taking into account its different activities as originator or investor, in other words, the participant that assigns portfolios for securitization purposes, and the trader of securitized assets, respectively. As originator, gains and losses are calculated as the difference between the sum received for assets transferred to the securitizing institutions and the book value of the portfolio. As investor, the calculation takes into account the difference between the sale amount and the book value of the securitized paper. Gains and losses on securitization are disclosed when they are material. Credit Derivatives Itaú Unibanco buys and sells credit protection in order to meet the needs of its customers. CDS (credit default swap) is credit derivative in which, upon a default related to the reference entity, the protection buyer is entitled to receive, from the protection seller, the amount equivalent to the difference between the face value of the CDS contract and the fair value of the liability on the date the contract was settled, also known as the recovered amount. The protection buyer does not need to hold the debt instrument of the reference entity for it to receive the amounts due pursuant to the CDS contract terms when a credit event occurs. TRS (total return swap) is a transaction in which a party swaps the total return of an asset or of a basket of assets for regular cash flows, usually interest and a guarantee against capital loss. In a TRS contract, the parties do not transfer the ownership of the assets. 31 Itaú Unibanco Risk and Capital Management – Pillar 3 (1) Securitization Exposures R$ million 12/31/2019 09/30/2019 12/31/2018 CRI 7 ,291 9 ,151 11,086 Mortgage Loans 7,291 9 ,151 11,086 Single-Tranche 6 ,260 7 ,951 9,684 Subordinated 1,031 1 ,200 1,402 CRA 519 274 170 519 274 170 Credit Related to Agribusiness Single-Tranche 519 274 170 FIDC 2 ,764 2 ,978 225 Credit Rights 2 ,764 2 ,978 225 Senior 2,764 2 ,978 225 Debenture 103 103 82 Loan portfolio 103 103 82 Single-Tranche 103 103 82 Total 1 0,677 1 2,507 11,563 (1) Traditional securitization. The table below presents the summary of the securitization activity in the period: (1) Securitization Activities in the Period R$ million 4th quarter 3rd quarter 2nd quarter 1st quarter 4th quarter 2019 2019 2019 2019 2018 CRI 195 612 150 75 62 Mortgage Loans 195 612 150 75 62 FIDC 366 90 1, 851 575 - 366 90 1,851 575 - Credit Rights CRA 322 381 446 130 - 322 381 446 130 - Credit Related to Agribusiness Total 883 1, 084 2,447 780 62 (1) Traditional securitization. It should be noted that the portion of RWA attributable to securitization exposure did not exceed 5% of the total on CPAD December 31, 2019. Itaú Unibanco ascertains its gains and losses with the securitization process taking into account its different activities as originator or investor, in other words, the participant that assigns portfolios for securitization purposes, and the trader of securitized assets, respectively. As originator, gains and losses are calculated as the difference between the sum received for assets transferred to the securitizing institutions and the book value of the portfolio. As investor, the calculation takes into account the difference between the sale amount and the book value of the securitized paper. Gains and losses on securitization are disclosed when they are material. Credit Derivatives Itaú Unibanco buys and sells credit protection in order to meet the needs of its customers. CDS (credit default swap) is credit derivative in which, upon a default related to the reference entity, the protection buyer is entitled to receive, from the protection seller, the amount equivalent to the difference between the face value of the CDS contract and the fair value of the liability on the date the contract was settled, also known as the recovered amount. The protection buyer does not need to hold the debt instrument of the reference entity for it to receive the amounts due pursuant to the CDS contract terms when a credit event occurs. TRS (total return swap) is a transaction in which a party swaps the total return of an asset or of a basket of assets for regular cash flows, usually interest and a guarantee against capital loss. In a TRS contract, the parties do not transfer the ownership of the assets. 31 Itaú Unibanco

Risk and Capital Management – Pillar 3 Notional Amount of Credit Derivatives Held in Portfolio R$ million 12/31/2019 09/30/2019 12/31/2018 Risk Transferred 2,295 2 ,848 1,471 Credit Default Swap (CDS) 2 ,295 2 ,848 1,471 Risk Received (10,444) (10,684) (6,853) Credit Default Swap (CDS) (6 ,283) (7 ,399) (6,853) Total Return Swap (TRS) (4 ,161) (3 ,285) - Total (8,149) (7,836) (5,382) Required capital of Risk Received 57 59 46 32 Itaú Unibanco Risk and Capital Management – Pillar 3 Notional Amount of Credit Derivatives Held in Portfolio R$ million 12/31/2019 09/30/2019 12/31/2018 Risk Transferred 2,295 2 ,848 1,471 Credit Default Swap (CDS) 2 ,295 2 ,848 1,471 Risk Received (10,444) (10,684) (6,853) Credit Default Swap (CDS) (6 ,283) (7 ,399) (6,853) Total Return Swap (TRS) (4 ,161) (3 ,285) - Total (8,149) (7,836) (5,382) Required capital of Risk Received 57 59 46 32 Itaú Unibanco

Risk and Capital Management – Pillar 3 6 Market Risk 6.1 Framework and Treatment Market risk is the possibility of losses resulting from fluctuations in the market values of positions held by a financial institution, including the risk of operations subject to variations in foreign exchange rates, interest rates, price indexes, equity and commodity prices. Itaú Uiao’s istitutioal polii es ad geeal a ket isk a age et faeo k ae i lie i th the piiples of CMN Resolution 4,557, and subsequent amendments. These principles guide the approach to market risk control across the institution. Itaú Uiao’s a ket isk a ageet stateg is aied at alaig opoate usi ess goals, takig ito aout, among other factors: • Political, economic and market conditions; • The profile of Itaú Unibanco´s portfolio; and • Capacity to act in specific markets. The key principles underlying Itaú Uiao’s market risk control structure are as follows: • Provide visibility and comfort for all senior management levels that market risks assumed must be in line with Itaú Unibanco risk-return objectives; • Provide disciplined and informed dialogue on the overall market risk profile and its evolution over time; • Increase transparency as to how the business works to optimize results; • Provide early warning mechanisms to facilitate effective risk management, without obstructing the business objectives; and • Monitor and avoid concentration of risks. Market risk is controlled by an area independent of the business units, which is responsible for the daily activities: (i) measuring and assessing risk, (ii) monitoring stress scenarios, limits and alerts, (iii) applying, analyzing and stress testing scenarios, (iv) reporting risk to the individuals responsible in the business units, in compliance with Itaú Unibanco´s governance, (v) monitoring the measures needed to adjust positions and/or risk levels to make them viable, and (vi) supporting the secure launch of new financial products. The CMN has regulations that establish the segregation of exposure to market risk into risk factors, such as: interest rates, exchange rates, stocks and commodities. Brazilian inflation indices are also treated as a group of risk factors and follow the same structure of limits governance. The structure of limits and alerts is in alignment with the board of directors' guidelines, being reviewed and approved on an annual basis. This structure extends to specific limits and is aimed at improving the process of risk monitoring and understanding as well as preventing risk concentration. Limits and alerts are calibrated based on projections of future balance sheets, stokholdes’ euit, liquidity, complexity and market volatility, as well as the Itaú Uiao’s isk appetite. In an attempt to fit the transactions into the defined limits, Itaú Unibanco hedges its client transactions and proprietary positions, including investments overseas. Derivatives are the most commonly used instruments for carrying out these hedging activities, and can be characterized as either accounting or economic hedge, both of which are governed by institutional regulations at Itaú Unibanco. Hedge accounting considerations are presented in detail in Note 5f V – Accounting hedge to the Cop lete Fiaial Statements, that can be found on the website www.itau.com.br/investor-relations. Market risk management framework categorizes transactions as part of either the Trading Book or the Baking Book, in accordance with general criteria established by CMN Resolution 4,557 and BACEN Circular 3,354. Trading Book is composed of all trades with financial and commodity instruments (including derivatives) undertaken with the intention of trading. Banking Book is predominantly characterized by portfolios originated from the banking business and operations related to balance sheet management, are intended to be either held to maturity, or sold in the medium and in the long term. Market risk management is based on the following key metrics: • Value at Risk (VaR): a statistical metric that quantifies the maximum potential economic loss expected in normal market conditions, considering a defined holding period and confidence interval; 33 Itaú Unibanco Risk and Capital Management – Pillar 3 6 Market Risk 6.1 Framework and Treatment Market risk is the possibility of losses resulting from fluctuations in the market values of positions held by a financial institution, including the risk of operations subject to variations in foreign exchange rates, interest rates, price indexes, equity and commodity prices. Itaú Uiao’s istitutioal polii es ad geeal a ket isk a age et faeo k ae i lie i th the piiples of CMN Resolution 4,557, and subsequent amendments. These principles guide the approach to market risk control across the institution. Itaú Uiao’s a ket isk a ageet stateg is aied at alaig opoate usi ess goals, takig ito aout, among other factors: • Political, economic and market conditions; • The profile of Itaú Unibanco´s portfolio; and • Capacity to act in specific markets. The key principles underlying Itaú Uiao’s market risk control structure are as follows: • Provide visibility and comfort for all senior management levels that market risks assumed must be in line with Itaú Unibanco risk-return objectives; • Provide disciplined and informed dialogue on the overall market risk profile and its evolution over time; • Increase transparency as to how the business works to optimize results; • Provide early warning mechanisms to facilitate effective risk management, without obstructing the business objectives; and • Monitor and avoid concentration of risks. Market risk is controlled by an area independent of the business units, which is responsible for the daily activities: (i) measuring and assessing risk, (ii) monitoring stress scenarios, limits and alerts, (iii) applying, analyzing and stress testing scenarios, (iv) reporting risk to the individuals responsible in the business units, in compliance with Itaú Unibanco´s governance, (v) monitoring the measures needed to adjust positions and/or risk levels to make them viable, and (vi) supporting the secure launch of new financial products. The CMN has regulations that establish the segregation of exposure to market risk into risk factors, such as: interest rates, exchange rates, stocks and commodities. Brazilian inflation indices are also treated as a group of risk factors and follow the same structure of limits governance. The structure of limits and alerts is in alignment with the board of directors' guidelines, being reviewed and approved on an annual basis. This structure extends to specific limits and is aimed at improving the process of risk monitoring and understanding as well as preventing risk concentration. Limits and alerts are calibrated based on projections of future balance sheets, stokholdes’ euit, liquidity, complexity and market volatility, as well as the Itaú Uiao’s isk appetite. In an attempt to fit the transactions into the defined limits, Itaú Unibanco hedges its client transactions and proprietary positions, including investments overseas. Derivatives are the most commonly used instruments for carrying out these hedging activities, and can be characterized as either accounting or economic hedge, both of which are governed by institutional regulations at Itaú Unibanco. Hedge accounting considerations are presented in detail in Note 5f V – Accounting hedge to the Cop lete Fiaial Statements, that can be found on the website www.itau.com.br/investor-relations. Market risk management framework categorizes transactions as part of either the Trading Book or the Baking Book, in accordance with general criteria established by CMN Resolution 4,557 and BACEN Circular 3,354. Trading Book is composed of all trades with financial and commodity instruments (including derivatives) undertaken with the intention of trading. Banking Book is predominantly characterized by portfolios originated from the banking business and operations related to balance sheet management, are intended to be either held to maturity, or sold in the medium and in the long term. Market risk management is based on the following key metrics: • Value at Risk (VaR): a statistical metric that quantifies the maximum potential economic loss expected in normal market conditions, considering a defined holding period and confidence interval; 33 Itaú Unibanco

Risk and Capital Management – Pillar 3 • Losses in Stress Scenarios (Stress Testing): a simulation technique to evaluate the impact, in the assets, liabilities and derivatives of the portfolio, of various risk factors in extreme market situations (based on prospective and historic scenarios); • Stop Loss: metrics that trigger a management review of positions, if the accumulated losses in a given period reach specified levels; • Concentration: cumulative exposure of certain financial instrument or risk factor calculated at market value ( MtM - Mark to Market ); and • Stressed VaR: statistical metric derived from VaR calculation, aimed at capturing the biggest risk in simulations of the current trading portfolio, taking into consideration the observable returns in historical scenarios of extreme volatility. In addition to the risk metrics described above, sensitivity and loss control measures are also analyzed. They include: • Gap Analysis: accumulated exposure of the cash flows by risk factor, which are marked-to-market and positioned by settlement dates; • Sensitivity (DV01 – Delta Variation Risk): impact on the market value of cash flows when a 1 basis point change is applied to current interest rates or on the index rates; and • Sensitivities to Various Risk Factors (Greeks): partial derivatives of a portfolio of options on the prices of the underlying assets, implied volatilities, interest rates and time. Itaú Unibanco uses proprietary systems to measure the consolidated market risk. The processing of these systems takes place in an access-controlled environment, being highly available, which has data safekeeping and recovery processes, and counts on an infrastructure to ensure the continuity of business in contingency (disaster recovery) situations. The document that details the market risk control institutional policy is on the Investor Relations website www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Reports. 6.2 Portfolio Analysis Interest rate risk in the banking book Interest rate risk is the potential loss associated with variations in these rates in the market in relation to indexer mismatches, maturities and between investments and funding. The methodology adopted involves marking-to-market of the various products, calculating the sensitivity to variations in interest rates, and the value at risk by historical simulation (VaR) as well as stress tests throughout the entire portfolio, as determined by Itaú Unibanco's institutional regulations. In managing the interest rate risk of the loan portfolios that show material early settlements, Itaú Unibanco adjusts the original maturities of transactions, which speeds up the reduction in the originally contracted payment flows so as to better reflect clients' expected behavior. Likewise, the balances of products with no definite expiry date, such as demand deposits and savings accounts, are included in the statistics on the basis of past and seasonal experience. The core portion is distributed over time, thus generating an exposure to changes in interest rates, pursuant to internally approved methodologies. The table below shows the sensitivity of the amount of the banking book positions to changes in interest rate curves, using the methodology and stress scenarios adopted. (1) Sensibility of Banking Position R$ million Exposures 12/31/2019 Risk factors Risk of variation in: Scenario I Scenario II Scenario III Interest Rate Fixed Income Interest Rates in reais (11) (1,291) (2,550) Foreign Exchange Linked Foreign Exchange Linked Interest Rates (3) (175) (335) Price Index Linked Interest of Inflation coupon (7) (537) (992) TR TR Linked Interest Rates 0 (1) 0 (1) Amounts net of tax effects. In order to measure these sensitivities, the following scenarios are used: • Scenario I: Shocks of 1 base point in interest fixed rates, currency coupon, inflation, interest rate indexes, and 1 percentage point in the prices of currencies and shares; • Scenario II: Shocks of 25% in interest fixed rates, currency coupon, inflation, interest rate indexes, and in the prices of currencies and shares, both for growth and fall, considering the largest resulting losses per risk factor; 34 Itaú Unibanco Risk and Capital Management – Pillar 3 • Losses in Stress Scenarios (Stress Testing): a simulation technique to evaluate the impact, in the assets, liabilities and derivatives of the portfolio, of various risk factors in extreme market situations (based on prospective and historic scenarios); • Stop Loss: metrics that trigger a management review of positions, if the accumulated losses in a given period reach specified levels; • Concentration: cumulative exposure of certain financial instrument or risk factor calculated at market value ( MtM - Mark to Market ); and • Stressed VaR: statistical metric derived from VaR calculation, aimed at capturing the biggest risk in simulations of the current trading portfolio, taking into consideration the observable returns in historical scenarios of extreme volatility. In addition to the risk metrics described above, sensitivity and loss control measures are also analyzed. They include: • Gap Analysis: accumulated exposure of the cash flows by risk factor, which are marked-to-market and positioned by settlement dates; • Sensitivity (DV01 – Delta Variation Risk): impact on the market value of cash flows when a 1 basis point change is applied to current interest rates or on the index rates; and • Sensitivities to Various Risk Factors (Greeks): partial derivatives of a portfolio of options on the prices of the underlying assets, implied volatilities, interest rates and time. Itaú Unibanco uses proprietary systems to measure the consolidated market risk. The processing of these systems takes place in an access-controlled environment, being highly available, which has data safekeeping and recovery processes, and counts on an infrastructure to ensure the continuity of business in contingency (disaster recovery) situations. The document that details the market risk control institutional policy is on the Investor Relations website www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Reports. 6.2 Portfolio Analysis Interest rate risk in the banking book Interest rate risk is the potential loss associated with variations in these rates in the market in relation to indexer mismatches, maturities and between investments and funding. The methodology adopted involves marking-to-market of the various products, calculating the sensitivity to variations in interest rates, and the value at risk by historical simulation (VaR) as well as stress tests throughout the entire portfolio, as determined by Itaú Unibanco's institutional regulations. In managing the interest rate risk of the loan portfolios that show material early settlements, Itaú Unibanco adjusts the original maturities of transactions, which speeds up the reduction in the originally contracted payment flows so as to better reflect clients' expected behavior. Likewise, the balances of products with no definite expiry date, such as demand deposits and savings accounts, are included in the statistics on the basis of past and seasonal experience. The core portion is distributed over time, thus generating an exposure to changes in interest rates, pursuant to internally approved methodologies. The table below shows the sensitivity of the amount of the banking book positions to changes in interest rate curves, using the methodology and stress scenarios adopted. (1) Sensibility of Banking Position R$ million Exposures 12/31/2019 Risk factors Risk of variation in: Scenario I Scenario II Scenario III Interest Rate Fixed Income Interest Rates in reais (11) (1,291) (2,550) Foreign Exchange Linked Foreign Exchange Linked Interest Rates (3) (175) (335) Price Index Linked Interest of Inflation coupon (7) (537) (992) TR TR Linked Interest Rates 0 (1) 0 (1) Amounts net of tax effects. In order to measure these sensitivities, the following scenarios are used: • Scenario I: Shocks of 1 base point in interest fixed rates, currency coupon, inflation, interest rate indexes, and 1 percentage point in the prices of currencies and shares; • Scenario II: Shocks of 25% in interest fixed rates, currency coupon, inflation, interest rate indexes, and in the prices of currencies and shares, both for growth and fall, considering the largest resulting losses per risk factor; 34 Itaú Unibanco

Risk and Capital Management – Pillar 3 • Scenario III: Shocks of 50% in interest fixed rates, currency coupon, inflation, interest rate indexes, and in the prices of currencies and shares, both for growth and fall, considering the largest resulting losses per risk factor. Evolution of the Trading Book The evolution of the Trading Book, broken down by major risk factors, is tabulated below: Total Value of Trading Position R$ million 12/31/2019 09/30/2019 12/31/2018 Long Short Long Short Long Short Interest Rates 170,726 (160,774) 176,155 (193,895) 188,191 (200,017) Foreign Exchange 113,552 (113,578) 101,922 (102,882) 132,741 (131,969) Equities 469 (169) 268 (187) 3,340 (3,304) Commodities 1,361 (1,372) 1,109 (1,099) 0 (0) Evolution of the Derivatives Portfolio The main purpose of the derivative positions in the Banking Book and Trading Book is to manage risks in these positions and in the corresponding risk factors. Derivatives: Trades in Brazil - Trading + Banking - With Central Counterparty R$ million 12/31/2019 09/30/2019 12/31/2018 Long Short Long Short Long Short Interest Rates 284,380 (81,782) 192,798 (139,748) 135,839 (127,144) Foreign Exchange 166,314 (200,784) 176,087 (201,663) 33,327 (65,325) Equities 600 (186) 1,344 (505) 1,676 (483) Commodities 981 (1,100) 370 (434) 97 (74) Derivatives: Trades in Brazil - Trading + Banking - Without Central Counterparty R$ million 12/31/2019 09/30/2019 12/31/2018 Long Short Long Short Long Short Interest Rates 31,517 (42,525) 34,170 (26,427) 42,441 (34,893) Foreign Exchange 16,863 (32,641) 16,972 (36,975) 13,405 (37,896) Equities 11 (79) - (126) - (37) Commodities 107 - 74 - 37 (51) Derivatives: Foreign Trades - Trading + Banking - With Central Counterparty R$ million 12/31/2019 09/30/2019 12/31/2018 Long Short Long Short Long Short Interest Rates 21,929 (12,932) 17,985 (11,370) 37 (1,975) Foreign Exchange 62,843 (72,285) 82,584 (87,643) 100,892 (96,589) Equities 515 (770) 810 (2,290) 233 (3,402) Derivatives: Foreign Trades - Trading + Banking - Without Central Counterparty R$ milhões 12/31/2019 09/30/2019 12/31/2018 Long Short Long Short Long Short Interest Rates 40,413 (91,245) 40,000 (113,963) 43,950 (105,333) Foreign Exchange 277,082 (265,414) 289,800 (273,098) 236,337 (228,794) VaR – Consolidated Itaú Unibanco Consolidated VaR of Itaú Unibanco is calculated by Historical Simulation, i.e., the expected distribution for profit and loss P&L’s - Profit and loss statement) of a portfolio over a time horizon that can be estimated based on the historical behavior of returns of market risk factors of this portfolio. VaR is calculated at a confidence level of 99%, historical period of 4 years (1000 business days) and a holding period of one day. In addition, in a conservative approach, VaR is calculated daily, being or not volatility-weighted, and the final VaR is the most restrictive value between both methodologies. 35 Itaú Unibanco Risk and Capital Management – Pillar 3 • Scenario III: Shocks of 50% in interest fixed rates, currency coupon, inflation, interest rate indexes, and in the prices of currencies and shares, both for growth and fall, considering the largest resulting losses per risk factor. Evolution of the Trading Book The evolution of the Trading Book, broken down by major risk factors, is tabulated below: Total Value of Trading Position R$ million 12/31/2019 09/30/2019 12/31/2018 Long Short Long Short Long Short Interest Rates 170,726 (160,774) 176,155 (193,895) 188,191 (200,017) Foreign Exchange 113,552 (113,578) 101,922 (102,882) 132,741 (131,969) Equities 469 (169) 268 (187) 3,340 (3,304) Commodities 1,361 (1,372) 1,109 (1,099) 0 (0) Evolution of the Derivatives Portfolio The main purpose of the derivative positions in the Banking Book and Trading Book is to manage risks in these positions and in the corresponding risk factors. Derivatives: Trades in Brazil - Trading + Banking - With Central Counterparty R$ million 12/31/2019 09/30/2019 12/31/2018 Long Short Long Short Long Short Interest Rates 284,380 (81,782) 192,798 (139,748) 135,839 (127,144) Foreign Exchange 166,314 (200,784) 176,087 (201,663) 33,327 (65,325) Equities 600 (186) 1,344 (505) 1,676 (483) Commodities 981 (1,100) 370 (434) 97 (74) Derivatives: Trades in Brazil - Trading + Banking - Without Central Counterparty R$ million 12/31/2019 09/30/2019 12/31/2018 Long Short Long Short Long Short Interest Rates 31,517 (42,525) 34,170 (26,427) 42,441 (34,893) Foreign Exchange 16,863 (32,641) 16,972 (36,975) 13,405 (37,896) Equities 11 (79) - (126) - (37) Commodities 107 - 74 - 37 (51) Derivatives: Foreign Trades - Trading + Banking - With Central Counterparty R$ million 12/31/2019 09/30/2019 12/31/2018 Long Short Long Short Long Short Interest Rates 21,929 (12,932) 17,985 (11,370) 37 (1,975) Foreign Exchange 62,843 (72,285) 82,584 (87,643) 100,892 (96,589) Equities 515 (770) 810 (2,290) 233 (3,402) Derivatives: Foreign Trades - Trading + Banking - Without Central Counterparty R$ milhões 12/31/2019 09/30/2019 12/31/2018 Long Short Long Short Long Short Interest Rates 40,413 (91,245) 40,000 (113,963) 43,950 (105,333) Foreign Exchange 277,082 (265,414) 289,800 (273,098) 236,337 (228,794) VaR – Consolidated Itaú Unibanco Consolidated VaR of Itaú Unibanco is calculated by Historical Simulation, i.e., the expected distribution for profit and loss P&L’s - Profit and loss statement) of a portfolio over a time horizon that can be estimated based on the historical behavior of returns of market risk factors of this portfolio. VaR is calculated at a confidence level of 99%, historical period of 4 years (1000 business days) and a holding period of one day. In addition, in a conservative approach, VaR is calculated daily, being or not volatility-weighted, and the final VaR is the most restrictive value between both methodologies. 35 Itaú Unibanco

Risk and Capital Management – Pillar 3 (1) VaR - Itaú Unibanco Holding R$ million 12/31/2019 09/30/2019 12/31/2018 VaR per Risk Factor Group Brazilian Interest rates 813.1 6 82.0 898.4 Currencies 1 0.9 2 9.3 37.3 Equities 29.4 1 3.5 50.1 Commodities 1.0 1.5 1.0 Diversification effect (576.1) (505.9) (605.3) Total VaR 278.3 220.4 381.5 Maximum Total VaR of the Quarter 398.2 398.3 397.0 Average Total VaR of the Quarter 279.6 305.6 357.8 Minimum Total VaR of the Quarter 210.5 208.7 303.0 (1) Considers one-day holding period and 99% confidence level. The Total VaR increased from the prior quarter due to higher exposure to Brazilian interest rates. VaR and Stressed VaR Internal Model – Regulatory Portfolio For its Regulatory Portfolio, Itaú Unibanco uses historical simulation methodology for calculating the VaR and Stressed VaR, with a confidence interval of 99% and a holding period of at least 10-day, depending on the market liquidity of the portfolio. (1) VaR - Itaú Unibanco - Regulatory Portfolio R$ million 12/31/2019 09/30/2019 12/31/2018 VaR per Risk Factor Group VaR Stressed VaR VaR Stressed VaR VaR Stressed VaR Brazilian Interest rates 114.1 290.1 94.6 165.0 5 6.9 180.0 Currencies 2 0.3 5 6.4 70.7 292.2 9 3.1 255.6 Equities 27.9 4 7.0 25.1 3 6.2 53.5 1 41.4 Commodities 5.7 7.4 4.0 6.3 2.9 3 .3 Diversification effect (41.2) (147.9) (105.4) (322.5) (80.1) (216.4) Total VaR 126.8 253.0 89.0 177.2 126.3 363.9 Maximum Total VaR of the Quarter 218.2 601.1 161.1 321.4 275.0 363.9 Average Total VaR of the Quarter 133.2 291.7 109.9 132.9 135.8 130.2 Minimum Total VaR of the Quarter 79.4 208.2 47.7 39.1 68.4 65.7 (1) VaR Historical Simulation approach, holding period of 10 days. Amounts reported consider 99% confidence level. Stress Testing In addition to using VaR, Itaú Unibanco analyzes the risk in extreme scenarios under a wide range of different stress testings, so as to identify significant losses that could occur in extreme market conditions. This scenarios are based on past crises or on predetermined shocks in the risk factors. One factor that has a major bearing on the test results is the correlation between the assets and the respective risk factors, and this effect is simulated in various ways in the different scenarios tested. In order to identify its greatest risks and to assist in decision-making by the treasury department and by the senior management, the results of the stress tests are assessed by means of risk factors as well as in a consolidated way. Backtesting The effectiveness of the VaR model is validated by the use of backtesting techniques, comparing daily hypothetical and effective results with the estimated daily VaR, according to BACEN Circular 3,646. The number of exceptions to the VaR pre-established limits should be consistent, within an acceptable margin, with the hypothesis of 99% confidence interval, considering a range of 250 business days. Confidence intervals of 97.5% and 95%, and periods of 500 and 750 business days, respectively are also considered. The backtesting analysis presented below considers the ranges suggested by the Basel Committee on Banking Supervision (BCBS). The ranges are divided into: • Green (0 to 4 exceptions): backtesting results that do not suggest any problem with the quality or accuracy of the adopted models; • Yellow (5 to 9 exceptions): intermediate range group, which indicates an early warning monitoring and may indicate the need to review the model; and • Red (10 or more exceptions): need for improvement actions. The Backtesting presented one exception in relation to the effective and hypothetical results in the period. 36 Itaú Unibanco Risk and Capital Management – Pillar 3 (1) VaR - Itaú Unibanco Holding R$ million 12/31/2019 09/30/2019 12/31/2018 VaR per Risk Factor Group Brazilian Interest rates 813.1 6 82.0 898.4 Currencies 1 0.9 2 9.3 37.3 Equities 29.4 1 3.5 50.1 Commodities 1.0 1.5 1.0 Diversification effect (576.1) (505.9) (605.3) Total VaR 278.3 220.4 381.5 Maximum Total VaR of the Quarter 398.2 398.3 397.0 Average Total VaR of the Quarter 279.6 305.6 357.8 Minimum Total VaR of the Quarter 210.5 208.7 303.0 (1) Considers one-day holding period and 99% confidence level. The Total VaR increased from the prior quarter due to higher exposure to Brazilian interest rates. VaR and Stressed VaR Internal Model – Regulatory Portfolio For its Regulatory Portfolio, Itaú Unibanco uses historical simulation methodology for calculating the VaR and Stressed VaR, with a confidence interval of 99% and a holding period of at least 10-day, depending on the market liquidity of the portfolio. (1) VaR - Itaú Unibanco - Regulatory Portfolio R$ million 12/31/2019 09/30/2019 12/31/2018 VaR per Risk Factor Group VaR Stressed VaR VaR Stressed VaR VaR Stressed VaR Brazilian Interest rates 114.1 290.1 94.6 165.0 5 6.9 180.0 Currencies 2 0.3 5 6.4 70.7 292.2 9 3.1 255.6 Equities 27.9 4 7.0 25.1 3 6.2 53.5 1 41.4 Commodities 5.7 7.4 4.0 6.3 2.9 3 .3 Diversification effect (41.2) (147.9) (105.4) (322.5) (80.1) (216.4) Total VaR 126.8 253.0 89.0 177.2 126.3 363.9 Maximum Total VaR of the Quarter 218.2 601.1 161.1 321.4 275.0 363.9 Average Total VaR of the Quarter 133.2 291.7 109.9 132.9 135.8 130.2 Minimum Total VaR of the Quarter 79.4 208.2 47.7 39.1 68.4 65.7 (1) VaR Historical Simulation approach, holding period of 10 days. Amounts reported consider 99% confidence level. Stress Testing In addition to using VaR, Itaú Unibanco analyzes the risk in extreme scenarios under a wide range of different stress testings, so as to identify significant losses that could occur in extreme market conditions. This scenarios are based on past crises or on predetermined shocks in the risk factors. One factor that has a major bearing on the test results is the correlation between the assets and the respective risk factors, and this effect is simulated in various ways in the different scenarios tested. In order to identify its greatest risks and to assist in decision-making by the treasury department and by the senior management, the results of the stress tests are assessed by means of risk factors as well as in a consolidated way. Backtesting The effectiveness of the VaR model is validated by the use of backtesting techniques, comparing daily hypothetical and effective results with the estimated daily VaR, according to BACEN Circular 3,646. The number of exceptions to the VaR pre-established limits should be consistent, within an acceptable margin, with the hypothesis of 99% confidence interval, considering a range of 250 business days. Confidence intervals of 97.5% and 95%, and periods of 500 and 750 business days, respectively are also considered. The backtesting analysis presented below considers the ranges suggested by the Basel Committee on Banking Supervision (BCBS). The ranges are divided into: • Green (0 to 4 exceptions): backtesting results that do not suggest any problem with the quality or accuracy of the adopted models; • Yellow (5 to 9 exceptions): intermediate range group, which indicates an early warning monitoring and may indicate the need to review the model; and • Red (10 or more exceptions): need for improvement actions. The Backtesting presented one exception in relation to the effective and hypothetical results in the period. 36 Itaú Unibanco

Risk and Capital Management – Pillar 3 Pricing of Financial Instruments To price its portfolios, Itaú Unibanco uses, where possible, price quotes seen in financial markets and published by reliable external sources, or, if quotes are not available from specialized sources, estimates from pricing models representing the fair value of its positions. The pricing parameters used by Itaú Unibanco include interest rates, foreign exchange rates, the prices of securities, equities, commodities, derivatives contracts, indices, and volatilities. Prices are calculated by the pricing area, and are independently validated from price information, volatility curves and surfaces (IPV – Independent price validation), to ensure that the information is consistent and accurate. 37 Itaú Unibanco Risk and Capital Management – Pillar 3 Pricing of Financial Instruments To price its portfolios, Itaú Unibanco uses, where possible, price quotes seen in financial markets and published by reliable external sources, or, if quotes are not available from specialized sources, estimates from pricing models representing the fair value of its positions. The pricing parameters used by Itaú Unibanco include interest rates, foreign exchange rates, the prices of securities, equities, commodities, derivatives contracts, indices, and volatilities. Prices are calculated by the pricing area, and are independently validated from price information, volatility curves and surfaces (IPV – Independent price validation), to ensure that the information is consistent and accurate. 37 Itaú Unibanco

Risk and Capital Management – Pillar 3 7 Operational Risk 7.1 Framework and Treatment Operational risk is defined as the possibility of losses arising from failure, deficiency or inadequacy of internal process, people or systems or from external events that affect the achievement of strategic, tactical or operational objectives. It includes legal risk associated with inadequacy or deficiency in contracts signed by the institution, as well as penalties due to noncompliance with laws and punitive damages to third parties arising from the activities undertaken by the institution. Itaú Unibanco internally classifies its risk events in: • Internal fraud; • External fraud; • Labor claims and deficient security in the workplace; • Inadequate practices related to clients, products and services; • Damages to own physical assets or assets in use by Itaú Unibanco; • Interruption of Itaú Unibanco’s atii ties; • Failures in information technology (IT) systems, processes or infrastructure; • Failures in the performance, compliance with deadlines and management of activities at Itaú Unibanco. Operational risk management includes conduct risk, which is subject to mitigating procedures to assess product design (suitability) and incentive models. The inspection area is responsible for fraud prevention. Irrespective of their origin, specific cases may be handled by risk committees and integrity and ethics committees. Itaú Unibanco has a governance process that is structured through forums and corporate bodies composed of senior management, which report to the Board of Directors, with well-defined roles and responsibilities in order to segregate the business and management and control activities, ensuring independence between the areas and, consequently, well-balanced decisions with respect to risks. This is reflected in the risk management process carried out on a decentralized basis under the responsibility of the business areas and by a centralized control carried out by the internal control, compliance and operational risk department, by means of methodologies, training courses, certification and monitoring of the control environment in an independent way. The managers of the executive areas use corporate methods constructed and made available by the internal control, compliance and operational risk area. Among the methodologies and tools used are the self-evaluation and the map of the istitutio’s pioiti zed risks, the approval of processes, products, and system development products and projects, the monitoring of key risk indicators that and the database of operational losses, guaranteeing a single conceptual basis for managing processes, systems, projects and new products and services. Within the governance of the risk management process, regularly, the consolidated reports on risk monitoring, controls, action plans and operational losses are presented to the business area executives. In line with CMN Resolution 4,557, the doue t Puli Repot – Integrated Management of Operational Risk /Internal Cotols/Cop liae, suaized e sio of the istitutioal opeati oal isk a ageet poli a e foud o the website www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Reports. 7.2 Crisis Management and Business Continuity Itaú Unibanco's Business Continuity Program is designed to anticipate and respond at an acceptable level to events that may interrupt its essential activities. It establishes the Business Continuity Plan (BCP), which consists of modular procedures that are available for use in the event of incidents. The descriptions/characteristics of the existing plans are: • Disaster Recovery: it aims to ensure the availability and integrity of Information Technology resources and communication in the event of a failure in the primary Data Center to maintain the processing of critical systems; • Workplace Contingency: alternative facilities to perform the activities in the event the administrative buildings become unavailable; • Operational Contingency: alternatives to carry out critical processes whether they are systemic, procedural or emergency responses. In order to assess the efficiency of the contingency actions in the face of the interruption scenarios described in the plans and identify improvement points, tests are carried out at intervals that vary according to the plan, at least once a year. In order to keep the continuity solutions aligned with the business requirements (processes, minimum resources, legal requirements, etc) the Program applies the following tools to assess the institution: 38 Itaú Unibanco Risk and Capital Management – Pillar 3 7 Operational Risk 7.1 Framework and Treatment Operational risk is defined as the possibility of losses arising from failure, deficiency or inadequacy of internal process, people or systems or from external events that affect the achievement of strategic, tactical or operational objectives. It includes legal risk associated with inadequacy or deficiency in contracts signed by the institution, as well as penalties due to noncompliance with laws and punitive damages to third parties arising from the activities undertaken by the institution. Itaú Unibanco internally classifies its risk events in: • Internal fraud; • External fraud; • Labor claims and deficient security in the workplace; • Inadequate practices related to clients, products and services; • Damages to own physical assets or assets in use by Itaú Unibanco; • Interruption of Itaú Unibanco’s atii ties; • Failures in information technology (IT) systems, processes or infrastructure; • Failures in the performance, compliance with deadlines and management of activities at Itaú Unibanco. Operational risk management includes conduct risk, which is subject to mitigating procedures to assess product design (suitability) and incentive models. The inspection area is responsible for fraud prevention. Irrespective of their origin, specific cases may be handled by risk committees and integrity and ethics committees. Itaú Unibanco has a governance process that is structured through forums and corporate bodies composed of senior management, which report to the Board of Directors, with well-defined roles and responsibilities in order to segregate the business and management and control activities, ensuring independence between the areas and, consequently, well-balanced decisions with respect to risks. This is reflected in the risk management process carried out on a decentralized basis under the responsibility of the business areas and by a centralized control carried out by the internal control, compliance and operational risk department, by means of methodologies, training courses, certification and monitoring of the control environment in an independent way. The managers of the executive areas use corporate methods constructed and made available by the internal control, compliance and operational risk area. Among the methodologies and tools used are the self-evaluation and the map of the istitutio’s pioiti zed risks, the approval of processes, products, and system development products and projects, the monitoring of key risk indicators that and the database of operational losses, guaranteeing a single conceptual basis for managing processes, systems, projects and new products and services. Within the governance of the risk management process, regularly, the consolidated reports on risk monitoring, controls, action plans and operational losses are presented to the business area executives. In line with CMN Resolution 4,557, the doue t Puli Repot – Integrated Management of Operational Risk /Internal Cotols/Cop liae, suaized e sio of the istitutioal opeati oal isk a ageet poli a e foud o the website www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Reports. 7.2 Crisis Management and Business Continuity Itaú Unibanco's Business Continuity Program is designed to anticipate and respond at an acceptable level to events that may interrupt its essential activities. It establishes the Business Continuity Plan (BCP), which consists of modular procedures that are available for use in the event of incidents. The descriptions/characteristics of the existing plans are: • Disaster Recovery: it aims to ensure the availability and integrity of Information Technology resources and communication in the event of a failure in the primary Data Center to maintain the processing of critical systems; • Workplace Contingency: alternative facilities to perform the activities in the event the administrative buildings become unavailable; • Operational Contingency: alternatives to carry out critical processes whether they are systemic, procedural or emergency responses. In order to assess the efficiency of the contingency actions in the face of the interruption scenarios described in the plans and identify improvement points, tests are carried out at intervals that vary according to the plan, at least once a year. In order to keep the continuity solutions aligned with the business requirements (processes, minimum resources, legal requirements, etc) the Program applies the following tools to assess the institution: 38 Itaú Unibanco

Risk and Capital Management – Pillar 3 − Business Impact Analysis (BIA): evaluates the criticality and resumption requirement of the processes that support the delivery of products and services. − Threats and Vulnerabilities Analysis (AVA): identification of threats near to Itaú Uiao’s uildigs. In addition, the institution has a Crisis Management Program, which is aimed at managing business interruption events, natural disasters, impacts of an environmental, social, and infrastructure/operational (including information technology) or of any other nature that jeopardize the image and reputation and/or viability of Itaú Unibanco's processes with its employees, clients, strategic partners and regulators, with timely and integrated responses. 7.3 Independent Validation of Risk Models Itaú Unibanco validates the processes and risk models independently. This is done by a department which is separate from the business and risk control areas, to ensure that its assessments are independent. The validation method, defined in an internal policy, meets regulatory requirements such as those of BACEN Circulars 3,646 and 3,674. The validation stages include: • Verification of mathematical and theoretical development of the models; • Qualitative and quantitative analysis of the models, including the variables, construction of an independent calculator and the use of appropriate technical; • When applicable, comparison with alternative models and international benchmarks; • Histhorical Backtesting of the model; • The correct implementation of the models in the systems used. Additionally, the validation area assesses the stress testing program. The performance of the independent validation area and the validation of the processes and models are assessed by Internal Audit and reported to the specific senior management committees. Action plans are prepared to address opportunities identified during the independent validation process, and are monitored by the 3 lines of defense and by senior management until the conclusion. 39 Itaú Unibanco Risk and Capital Management – Pillar 3 − Business Impact Analysis (BIA): evaluates the criticality and resumption requirement of the processes that support the delivery of products and services. − Threats and Vulnerabilities Analysis (AVA): identification of threats near to Itaú Uiao’s uildigs. In addition, the institution has a Crisis Management Program, which is aimed at managing business interruption events, natural disasters, impacts of an environmental, social, and infrastructure/operational (including information technology) or of any other nature that jeopardize the image and reputation and/or viability of Itaú Unibanco's processes with its employees, clients, strategic partners and regulators, with timely and integrated responses. 7.3 Independent Validation of Risk Models Itaú Unibanco validates the processes and risk models independently. This is done by a department which is separate from the business and risk control areas, to ensure that its assessments are independent. The validation method, defined in an internal policy, meets regulatory requirements such as those of BACEN Circulars 3,646 and 3,674. The validation stages include: • Verification of mathematical and theoretical development of the models; • Qualitative and quantitative analysis of the models, including the variables, construction of an independent calculator and the use of appropriate technical; • When applicable, comparison with alternative models and international benchmarks; • Histhorical Backtesting of the model; • The correct implementation of the models in the systems used. Additionally, the validation area assesses the stress testing program. The performance of the independent validation area and the validation of the processes and models are assessed by Internal Audit and reported to the specific senior management committees. Action plans are prepared to address opportunities identified during the independent validation process, and are monitored by the 3 lines of defense and by senior management until the conclusion. 39 Itaú Unibanco

Risk and Capital Management – Pillar 3 8 Liquidity Risk 8.1 Framework and Treatment Liquidity risk is defined as the likelihood of the institution not being able to effectively honor its expected and unexpected obligations, current and future, including those from guarantees commitment, without affecting its daily operations or incurring significant losses. Liquidity risk control is carried out by an area that is independent of the business areas, and which is responsible for defining the composition of the reserve, estimating cash flow and exposure to liquidity risk over different time horizons, and monitoring the minimum limits for absorbing losses in stress scenarios in the countries where Itaú Unibanco operates. All activities are subject to assessment by the independent validation, internal controls and audit departments. Additionally, and pursuant to the requirements of CMN Resolutions 4,090 and BACEN Circular 3,749, Itaú Unibanco makes monthly delivery of its Liquidity Risk Statements (DLR) to BACEN and the following items are regularly prepared and submitted to the senior management for monitoring and decision support: • Different scenarios for liquidity projections; • Contingency plans for crisis situations; • Reports and charts to enable monitoring risk positions; • Assessment of funding costs and alternatives; • Tracking the sort of funding sources through a continuous control of funding sources considering counterparty type, maturity and other aspects. The document that details the liquidity risk control institutional policy is on the Investor Relations website https://www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Reports. 8.2 Liquidity Coverage Ratio (LCR) The Liquidity Coverage Ratio (LCR), which is calculated as required by BACEN, in line with the Basel international standard, is defined as follows: �� ���� = ������ – �� ���� ; ���� % ������ • HQLA – High Quality Liquid Assets = correspond to inventories, in some cases weighted by a discount factor, of assets that remain liquid in the market even in periods of stress, that can easily be converted into cash and that are classified as low risk; • Outflowss = total potential cash outflows for a 30-day horizon, calculated for a standard stress scenario as defined by BACEN Circular 3,749; • Inflowss = total potential cash inflows for a 30-day horizon, calculated for a standard stress scenario as defined by BACEN Circular 3,749. According to the instructions in BACEN Circular 3,775, banks with total assets exceeding R$100 billion have since October 2015 been required to submit a monthly Prudential Conglomerate LCR to BACEN. This indicator is subject to a progressive minimum regulatory requirement, as presented below. Schedule for limits to be observed (1) 2018 2019 Liquidity Coverage Ratio (LCR) 90% 100% (1) Mininum requirement valid from 1 January, 2019 onwards. 40 Itaú Unibanco Risk and Capital Management – Pillar 3 8 Liquidity Risk 8.1 Framework and Treatment Liquidity risk is defined as the likelihood of the institution not being able to effectively honor its expected and unexpected obligations, current and future, including those from guarantees commitment, without affecting its daily operations or incurring significant losses. Liquidity risk control is carried out by an area that is independent of the business areas, and which is responsible for defining the composition of the reserve, estimating cash flow and exposure to liquidity risk over different time horizons, and monitoring the minimum limits for absorbing losses in stress scenarios in the countries where Itaú Unibanco operates. All activities are subject to assessment by the independent validation, internal controls and audit departments. Additionally, and pursuant to the requirements of CMN Resolutions 4,090 and BACEN Circular 3,749, Itaú Unibanco makes monthly delivery of its Liquidity Risk Statements (DLR) to BACEN and the following items are regularly prepared and submitted to the senior management for monitoring and decision support: • Different scenarios for liquidity projections; • Contingency plans for crisis situations; • Reports and charts to enable monitoring risk positions; • Assessment of funding costs and alternatives; • Tracking the sort of funding sources through a continuous control of funding sources considering counterparty type, maturity and other aspects. The document that details the liquidity risk control institutional policy is on the Investor Relations website https://www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Reports. 8.2 Liquidity Coverage Ratio (LCR) The Liquidity Coverage Ratio (LCR), which is calculated as required by BACEN, in line with the Basel international standard, is defined as follows: �� ���� = ������ – �� ���� ; ���� % ������ • HQLA – High Quality Liquid Assets = correspond to inventories, in some cases weighted by a discount factor, of assets that remain liquid in the market even in periods of stress, that can easily be converted into cash and that are classified as low risk; • Outflowss = total potential cash outflows for a 30-day horizon, calculated for a standard stress scenario as defined by BACEN Circular 3,749; • Inflowss = total potential cash inflows for a 30-day horizon, calculated for a standard stress scenario as defined by BACEN Circular 3,749. According to the instructions in BACEN Circular 3,775, banks with total assets exceeding R$100 billion have since October 2015 been required to submit a monthly Prudential Conglomerate LCR to BACEN. This indicator is subject to a progressive minimum regulatory requirement, as presented below. Schedule for limits to be observed (1) 2018 2019 Liquidity Coverage Ratio (LCR) 90% 100% (1) Mininum requirement valid from 1 January, 2019 onwards. 40 Itaú Unibanco

Risk and Capital Management – Pillar 3 Information on the Liquidity Coverage Ratio (LCR) R$ thousand 4th quarter 2019 ¹ 3rd quarter 2019 ² 4th quarter 2018 ³ Total Unweighted Total Weighted Total Unweighted Total Weighted Total Unweighted Total Weighted (4) (5) (4) (5) (4) (5) Value (average) Value (average) Value (average) Value (average) Value (average) Value (average) High Quality Liquid Assets (HQLA) 1 Total High Quality Liquid Assets (HQLA) - 170,004,407 - 152,914,162 179,879,581 (6) Cash outflows - - Retail deposits and deposits from small business customers, of 2 283,608,542 24,611,828 270,539,589 23,165,400 275,132,207 24,549,688 which: 3 Stable deposits 156,766,174 7,838,309 151,649,019 7,582,451 144,721,508 7,236,071 4 Less stable deposits 126,842,368 16,773,519 118,890,570 15,582,949 130,410,699 17,313,616 5 Unsecured wholesale funding, of which: 177,757,824 80,561,758 161,013,050 72,650,961 154,104,524 70,103,803 Operational deposits (all counterparties) and deposits in 6 1,063,541 53,177 1,160,065 58,003 1,997,884 99,894 networks of cooperative banks 7 Non-operational deposits (all counterparties) 175,879,275 79,693,573 158,297,564 71,037,536 150,584,782 68,482,051 8 Unsecured debt 815,008 815,008 1,555,421 1,555,421 1,521,858 1,521,858 9 Secured wholesale funding 12,064,421 - 9,676,950 7,183,423 10 Additional requirements, of which: 265,458,246 34,228,550 240,080,908 30,086,436 225,759,210 30,030,807 Outflows related to derivative exposure and other collateral 11 37,702,176 18,156,422 32,507,267 15,199,248 27,852,667 13,625,033 requirements 12 Outflows related to loss of funding on debt products 1,270,912 1,270,912 1,186,913 1,186,913 3,167,152 3,167,152 13 Credit and liquidity facilities 226,485,158 14,801,216 206,386,728 13,700,275 194,739,391 13,238,622 14 Other contractual funding obligations 62,685,601 62,685,601 61,569,911 61,569,911 58,043,584 58,043,584 15 Other contingent funding obligations 89,753,225 11,196,408 82,633,326 10,214,205 88,777,377 10,536,953 16 Total cash outflows 225,348,567 - 207,363,863 200,448,258 (6) Cash inflows #N/D #N/D 17 Secured lending 146,775,301 405,167 161,229,812 242,561 174,016,478 323,878 18 Inflows from fully performing exposures 30,968,861 18,927,092 29,656,601 17,750,448 27,381,337 16,193,016 19 Other cash inflows 104,372,199 91,980,930 100,517,145 88,728,917 90,014,372 79,188,448 20 Total cash inflows 282,116,360 111,313,189 291,403,558 106,721,926 291,412,186 95,705,342 (7) (7) (7) Adjusted Total Adjusted Total Adjusted Total 21 Total HQLA 170,004,407 152,914,162 179,879,581 22 Total net cash outflows 114,035,378 100,641,937 104,742,916 23 LCR (%) 149.1% 151.9% 171.7% (1) It corresponds to 64 daily average observations. (2) It corresponds to 66 daily average observations. (3) It corresponds to 62 daily average observations. (4) Total balance of the cash inflows or outflows. (5) After application of weighting factors. (6) Potential cash outflows (Outflows ) and inflows (Inflows ). e e (7) Amount calculated after applying weighting factors and limits set by BACEN Circular 3,749. The table shows that Itaú Unibanco has an average LCR of 149.1% in the quarter, leading to the conclusion that the institution comfortably has sufficient liquid assets to endure more than 30 days in a period of idiosyncratic or systemic liquidity stress, as set forth by the metrics. 8.3 Net Stable Funding Ratio (NSFR) The Net Stable Funding Ratio (NSFR), the calculation of which is established by the BACEN and in line with the Basel international guidelines, is defined as follows: �������� �� ���������� ���� = �� �� ���������� �� • ASF – Available Stable Funding – refers to liabilities and equity weighted by a discount factor according to their stability, as provided for in BACEN Circular 3,869; • RSF – Required Stable Funding – refers to assets and off-balance exposures weighted by a discount factor to their necessity, as provided for in BACEN Circular 3,869. 41 Itaú Unibanco ���� Risk and Capital Management – Pillar 3 Information on the Liquidity Coverage Ratio (LCR) R$ thousand 4th quarter 2019 ¹ 3rd quarter 2019 ² 4th quarter 2018 ³ Total Unweighted Total Weighted Total Unweighted Total Weighted Total Unweighted Total Weighted (4) (5) (4) (5) (4) (5) Value (average) Value (average) Value (average) Value (average) Value (average) Value (average) High Quality Liquid Assets (HQLA) 1 Total High Quality Liquid Assets (HQLA) - 170,004,407 - 152,914,162 179,879,581 (6) Cash outflows - - Retail deposits and deposits from small business customers, of 2 283,608,542 24,611,828 270,539,589 23,165,400 275,132,207 24,549,688 which: 3 Stable deposits 156,766,174 7,838,309 151,649,019 7,582,451 144,721,508 7,236,071 4 Less stable deposits 126,842,368 16,773,519 118,890,570 15,582,949 130,410,699 17,313,616 5 Unsecured wholesale funding, of which: 177,757,824 80,561,758 161,013,050 72,650,961 154,104,524 70,103,803 Operational deposits (all counterparties) and deposits in 6 1,063,541 53,177 1,160,065 58,003 1,997,884 99,894 networks of cooperative banks 7 Non-operational deposits (all counterparties) 175,879,275 79,693,573 158,297,564 71,037,536 150,584,782 68,482,051 8 Unsecured debt 815,008 815,008 1,555,421 1,555,421 1,521,858 1,521,858 9 Secured wholesale funding 12,064,421 - 9,676,950 7,183,423 10 Additional requirements, of which: 265,458,246 34,228,550 240,080,908 30,086,436 225,759,210 30,030,807 Outflows related to derivative exposure and other collateral 11 37,702,176 18,156,422 32,507,267 15,199,248 27,852,667 13,625,033 requirements 12 Outflows related to loss of funding on debt products 1,270,912 1,270,912 1,186,913 1,186,913 3,167,152 3,167,152 13 Credit and liquidity facilities 226,485,158 14,801,216 206,386,728 13,700,275 194,739,391 13,238,622 14 Other contractual funding obligations 62,685,601 62,685,601 61,569,911 61,569,911 58,043,584 58,043,584 15 Other contingent funding obligations 89,753,225 11,196,408 82,633,326 10,214,205 88,777,377 10,536,953 16 Total cash outflows 225,348,567 - 207,363,863 200,448,258 (6) Cash inflows #N/D #N/D 17 Secured lending 146,775,301 405,167 161,229,812 242,561 174,016,478 323,878 18 Inflows from fully performing exposures 30,968,861 18,927,092 29,656,601 17,750,448 27,381,337 16,193,016 19 Other cash inflows 104,372,199 91,980,930 100,517,145 88,728,917 90,014,372 79,188,448 20 Total cash inflows 282,116,360 111,313,189 291,403,558 106,721,926 291,412,186 95,705,342 (7) (7) (7) Adjusted Total Adjusted Total Adjusted Total 21 Total HQLA 170,004,407 152,914,162 179,879,581 22 Total net cash outflows 114,035,378 100,641,937 104,742,916 23 LCR (%) 149.1% 151.9% 171.7% (1) It corresponds to 64 daily average observations. (2) It corresponds to 66 daily average observations. (3) It corresponds to 62 daily average observations. (4) Total balance of the cash inflows or outflows. (5) After application of weighting factors. (6) Potential cash outflows (Outflows ) and inflows (Inflows ). e e (7) Amount calculated after applying weighting factors and limits set by BACEN Circular 3,749. The table shows that Itaú Unibanco has an average LCR of 149.1% in the quarter, leading to the conclusion that the institution comfortably has sufficient liquid assets to endure more than 30 days in a period of idiosyncratic or systemic liquidity stress, as set forth by the metrics. 8.3 Net Stable Funding Ratio (NSFR) The Net Stable Funding Ratio (NSFR), the calculation of which is established by the BACEN and in line with the Basel international guidelines, is defined as follows: �������� �� ���������� ���� = �� �� ���������� �� • ASF – Available Stable Funding – refers to liabilities and equity weighted by a discount factor according to their stability, as provided for in BACEN Circular 3,869; • RSF – Required Stable Funding – refers to assets and off-balance exposures weighted by a discount factor to their necessity, as provided for in BACEN Circular 3,869. 41 Itaú Unibanco ����

Risk and Capital Management – Pillar 3 Information on the Net Stable Funding Ratio (NSFR) R$ thousand 12/31/2019 Value per residual effective maturity term (R$ thousand) Greater than or Weighted equal to six Greater than or (2) Lower than six Value (1) months, and equal to 1 No Maturity (1) months (R$ thousand) (1) lower than 1 year (1) year (3) Available Stable Funding (AFS) 1 Capital - - - 194,018,191 194,018,191 2 Reference Equity, gross of regulatory deductions - - - 144,831,380 144,831,380 3 Other capital instruments not included in line 2 - - - 49,186,811 49,186,811 4 Retail Funding 143,588,048 160,463,073 4,758,601 11,866,957 298,122,081 5 Stable Funding 102,889,581 63,045,696 597,220 227,861 158,433,484 6 Less Stable Funding 40,698,467 97,417,377 4,161,381 11,639,095 139,688,597 7 Wholesale Funding 33,594,114 488,920,514 57,164,435 107,391,821 236,335,283 8 Operational deposits and deposits of member cooperatives 4,087,741 - - - 2,043,870 9 Other Wholesale Funding 29,506,373 488,920,514 57,164,435 107,391,821 234,291,413 Operations in which the institution acts exclusively as intermediary, not undertaking any 10 - 88,476,563 - - - rights or obligations, even if contingent 11 Other liabilities, in which: 73,627,771 140,255,608 912,006 4,310,342 4,766,345 12 Derivatives whose replacement values are lower than zero - 29,078,269 - - - 13 Other liability or equity elements not included above 73,627,771 111,177,339 912,006 4,310,342 4,766,345 14 Total Available Stable Funding (ASF) 250,809,934 878,115,758 62,835,042 317,587,311 733,241,901 (3) Required Stable Funding (RSF) 15 Total NSFR high-quality liquid assets (HQLA) 126,827,792 156,311,587 96,619 21,408,645 13,733,920 16 Operational deposits held at other financial institutions - - - - - 17 Performing loans and securities (financial institutions, corporates and central banks) - 375,226,522 82,999,892 321,381,295 397,254,696 18 Performing loans to financial institutions secured by Level 1 HQLA - 11,996,546 - 2,653 1,202,308 Performing loans to financial institutions secured by non-Level 1 HQLA and unsecured 19 - 30,117,651 3,756,119 19,544,857 25,940,564 performing loans to financial institutions Performing loans to non-financial corporate clients, loans to retail and small business 20 - 317,460,982 64,626,055 170,936,370 251,018,136 customers, and loans to sovereigns, central banks, of which: With a risk weight of less than or equal to 35%, approach for credit risk, according to 21 - - - - - Circular 3,644. 22 Performing residential mortgages, of which: - 4,327,452 4,001,007 62,161,958 49,204,008 23 Which are in accordance to Circular 3,644, 2013, art. 22 - - - 44,158,994 30,259,068 Securities that are not in default and do not qualify as HQLA, including exchange- 24 - 11,323,891 10,616,711 68,735,457 69,889,679 traded equities Operations in which the institution acts exclusively as intermediary, not undertaking any 25 - 113,193,060 7,657,494 886,820 - rights or obligations, even if contingent 26 Other assets, in which: 6,498,568 188,504,468 7,748,690 106,862,624 172,657,152 Transactions with gold and commodities, including those with expected physical 27 - - - - - settlement Assets posted as initial margin for derivatives contracts and participation in mutual 28 guarantee funds of clearinghouses or providers of clearing and settlement services - - - 22,529,162 19,149,788 which acts as central counterparty. 29 Derivatives whose replacement values are higher than or equal to zero - - - 30,274,186 1,195,917 Derivatives whose replacement values are less than zero, gross of the deduction of any 30 - - - 1,453,913 1,453,913 collateral provided as a result of deposit of variation margin 31 All other assets not included in the above categories 6,498,568 188,504,468 7,748,690 52,605,362 150,857,533 32 Off-balance sheet transactions 392,851,345 - - - 16,316,911 33 Total Required Stable Funding (RSF) 526,177,705 833,235,637 98,502,695 450,539,384 599,962,679 Total Adjusted (4) Value Total Available Stable Funding (ASF) 733,241,901 Total Required Stable Funding (RSF) 599,962,679 34 NSFR (%) 122.2% (1) This is the total balance of the available stable funding (ASF) or required stable funding (RSF). (2) Corresponds to the amount after application of weighting factors. (3) Corresponds to available stable funding (ASF) or required stable funding (RSF). (4) Corresponds to the amount calculated after application of the weighting factors and limits set forth in BACEN Circular 3.869. NSFR Comparative R$ Thousand 12/31/2019 09/30/2019 Total Adjusted Total Adjusted (1) (1) Value Value Total Available Stable Funding (ASF) 733,241,901 699,997,484 Total Required Stable Funding (RSF) 599,962,679 595,943,343 NSFR (%) 122.2% 117.5% (1) Corresponds to the amount calculated after application of the weighting factors and limits set forth in BACEN Circular 3,869. 42 Itaú Unibanco Risk and Capital Management – Pillar 3 Information on the Net Stable Funding Ratio (NSFR) R$ thousand 12/31/2019 Value per residual effective maturity term (R$ thousand) Greater than or Weighted equal to six Greater than or (2) Lower than six Value (1) months, and equal to 1 No Maturity (1) months (R$ thousand) (1) lower than 1 year (1) year (3) Available Stable Funding (AFS) 1 Capital - - - 194,018,191 194,018,191 2 Reference Equity, gross of regulatory deductions - - - 144,831,380 144,831,380 3 Other capital instruments not included in line 2 - - - 49,186,811 49,186,811 4 Retail Funding 143,588,048 160,463,073 4,758,601 11,866,957 298,122,081 5 Stable Funding 102,889,581 63,045,696 597,220 227,861 158,433,484 6 Less Stable Funding 40,698,467 97,417,377 4,161,381 11,639,095 139,688,597 7 Wholesale Funding 33,594,114 488,920,514 57,164,435 107,391,821 236,335,283 8 Operational deposits and deposits of member cooperatives 4,087,741 - - - 2,043,870 9 Other Wholesale Funding 29,506,373 488,920,514 57,164,435 107,391,821 234,291,413 Operations in which the institution acts exclusively as intermediary, not undertaking any 10 - 88,476,563 - - - rights or obligations, even if contingent 11 Other liabilities, in which: 73,627,771 140,255,608 912,006 4,310,342 4,766,345 12 Derivatives whose replacement values are lower than zero - 29,078,269 - - - 13 Other liability or equity elements not included above 73,627,771 111,177,339 912,006 4,310,342 4,766,345 14 Total Available Stable Funding (ASF) 250,809,934 878,115,758 62,835,042 317,587,311 733,241,901 (3) Required Stable Funding (RSF) 15 Total NSFR high-quality liquid assets (HQLA) 126,827,792 156,311,587 96,619 21,408,645 13,733,920 16 Operational deposits held at other financial institutions - - - - - 17 Performing loans and securities (financial institutions, corporates and central banks) - 375,226,522 82,999,892 321,381,295 397,254,696 18 Performing loans to financial institutions secured by Level 1 HQLA - 11,996,546 - 2,653 1,202,308 Performing loans to financial institutions secured by non-Level 1 HQLA and unsecured 19 - 30,117,651 3,756,119 19,544,857 25,940,564 performing loans to financial institutions Performing loans to non-financial corporate clients, loans to retail and small business 20 - 317,460,982 64,626,055 170,936,370 251,018,136 customers, and loans to sovereigns, central banks, of which: With a risk weight of less than or equal to 35%, approach for credit risk, according to 21 - - - - - Circular 3,644. 22 Performing residential mortgages, of which: - 4,327,452 4,001,007 62,161,958 49,204,008 23 Which are in accordance to Circular 3,644, 2013, art. 22 - - - 44,158,994 30,259,068 Securities that are not in default and do not qualify as HQLA, including exchange- 24 - 11,323,891 10,616,711 68,735,457 69,889,679 traded equities Operations in which the institution acts exclusively as intermediary, not undertaking any 25 - 113,193,060 7,657,494 886,820 - rights or obligations, even if contingent 26 Other assets, in which: 6,498,568 188,504,468 7,748,690 106,862,624 172,657,152 Transactions with gold and commodities, including those with expected physical 27 - - - - - settlement Assets posted as initial margin for derivatives contracts and participation in mutual 28 guarantee funds of clearinghouses or providers of clearing and settlement services - - - 22,529,162 19,149,788 which acts as central counterparty. 29 Derivatives whose replacement values are higher than or equal to zero - - - 30,274,186 1,195,917 Derivatives whose replacement values are less than zero, gross of the deduction of any 30 - - - 1,453,913 1,453,913 collateral provided as a result of deposit of variation margin 31 All other assets not included in the above categories 6,498,568 188,504,468 7,748,690 52,605,362 150,857,533 32 Off-balance sheet transactions 392,851,345 - - - 16,316,911 33 Total Required Stable Funding (RSF) 526,177,705 833,235,637 98,502,695 450,539,384 599,962,679 Total Adjusted (4) Value Total Available Stable Funding (ASF) 733,241,901 Total Required Stable Funding (RSF) 599,962,679 34 NSFR (%) 122.2% (1) This is the total balance of the available stable funding (ASF) or required stable funding (RSF). (2) Corresponds to the amount after application of weighting factors. (3) Corresponds to available stable funding (ASF) or required stable funding (RSF). (4) Corresponds to the amount calculated after application of the weighting factors and limits set forth in BACEN Circular 3.869. NSFR Comparative R$ Thousand 12/31/2019 09/30/2019 Total Adjusted Total Adjusted (1) (1) Value Value Total Available Stable Funding (ASF) 733,241,901 699,997,484 Total Required Stable Funding (RSF) 599,962,679 595,943,343 NSFR (%) 122.2% 117.5% (1) Corresponds to the amount calculated after application of the weighting factors and limits set forth in BACEN Circular 3,869. 42 Itaú Unibanco

Risk and Capital Management – Pillar 3 th Itaú Uiao’s Aailale Stale Fudig ASF amounted to R$ 733,2 billion in the 4 quarter, mainly due to Capital and th Retail and Wholesale Funding. Required Stable Funding (RSF), in turn, amounted to R$ 600,0 billion in the 4 quarter, particularly due to Loans and financing awarded to wholesale and retail customers, central governments and transactions with central Banks. The table shows that the NSFR was 122.2% at the closing of the quarter, above to the requirement of 100%. Thus, the institution counts on sufficient available stable funds to support the stable funds required in the long term, according to the metrics. 43 Itaú Unibanco Risk and Capital Management – Pillar 3 th Itaú Uiao’s Aailale Stale Fudig ASF amounted to R$ 733,2 billion in the 4 quarter, mainly due to Capital and th Retail and Wholesale Funding. Required Stable Funding (RSF), in turn, amounted to R$ 600,0 billion in the 4 quarter, particularly due to Loans and financing awarded to wholesale and retail customers, central governments and transactions with central Banks. The table shows that the NSFR was 122.2% at the closing of the quarter, above to the requirement of 100%. Thus, the institution counts on sufficient available stable funds to support the stable funds required in the long term, according to the metrics. 43 Itaú Unibanco

Risk and Capital Management – Pillar 3 9 Other Risks Insurance products, pension plans and premium bonds risks Products that compose portfolios of insurance companies of Itaú Unibanco are related to life and elementary insurance, as well as pension plans and premium bonds. The main risks inherent in these products are described below and their definitions are given in their respective chapters. • Underwriting Risk: possibility of losses arising from insurance products, pension plans and premium bonds that go agaist istitutio’s epetatios, dietl o idietl assoiated i th tehial ad atuaial ases used f or calculating premiums, contributions and technical provisions; • Market Risk; • Credit Risk; • Operational risk; • Liquidity risk in insurance operations. In line with domestic and international best practices, Itaú Unibanco has a risk management structure which ensures that risks resulting from insurance, pension and special savings products are properly assessed and reported to the relevant forums. The process of risk management for insurance, pensions and premium bond plans is independent and focus on the special nature of each risk. The aim of Itaú Unibanco is to ensure that assets serving as collateral for long-term products, with guaranteed minimum returns, are managed according to the characteristics of the liabilities, so that they are actuarially balanced and solvent over the long term. Social and Environmental Risk Itaú Unibanco understands social and environmental risk as the risk of potential losses due to exposure to social and environmental events arising from the performance of its activities. Mitigation actions of social and environmental risk are carried out through processes mappings, internal controls, monitoring new regulations on the subject, and recording occurrences in internal databases. In addition, risks identified, prioritized and actions taken complement the management of this risk in Itaú Unibanco. The social and environmental risk management is carried out by the first line of defense in its daily operations, supplemented by a specialized assessment of legal and risks control area. Business units also have their governance for approval of new products, including assessing the social and environmental risk, which ensures compliance in the new products and processes employed by the institution. Governance also includes the Social and Environmental Risk Committee, which is primarily responsible for guide institutional views of social and environmental risk exposure related to Itaú Unibanco activities. Itaú Unibanco consistently seeks to evolve in the management of social and environmental risk, always attentive to the challenges so as to monitor the changes in and demands of society. Therefore, among other actions, Itaú Unibanco has assued ad iopoated ito Itaú Uiao’s iteal poesses a ue of atioal ad iteatioal o luta commitments and pacts aimed at integrating social, environmental and governance aspects into Itaú Unibanco business. The main ones are the Principles for Responsible Investment (PRI), the Charter for Human Rights – Ethos, the Equator Principles (EP), the Global Impact, the Carbon Disclosure Project (CDP), the Brazilian GHG Protocol Program, the Pacto Nacional para Erradicação do Trabalho Escravo (National Pact for Eradicating Slave Labor), among others. Itaú Unibanco efforts to increase the knowledge of the assessment of the social and environmental criteria have been recognized as models in Brazil and abroad, as shown by the recurring presence of the institution in the major sustainability indexes abroad, such as the Dow Jones Sustainability Index, and recently, in Sustainability Index Euronext Vigeo – Emerging 70, and in Brazil, for example in the Corporate Sustainability Index, as well as the numerous prizes which Itaú Unibanco has been awarded. Regulatory and Compliance Risk Regulatory and Compliance risk is the risk arising from losses due to fines, sanctions and other penalties applied by regulatory agencies resulting from noncompliance with regulatory requirements. This risk is managed through a structured process aimed at identifying changes in the regulatory environment, analyzing their impacts on the departments of the institution and monitoring the actions directed at adherence to the regulatory requirements. Itaú Unibanco has a structured flow for addressing rules, which involves several areas, covering the stages of recognition and researches, distribution of regulatory environment changes and the monitoring of action plans for regulatory 44 Itaú Unibanco Risk and Capital Management – Pillar 3 9 Other Risks Insurance products, pension plans and premium bonds risks Products that compose portfolios of insurance companies of Itaú Unibanco are related to life and elementary insurance, as well as pension plans and premium bonds. The main risks inherent in these products are described below and their definitions are given in their respective chapters. • Underwriting Risk: possibility of losses arising from insurance products, pension plans and premium bonds that go agaist istitutio’s epetatios, dietl o idietl assoiated i th tehial ad atuaial ases used f or calculating premiums, contributions and technical provisions; • Market Risk; • Credit Risk; • Operational risk; • Liquidity risk in insurance operations. In line with domestic and international best practices, Itaú Unibanco has a risk management structure which ensures that risks resulting from insurance, pension and special savings products are properly assessed and reported to the relevant forums. The process of risk management for insurance, pensions and premium bond plans is independent and focus on the special nature of each risk. The aim of Itaú Unibanco is to ensure that assets serving as collateral for long-term products, with guaranteed minimum returns, are managed according to the characteristics of the liabilities, so that they are actuarially balanced and solvent over the long term. Social and Environmental Risk Itaú Unibanco understands social and environmental risk as the risk of potential losses due to exposure to social and environmental events arising from the performance of its activities. Mitigation actions of social and environmental risk are carried out through processes mappings, internal controls, monitoring new regulations on the subject, and recording occurrences in internal databases. In addition, risks identified, prioritized and actions taken complement the management of this risk in Itaú Unibanco. The social and environmental risk management is carried out by the first line of defense in its daily operations, supplemented by a specialized assessment of legal and risks control area. Business units also have their governance for approval of new products, including assessing the social and environmental risk, which ensures compliance in the new products and processes employed by the institution. Governance also includes the Social and Environmental Risk Committee, which is primarily responsible for guide institutional views of social and environmental risk exposure related to Itaú Unibanco activities. Itaú Unibanco consistently seeks to evolve in the management of social and environmental risk, always attentive to the challenges so as to monitor the changes in and demands of society. Therefore, among other actions, Itaú Unibanco has assued ad iopoated ito Itaú Uiao’s iteal poesses a ue of atioal ad iteatioal o luta commitments and pacts aimed at integrating social, environmental and governance aspects into Itaú Unibanco business. The main ones are the Principles for Responsible Investment (PRI), the Charter for Human Rights – Ethos, the Equator Principles (EP), the Global Impact, the Carbon Disclosure Project (CDP), the Brazilian GHG Protocol Program, the Pacto Nacional para Erradicação do Trabalho Escravo (National Pact for Eradicating Slave Labor), among others. Itaú Unibanco efforts to increase the knowledge of the assessment of the social and environmental criteria have been recognized as models in Brazil and abroad, as shown by the recurring presence of the institution in the major sustainability indexes abroad, such as the Dow Jones Sustainability Index, and recently, in Sustainability Index Euronext Vigeo – Emerging 70, and in Brazil, for example in the Corporate Sustainability Index, as well as the numerous prizes which Itaú Unibanco has been awarded. Regulatory and Compliance Risk Regulatory and Compliance risk is the risk arising from losses due to fines, sanctions and other penalties applied by regulatory agencies resulting from noncompliance with regulatory requirements. This risk is managed through a structured process aimed at identifying changes in the regulatory environment, analyzing their impacts on the departments of the institution and monitoring the actions directed at adherence to the regulatory requirements. Itaú Unibanco has a structured flow for addressing rules, which involves several areas, covering the stages of recognition and researches, distribution of regulatory environment changes and the monitoring of action plans for regulatory 44 Itaú Unibanco

Risk and Capital Management – Pillar 3 compliance, all of which are established in internal policies. This structured process includes the following actions: (i) to understand the changes in the regulatory environment; (ii) to monitor regulatory trends; (iii) to care for the relationship between the institution and the regulator, self-regulatory bodies and the representation entity; (iv) to monitor action plans on regulatory or self-regulatory compliance; (v) to coordinate a program to comply with significant norms, such as Integrity and Ethics; and (vi) to report regulatory issues in Operational and Compliance Risk forums, according to the structure of committees established in internal policies. Model Risk The model risk arises from the incorrect development or maintenance of models, such as mistaken assumptions, and inappropriate use or application of the model. The use of models can lead to decisions that are more accurate and therefore it is a major practice in the institution. The models have supported strategic decisions in several contexts, such as credit approval, pricing, volatility curve estimation, calculation of capital, among others. Due to the increasing use of models, driven by the application of new technologies and the expansion of data use, Itaú Unibanco has improved its governance in relation to its development and monitoring, through the definition of guidelines, policies and procedures aimed at assuring the quality and mitigation of the associated risks. Reputational Risk Itaú Unibanco understands reputational risk as the risk arising from internal practices, risk events and external factors that may generate a negative perception of the institution among clients, counterparties, stockholders, investors, supervisors, commercial partners, among others, resulting in impacts on the value of the brand and financial losses, in additio to ade sel affetig Itaú Uiao’s apailit to ai tai eistig oeial elatios, stat e usiesses and continue to have access to financing sources. The institution believes that its reputation is extremely important for achieving its long-term goals and this is why the institution tries to align its speech with ethical and transparent practice and work, which is essential to raise the confidence of Itaú Uiao’s stakeholders. Itaú Uiao’s reputation depends on its strategy (vision, culture and skills) and derives from direct or indirect experience of the relationship between Itaú Unibanco and its stakeholders. Since the reputational risk directly or indirectly permeates all operations and processes of the institutio, Itaú Uiao’s governance is structured in a way to ensure that potential reputational risks are identified, analyzed and managed still in the initial phases of its operations and analysis of new products. The treatment given to reputational risk is structured by means of many processes and internal initiatives, which, in turn, are supported by internal policies, and their main purpose is to provide mechanisms for the monitoring, management, control and mitigation of the main reputational risks. Among them are (i) risk appetite statement; (ii) process for the prevention and fight against unlawful acts; (iii) crisis management process and business continuity; (iv) processes and guidelines of the governmental and institutional relations; (v) corporate communication process; (vi) brand management process; (vii) ombudsman offices initiatives and commitment to customer satisfaction; and (vii) ethics guidelines and prevention of corruption. Financial institutions play a key role in preventing and fighting illegal acts, in particular money laundering, terrorist financing and fraud, in which the challenge is to identify and suppress increasingly sophisticated operations that seek to conceal the origin, location, disposition, ownership and movement of goods and money derived, directly or indirectly, from illegal activities. Itaú Unibanco has introduced a corporate policy in order to prevent its involvement in illegal acts and to protect its reputation and image towards employees, clients, strategic partners, suppliers, service providers, regulators and society, through a governance structure based on transparency, strict compliance with rules and regulations and cooperation with police and judicial authorities. It is also continuously with local and international best practices for preventing and fighting against illegal acts, through investing and training employees. In compliance with the guidelines of this corporate policy, Itaú Unibanco established a program to prevent and fight against illegal acts based on the following pillars: • Client Identification Process; • Know Your Client (KYC) Process; • Know Your Partner (KYP) Process; • Know Your Supplier (KYS) Process; • Know Your Employee (KYE) Process; • Assessment of New Products and Services; 45 Itaú Unibanco Risk and Capital Management – Pillar 3 compliance, all of which are established in internal policies. This structured process includes the following actions: (i) to understand the changes in the regulatory environment; (ii) to monitor regulatory trends; (iii) to care for the relationship between the institution and the regulator, self-regulatory bodies and the representation entity; (iv) to monitor action plans on regulatory or self-regulatory compliance; (v) to coordinate a program to comply with significant norms, such as Integrity and Ethics; and (vi) to report regulatory issues in Operational and Compliance Risk forums, according to the structure of committees established in internal policies. Model Risk The model risk arises from the incorrect development or maintenance of models, such as mistaken assumptions, and inappropriate use or application of the model. The use of models can lead to decisions that are more accurate and therefore it is a major practice in the institution. The models have supported strategic decisions in several contexts, such as credit approval, pricing, volatility curve estimation, calculation of capital, among others. Due to the increasing use of models, driven by the application of new technologies and the expansion of data use, Itaú Unibanco has improved its governance in relation to its development and monitoring, through the definition of guidelines, policies and procedures aimed at assuring the quality and mitigation of the associated risks. Reputational Risk Itaú Unibanco understands reputational risk as the risk arising from internal practices, risk events and external factors that may generate a negative perception of the institution among clients, counterparties, stockholders, investors, supervisors, commercial partners, among others, resulting in impacts on the value of the brand and financial losses, in additio to ade sel affetig Itaú Uiao’s apailit to ai tai eistig oeial elatios, stat e usiesses and continue to have access to financing sources. The institution believes that its reputation is extremely important for achieving its long-term goals and this is why the institution tries to align its speech with ethical and transparent practice and work, which is essential to raise the confidence of Itaú Uiao’s stakeholders. Itaú Uiao’s reputation depends on its strategy (vision, culture and skills) and derives from direct or indirect experience of the relationship between Itaú Unibanco and its stakeholders. Since the reputational risk directly or indirectly permeates all operations and processes of the institutio, Itaú Uiao’s governance is structured in a way to ensure that potential reputational risks are identified, analyzed and managed still in the initial phases of its operations and analysis of new products. The treatment given to reputational risk is structured by means of many processes and internal initiatives, which, in turn, are supported by internal policies, and their main purpose is to provide mechanisms for the monitoring, management, control and mitigation of the main reputational risks. Among them are (i) risk appetite statement; (ii) process for the prevention and fight against unlawful acts; (iii) crisis management process and business continuity; (iv) processes and guidelines of the governmental and institutional relations; (v) corporate communication process; (vi) brand management process; (vii) ombudsman offices initiatives and commitment to customer satisfaction; and (vii) ethics guidelines and prevention of corruption. Financial institutions play a key role in preventing and fighting illegal acts, in particular money laundering, terrorist financing and fraud, in which the challenge is to identify and suppress increasingly sophisticated operations that seek to conceal the origin, location, disposition, ownership and movement of goods and money derived, directly or indirectly, from illegal activities. Itaú Unibanco has introduced a corporate policy in order to prevent its involvement in illegal acts and to protect its reputation and image towards employees, clients, strategic partners, suppliers, service providers, regulators and society, through a governance structure based on transparency, strict compliance with rules and regulations and cooperation with police and judicial authorities. It is also continuously with local and international best practices for preventing and fighting against illegal acts, through investing and training employees. In compliance with the guidelines of this corporate policy, Itaú Unibanco established a program to prevent and fight against illegal acts based on the following pillars: • Client Identification Process; • Know Your Client (KYC) Process; • Know Your Partner (KYP) Process; • Know Your Supplier (KYS) Process; • Know Your Employee (KYE) Process; • Assessment of New Products and Services; 45 Itaú Unibanco

Risk and Capital Management – Pillar 3 • Monitoring of Transactions; • Reporting Suspicious Transactions to the Regulatory Bodies; and • Training and Awareness Raising. This program applies to the entire institution, including subsidiaries and affiliates in Brazil and abroad. The preventing and combating unlawful acts governance is carried out by the Board of Directors, Audit Committee, Operational Risk Committee and Anti-Money Laundering Committees. The document that presents the guidelines established in the corporate program to prevent and combat unlawful acts may be seen on the www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Policies, Corporate Policy for Prevention and Fight Against Illegal Acts. In addition, Itaú Unibanco has been developing various data analysis models to improve customer risk classification, transaction monitoring and KYC methodology to provide greater accuracy in its analysis and to decrease false-positives. Itaú Unibanco has also been innovating its modeling solutions using new methods based on machine learning techniques to identify potentially suspicious activities. Moreover, Itaú Unibanco is committed to protecting corporate information and ensuring client and general public privacy in any transactions. To this end, it has a Corporate Information Security Policy and Cyber Secutity and has a monitoring process and a control structure that covers technology, business areas and international units, adhering to principal regulatory bodies and external audits, and best market practices and certifications. Additionally, a Security Operation Cete SOC that o ks / otiutes to the e seuit of Itaú Uiao’ s eletoi haels ad IT infrastructure, the monitoring of operations and thus minimization of the risk of a security incident. The Corporate Information Security and Cyber Security Policy can be viewed on the website www.itau.com.br/investor- relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Policies, Corporate Policy on Information Security and Cyber Security. Country Risk The country risk is the risk of losses related to non-compliance with obligations in connection with borrowers, issuers, counterparties or guarantors, as a result of political-economic and social events or actions taken by the government of the country in question. Itaú Unibanco has a specific structure for the management and control of country risk, consisting of corporate bodies and dedicated teams, with responsibilities defined in policies. The institution has a structured and consistent procedure, including: (i) establishment of country ratings; (ii) determination of limits for countries; (iii) monitoring the use of limits. Business and Strategy Risk Business and strategy risk is the risk of a negative impact on the results or capital as a consequence of a faulty strategic planning, the making of adverse strategic decisions, the inability of Itaú Unibanco to implement the proper strategic plans and/or changes in its business environment. Itaú Unibanco has implemented many mechanisms that ensure that both the business and the strategic decision-making processes follow proper governance standards, have the active participation of executives and the Board of Directors, are based on market, macroeconomic and risk information and are aimed at optimizing the risk-return ratio. Decision-making and the definition of business and strategy guidelines, count on the full engagement of the Board of Directors, primarily through the Strategy Committee, and of the executives, through the Executive Committee. In order to handle risk adequately, Itaú Unibanco has governance and processes to involve the ARF in business and strategy decisions, so as to ensure that risk is managed and decisions are sustainable in the long term. They are: (i) qualifications and incentives of board members and executives; (ii) budget process; (iii) product assessment; (iv) evaluation and prospecting of proprietary mergers and acquisitions; and (v) a risk appetite framework which, for example, restricts the concentration of credit and exposure to specific and material risks. 46 Itaú Unibanco Risk and Capital Management – Pillar 3 • Monitoring of Transactions; • Reporting Suspicious Transactions to the Regulatory Bodies; and • Training and Awareness Raising. This program applies to the entire institution, including subsidiaries and affiliates in Brazil and abroad. The preventing and combating unlawful acts governance is carried out by the Board of Directors, Audit Committee, Operational Risk Committee and Anti-Money Laundering Committees. The document that presents the guidelines established in the corporate program to prevent and combat unlawful acts may be seen on the www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Policies, Corporate Policy for Prevention and Fight Against Illegal Acts. In addition, Itaú Unibanco has been developing various data analysis models to improve customer risk classification, transaction monitoring and KYC methodology to provide greater accuracy in its analysis and to decrease false-positives. Itaú Unibanco has also been innovating its modeling solutions using new methods based on machine learning techniques to identify potentially suspicious activities. Moreover, Itaú Unibanco is committed to protecting corporate information and ensuring client and general public privacy in any transactions. To this end, it has a Corporate Information Security Policy and Cyber Secutity and has a monitoring process and a control structure that covers technology, business areas and international units, adhering to principal regulatory bodies and external audits, and best market practices and certifications. Additionally, a Security Operation Cete SOC that o ks / otiutes to the e seuit of Itaú Uiao’ s eletoi haels ad IT infrastructure, the monitoring of operations and thus minimization of the risk of a security incident. The Corporate Information Security and Cyber Security Policy can be viewed on the website www.itau.com.br/investor- relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Policies, Corporate Policy on Information Security and Cyber Security. Country Risk The country risk is the risk of losses related to non-compliance with obligations in connection with borrowers, issuers, counterparties or guarantors, as a result of political-economic and social events or actions taken by the government of the country in question. Itaú Unibanco has a specific structure for the management and control of country risk, consisting of corporate bodies and dedicated teams, with responsibilities defined in policies. The institution has a structured and consistent procedure, including: (i) establishment of country ratings; (ii) determination of limits for countries; (iii) monitoring the use of limits. Business and Strategy Risk Business and strategy risk is the risk of a negative impact on the results or capital as a consequence of a faulty strategic planning, the making of adverse strategic decisions, the inability of Itaú Unibanco to implement the proper strategic plans and/or changes in its business environment. Itaú Unibanco has implemented many mechanisms that ensure that both the business and the strategic decision-making processes follow proper governance standards, have the active participation of executives and the Board of Directors, are based on market, macroeconomic and risk information and are aimed at optimizing the risk-return ratio. Decision-making and the definition of business and strategy guidelines, count on the full engagement of the Board of Directors, primarily through the Strategy Committee, and of the executives, through the Executive Committee. In order to handle risk adequately, Itaú Unibanco has governance and processes to involve the ARF in business and strategy decisions, so as to ensure that risk is managed and decisions are sustainable in the long term. They are: (i) qualifications and incentives of board members and executives; (ii) budget process; (iii) product assessment; (iv) evaluation and prospecting of proprietary mergers and acquisitions; and (v) a risk appetite framework which, for example, restricts the concentration of credit and exposure to specific and material risks. 46 Itaú Unibanco

Risk and Capital Management – Pillar 3 10 Appendix I 12/31/2019 Breakdown of the Referential Equity and Information on its adequacy Value Temporary Treatment Balance (R$ Thousand) (R$ Thousand) Sheet Reference Common Equity Tier I: instruments and reserves (k) 1 Instruments Eligible for the Common Equity Tier I 97,148,000 - 2 35,572,729 - (l) Revenue reserves 3 Other revenue and other reserve 799,181 - (m) Instruments that are authorized to compose the Common Equity Tier I before Resolution No. 4 4,192 of 2013 comes into effect Non-controlling interest in subsidiaries that are part of the conglomerate, non-deductible from 5 10,743,522 - (j) 1 the Common Equity Tier I 6 Common Equity Tier I before prudential adjustments 1 44,263,432 Common Equity Tier I: prudential adjustments 7 Prudential adjustments related to the pricing of financial instruments 312,981 - 8 (e) Goodwill paid upon the acquisition of investments based on the expectation of future profitability 6,397,213 - 9 Intangible assets 8,341,399 - (h) / (i) Tax credits arising from income tax losses and social contribution tax loss carryfowards and those 10 originating from this contribution related to determination periods ended until December 31, 1 ,480,040 - (b) 2 1998 Adjustments related to the market value of derivative financial instruments used to hedge the 11 (1,475,250) - cash flows of protected items whose mark-to-market adjustments are not recorded in the books. Downward difference between the amount recognized as a provision and the expected loss for 12 - - institutions using the IRB 13 Gains arising from securitization operations Gains or losses arising from the impact of changes on the credit risk of the institution on the fair 14 value assessment of liability items 15 Actuarial assets related to defined benefit pension funds - - (d) Shares or other instruments issued by the bank authorized to compose the Common Equity Tier I, 16 1 ,274,096 - (n) acquired directly, indirectly or synthetically 17 Investments crossed with instruments eligible for the Common Equity Tier I Added value of investments lower than 10% of the capital of companies that are similar to non- consolidated financial institutions, insurance companies, reinsurance companies, capitalization 18 - - companies and sponsored pension fund entities, that exceeds 10% of the amount of the Common Equity Tier I, disregarding specific deductions. Investments higher than 10% of the capital of companies that are similar to non-consolidated 19 financial institutions, insurance companies, reinsurance companies, capitalization companies and - - sponsored pension fund entities 20 Mortgage servicing rights Tax credits arising from temporary differences that depend on the generation of income or future 21 taxable income for their realization, above the limit of 10% of the Common Equity Tier I, - - disregarding specific deductions 22 1 0,604,515 - Amount that exceeds 15% of the Common Equity Tier I of which: arising from investments in the capital of companies that are similar to non-consolidated 23 6,891,947 - financial institutions, insurance companies, reinsurance companies, capitalization companies and open ended pension entities 24 of which: arising from mortgage servicing rights of which: arising from tax credits resulting from temporary differences that depend on the 25 3 ,712,568 - 2 generation of income or future taxable income for their realization 26 - - National regulatory adjustments 26.a Deferred permanent assets - - (g) Investment in dependence, financial institution abroad or non-financial entity that is part of the 26.b conglomerate, with respect to which the Central Bank of Brazil does not have access to - - information, data and documents Funding instruments eligible for the Common Equity Tier I issued by an institution that is 26.c authorized to operate by the Central Bank of Brazil or by a financial institution abroad, and that - - are not part of the conglomerate 26.d Increase of unauthorized capital - - 26.e - - Excess of the amount adjusted of Common Equity Tier I 26.f Deposit to cover capital deficiency - - (i) 26.g Amount of intangible assets established before Resolution No. 4,192 of 2013 comes into effect - - 26.h Excess of resources invested on permanent assets - 26.i PR emphasis - Other residual differences concerning the Common Equity Tier I calculation methodology for 26.j - regulatory purposes Regulatory adjustments applied to the Common Equity Tier I due to the Insufficiency of Additional 27 - - Capital Tier I and Tier II to cover deductions 28 Total regulatory deductions from the Common Equity Tier I 2 6,934,994 29 Common Equity Tier I 117,328,438 1 - Considers prudential adjustments corresponding to deduction of non-controlling interest. 2 - Considers the deduction of deferred tax liabilities. 47 Itaú Unibanco Risk and Capital Management – Pillar 3 10 Appendix I 12/31/2019 Breakdown of the Referential Equity and Information on its adequacy Value Temporary Treatment Balance (R$ Thousand) (R$ Thousand) Sheet Reference Common Equity Tier I: instruments and reserves (k) 1 Instruments Eligible for the Common Equity Tier I 97,148,000 - 2 35,572,729 - (l) Revenue reserves 3 Other revenue and other reserve 799,181 - (m) Instruments that are authorized to compose the Common Equity Tier I before Resolution No. 4 4,192 of 2013 comes into effect Non-controlling interest in subsidiaries that are part of the conglomerate, non-deductible from 5 10,743,522 - (j) 1 the Common Equity Tier I 6 Common Equity Tier I before prudential adjustments 1 44,263,432 Common Equity Tier I: prudential adjustments 7 Prudential adjustments related to the pricing of financial instruments 312,981 - 8 (e) Goodwill paid upon the acquisition of investments based on the expectation of future profitability 6,397,213 - 9 Intangible assets 8,341,399 - (h) / (i) Tax credits arising from income tax losses and social contribution tax loss carryfowards and those 10 originating from this contribution related to determination periods ended until December 31, 1 ,480,040 - (b) 2 1998 Adjustments related to the market value of derivative financial instruments used to hedge the 11 (1,475,250) - cash flows of protected items whose mark-to-market adjustments are not recorded in the books. Downward difference between the amount recognized as a provision and the expected loss for 12 - - institutions using the IRB 13 Gains arising from securitization operations Gains or losses arising from the impact of changes on the credit risk of the institution on the fair 14 value assessment of liability items 15 Actuarial assets related to defined benefit pension funds - - (d) Shares or other instruments issued by the bank authorized to compose the Common Equity Tier I, 16 1 ,274,096 - (n) acquired directly, indirectly or synthetically 17 Investments crossed with instruments eligible for the Common Equity Tier I Added value of investments lower than 10% of the capital of companies that are similar to non- consolidated financial institutions, insurance companies, reinsurance companies, capitalization 18 - - companies and sponsored pension fund entities, that exceeds 10% of the amount of the Common Equity Tier I, disregarding specific deductions. Investments higher than 10% of the capital of companies that are similar to non-consolidated 19 financial institutions, insurance companies, reinsurance companies, capitalization companies and - - sponsored pension fund entities 20 Mortgage servicing rights Tax credits arising from temporary differences that depend on the generation of income or future 21 taxable income for their realization, above the limit of 10% of the Common Equity Tier I, - - disregarding specific deductions 22 1 0,604,515 - Amount that exceeds 15% of the Common Equity Tier I of which: arising from investments in the capital of companies that are similar to non-consolidated 23 6,891,947 - financial institutions, insurance companies, reinsurance companies, capitalization companies and open ended pension entities 24 of which: arising from mortgage servicing rights of which: arising from tax credits resulting from temporary differences that depend on the 25 3 ,712,568 - 2 generation of income or future taxable income for their realization 26 - - National regulatory adjustments 26.a Deferred permanent assets - - (g) Investment in dependence, financial institution abroad or non-financial entity that is part of the 26.b conglomerate, with respect to which the Central Bank of Brazil does not have access to - - information, data and documents Funding instruments eligible for the Common Equity Tier I issued by an institution that is 26.c authorized to operate by the Central Bank of Brazil or by a financial institution abroad, and that - - are not part of the conglomerate 26.d Increase of unauthorized capital - - 26.e - - Excess of the amount adjusted of Common Equity Tier I 26.f Deposit to cover capital deficiency - - (i) 26.g Amount of intangible assets established before Resolution No. 4,192 of 2013 comes into effect - - 26.h Excess of resources invested on permanent assets - 26.i PR emphasis - Other residual differences concerning the Common Equity Tier I calculation methodology for 26.j - regulatory purposes Regulatory adjustments applied to the Common Equity Tier I due to the Insufficiency of Additional 27 - - Capital Tier I and Tier II to cover deductions 28 Total regulatory deductions from the Common Equity Tier I 2 6,934,994 29 Common Equity Tier I 117,328,438 1 - Considers prudential adjustments corresponding to deduction of non-controlling interest. 2 - Considers the deduction of deferred tax liabilities. 47 Itaú Unibanco

Risk and Capital Management – Pillar 3 Breakdown of the Referential Equity and Information on its adequacy 12/31/2019 Value Temporary Treatment Balance (R$ Thousand) (R$ Thousand) Sheet Reference Additional Tier I Capital: instruments 30 Instruments eligible for the Additional Tier I Capital 11,265,687 31 of which: classified as Common Equity Tier I in accordance with the accounting rules 32 of which: classified as liabilities in accordance with the accounting rules Instruments that are authorized to compose the Additional Tier I Capital before Resolution No. 33 4,192 of 2013 comes into effect 3 34 1 02,273 - Non-controlling interest in subsidiaries non-deductible from the Additional Tier I Capital of which: instruments issued by subsidiaries before Resolution No. 4,192 of 2013 comes into 35 effect 36 Additional Tier I Capital before regulatory deductions 11,367,960 Additional Tier I Capital: regulatory deductions Shares or other instruments issued by the bank authorized to compose the Additional Tier I 37 - Capital, acquired directly, indirectly or synthetically 38 Investments crossed with instruments eligible for the Additional Tier I Capital Added value of investments lower than 10% of the capital of institutions authorized to operate by 39 - the Central Bank of Brazil or by financial institutions abroad that are not part of the conglomerate and that exceeds 10% of the amount of the Additional Tier I Capital Investments higher than 10% of the capital of institutions authorized to operate by the Central 40 - Bank of Brazil or by financial institutions abroad that are not part of the conglomerate 41 National regulatory adjustments - The capital of institutions authorized to operate by the Central Bank of Brazil or by financial 41.a - institutions abroad that are not part of the conglomerate and do not exceeds 10% of the amount of the Additional Tier I Capital 41.b Non-controlling interest in Additional Tier I Capital - Other residual differences concerning the Additional Tier I Capital calculation methodology for 41.c - regulatory purposes Regulatory adjustments applied to the Additional Tier I Capital due to the insufficiency of Tier II to 42 - cover deductions 43 Total regulatory deductions from the Additional Tier I Capital - - 44 Additional Tier I Capital 11,367,960 45 Tier I 128,696,398 Tier II: instruments 46 Instruments eligible for Tier II Instruments that are authorized to compose Tier II before Resolution No. 4,192 of 2013 comes 47 4 into effect 11,833,538 27,611,589 Non-controlling interest in subsidiaries that are part of the conglomerate, non-deductible from 48 3 Tier II 65,570 - of which: instruments issued by subsidiaries before Resolution No. 4,192 of 2013 comes into 49 effect 50 Excess of provisions with respect to the loss expected in IRB - - 51 Tier II before regulatory deductions 11,899,108 Tier II: regulatory deductions Shares or other instruments issued by the bank authorized to compose Tier II, acquired directly, 52 - indirectly or synthetically 53 Investments crossed with instruments eligible for Tier II Added value of investments lower than 10% of the capital of institutions authorized to operate by 54 the Central Bank of Brazil or by financial institutions abroad that are not part of the conglomerate - and that exceeds 10% of the amount of Tier II Investments higher than 10% of the capital of institutions authorized to operate by the Central 55 - Bank of Brazil or by financial institutions abroad that are not part of the conglomerate 56 - National regulatory adjustments Funding instruments issued by an institution that is authorized to operate by the Central Bank of 56.a Brazil or by financial institutions abroad, and that are not part of the conglomerate, limited to the - - instruments held by third parties and issued until December 31, 2012 56.b Non-controlling interest in Tier II - - 56.c Other residual differences concerning Tier II calculation methodology for regulatory purposes - - 57 - - Total regulatory deductions from Tier II 58 Tier II 11,899,108 59 Referential Equity (Tier I + Tier II) 140,595,506 60 891,299,481 Total risk-weighted assets 3 - Calculated according to article 9 of Bacen Resolution No. 4,192. 4 - Calculated according to article 29 of Resolution No. 4,192. 48 Itaú Unibanco Risk and Capital Management – Pillar 3 Breakdown of the Referential Equity and Information on its adequacy 12/31/2019 Value Temporary Treatment Balance (R$ Thousand) (R$ Thousand) Sheet Reference Additional Tier I Capital: instruments 30 Instruments eligible for the Additional Tier I Capital 11,265,687 31 of which: classified as Common Equity Tier I in accordance with the accounting rules 32 of which: classified as liabilities in accordance with the accounting rules Instruments that are authorized to compose the Additional Tier I Capital before Resolution No. 33 4,192 of 2013 comes into effect 3 34 1 02,273 - Non-controlling interest in subsidiaries non-deductible from the Additional Tier I Capital of which: instruments issued by subsidiaries before Resolution No. 4,192 of 2013 comes into 35 effect 36 Additional Tier I Capital before regulatory deductions 11,367,960 Additional Tier I Capital: regulatory deductions Shares or other instruments issued by the bank authorized to compose the Additional Tier I 37 - Capital, acquired directly, indirectly or synthetically 38 Investments crossed with instruments eligible for the Additional Tier I Capital Added value of investments lower than 10% of the capital of institutions authorized to operate by 39 - the Central Bank of Brazil or by financial institutions abroad that are not part of the conglomerate and that exceeds 10% of the amount of the Additional Tier I Capital Investments higher than 10% of the capital of institutions authorized to operate by the Central 40 - Bank of Brazil or by financial institutions abroad that are not part of the conglomerate 41 National regulatory adjustments - The capital of institutions authorized to operate by the Central Bank of Brazil or by financial 41.a - institutions abroad that are not part of the conglomerate and do not exceeds 10% of the amount of the Additional Tier I Capital 41.b Non-controlling interest in Additional Tier I Capital - Other residual differences concerning the Additional Tier I Capital calculation methodology for 41.c - regulatory purposes Regulatory adjustments applied to the Additional Tier I Capital due to the insufficiency of Tier II to 42 - cover deductions 43 Total regulatory deductions from the Additional Tier I Capital - - 44 Additional Tier I Capital 11,367,960 45 Tier I 128,696,398 Tier II: instruments 46 Instruments eligible for Tier II Instruments that are authorized to compose Tier II before Resolution No. 4,192 of 2013 comes 47 4 into effect 11,833,538 27,611,589 Non-controlling interest in subsidiaries that are part of the conglomerate, non-deductible from 48 3 Tier II 65,570 - of which: instruments issued by subsidiaries before Resolution No. 4,192 of 2013 comes into 49 effect 50 Excess of provisions with respect to the loss expected in IRB - - 51 Tier II before regulatory deductions 11,899,108 Tier II: regulatory deductions Shares or other instruments issued by the bank authorized to compose Tier II, acquired directly, 52 - indirectly or synthetically 53 Investments crossed with instruments eligible for Tier II Added value of investments lower than 10% of the capital of institutions authorized to operate by 54 the Central Bank of Brazil or by financial institutions abroad that are not part of the conglomerate - and that exceeds 10% of the amount of Tier II Investments higher than 10% of the capital of institutions authorized to operate by the Central 55 - Bank of Brazil or by financial institutions abroad that are not part of the conglomerate 56 - National regulatory adjustments Funding instruments issued by an institution that is authorized to operate by the Central Bank of 56.a Brazil or by financial institutions abroad, and that are not part of the conglomerate, limited to the - - instruments held by third parties and issued until December 31, 2012 56.b Non-controlling interest in Tier II - - 56.c Other residual differences concerning Tier II calculation methodology for regulatory purposes - - 57 - - Total regulatory deductions from Tier II 58 Tier II 11,899,108 59 Referential Equity (Tier I + Tier II) 140,595,506 60 891,299,481 Total risk-weighted assets 3 - Calculated according to article 9 of Bacen Resolution No. 4,192. 4 - Calculated according to article 29 of Resolution No. 4,192. 48 Itaú Unibanco

Risk and Capital Management – Pillar 3 Breakdown of the Referential Equity and Information on its adequacy 12/31/2019 Value Temporary Treatment Balance (R$ Thousand) (R$ Thousand) Sheet Reference BIS Ratios and Additional Capital Buffers 61 Common Equity Tier 1 Ratio 13.2% 62 14.4% Tier I Capital Ratio 63 BIS Ratio 15.8% 64 Common Equity Tier 1 Ratio minimum required especifically to the institution (% of RWA) 8.0% 65 of which: conservation buffer 2.5% 66 of which: countercyclical buffer 0.0% 67 of which: buffer for institutions that are systemically important at global level (G-SIB) Common Equity Tier I available to meet the requirement of the Additional Capital Buffers (% of 68 3.5% 5 RWA) National Minimum 69 Common Equity Tier I Ratio, if different from that established in Basel III 4.5% 70 Tier I Ratio, if different from that established in Basel III 6.0% 71 BIS Ratio, if different from that established in Basel III 8.0% Amounts below the limit for deduction (non-weighted by risk) Added value of investments lower than 10% of the capital of companies that are similar to non- 72 consolidated financial institutions, insurance companies, reinsurance companies, capitalization 7 93,685 companies and sponsored pension fund entities Investments higher than 10% of the capital of companies that are similar to non-consolidated 73 financial institutions, insurance companies, reinsurance companies, capitalization companies and 1 8,329,829 (f) / (a) sponsored pension fund entities 74 Mortgage servicing rights 2 75 (c) Tax credits arising from temporary differences, not deducted from the Common Equity Tier I 8 ,295,076 Limits to the inclusion of provisions in Tier II Generic provisions eligible for the inclusion in Tier II related to exposures subject to the calculation 76 of the capital requirement by means of a standardized approach Limit for the inclusion of generic provisions in Tier II for exposures subject to the standardized 77 approach Provisions eligible for the inclusion in Tier II related to exposures subject to the calculation of the 78 - capital requirement by means of the IRB approach (before the application of the limit) 79 Limit for the inclusion of provisions in Tier II for exposures subject to the IRB approach - Instruments authorized to compose the Referential Equity before Resolution No. 4,192 of 2013 comes into effect (applicable between October 1, 2013 and January 1, 2022) Current limit for instruments that are authorized to compose the Common Equity Tier I before 80 Resolution No. 4,192 of 2013 comes into effect 81 Amount excluded from the Common Equity Tier I due to the limit Instruments that are authorized to compose the Additional Tier I Capital before Resolution No. 82 - - 4,192 of 2013 comes into effect 83 - - Amount excluded from the Additional Tier I Capital due to the limit Instruments that are authorized to compose Tier II before Resolution No. 4,192 of 2013 comes 84 - 4 into effect 11,833,538 4 85 - Amount excluded from Tier II due to the limit 2 7,611,589 2 - Considers the deduction of deferred tax liabilities. 4 - Calculated according to article 29 of Resolution No. 4,192. 5 - Considered the Additional Capital Buffer for Domestic Systemically Important Institution of 1.0% 49 Itaú Unibanco Risk and Capital Management – Pillar 3 Breakdown of the Referential Equity and Information on its adequacy 12/31/2019 Value Temporary Treatment Balance (R$ Thousand) (R$ Thousand) Sheet Reference BIS Ratios and Additional Capital Buffers 61 Common Equity Tier 1 Ratio 13.2% 62 14.4% Tier I Capital Ratio 63 BIS Ratio 15.8% 64 Common Equity Tier 1 Ratio minimum required especifically to the institution (% of RWA) 8.0% 65 of which: conservation buffer 2.5% 66 of which: countercyclical buffer 0.0% 67 of which: buffer for institutions that are systemically important at global level (G-SIB) Common Equity Tier I available to meet the requirement of the Additional Capital Buffers (% of 68 3.5% 5 RWA) National Minimum 69 Common Equity Tier I Ratio, if different from that established in Basel III 4.5% 70 Tier I Ratio, if different from that established in Basel III 6.0% 71 BIS Ratio, if different from that established in Basel III 8.0% Amounts below the limit for deduction (non-weighted by risk) Added value of investments lower than 10% of the capital of companies that are similar to non- 72 consolidated financial institutions, insurance companies, reinsurance companies, capitalization 7 93,685 companies and sponsored pension fund entities Investments higher than 10% of the capital of companies that are similar to non-consolidated 73 financial institutions, insurance companies, reinsurance companies, capitalization companies and 1 8,329,829 (f) / (a) sponsored pension fund entities 74 Mortgage servicing rights 2 75 (c) Tax credits arising from temporary differences, not deducted from the Common Equity Tier I 8 ,295,076 Limits to the inclusion of provisions in Tier II Generic provisions eligible for the inclusion in Tier II related to exposures subject to the calculation 76 of the capital requirement by means of a standardized approach Limit for the inclusion of generic provisions in Tier II for exposures subject to the standardized 77 approach Provisions eligible for the inclusion in Tier II related to exposures subject to the calculation of the 78 - capital requirement by means of the IRB approach (before the application of the limit) 79 Limit for the inclusion of provisions in Tier II for exposures subject to the IRB approach - Instruments authorized to compose the Referential Equity before Resolution No. 4,192 of 2013 comes into effect (applicable between October 1, 2013 and January 1, 2022) Current limit for instruments that are authorized to compose the Common Equity Tier I before 80 Resolution No. 4,192 of 2013 comes into effect 81 Amount excluded from the Common Equity Tier I due to the limit Instruments that are authorized to compose the Additional Tier I Capital before Resolution No. 82 - - 4,192 of 2013 comes into effect 83 - - Amount excluded from the Additional Tier I Capital due to the limit Instruments that are authorized to compose Tier II before Resolution No. 4,192 of 2013 comes 84 - 4 into effect 11,833,538 4 85 - Amount excluded from Tier II due to the limit 2 7,611,589 2 - Considers the deduction of deferred tax liabilities. 4 - Calculated according to article 29 of Resolution No. 4,192. 5 - Considered the Additional Capital Buffer for Domestic Systemically Important Institution of 1.0% 49 Itaú Unibanco

Risk and Capital Management – Pillar 3 11 Glossaries 11.1 Glossary of Acronyms A • ACCP – Adicional de Contracíclico de Capital Principal (Countercyclical Capital Buffer) • ACP – Adicional de Capital Principal (Additional Capital Buffer) • ARF – Área de Riscos e Finanças (Risk and Finance Department) • ASF – Available Stable Funding • AVA - Avaliação de Vulnerabilidades e Ameaças (Threats and Vulnerabilities Analysis) B • BACEN - Banco Central do Brasil (Central Bank of Brazil) • BCBS – Basel Committee on Banking Supervision • BCP – Business Continuity Plan • BIA - Business Impact Analysis • BIS - Bank for International Settlements C • CCB – Cédula de Crédito Bancário • CDP – Carbon Disclosure Project • CDS - Credit Default Swap • CEM - Current Exposure Method • CEO - Chief Executive Officer • CGRC - Comitê de Gestão de Risco e Capital (Risk and Capital Management Committee) • CMN - Conselho Monetário Nacional (National Monetary Council) • CNSP - Conselho Nacional de Seguros Privados (National Council of Private Insurance) • Comef - Comitê de Estabilidade Financeira (Financial Stability Committee) • CRA – Certificados de Recebíveis do Agronegócio (Agribusiness Receivables Certificate) • CRI - Certificados de Recebíveis Imobiliários (Securitized Real Estate Loans) • CRO - Chief Risk Officer • CTAM – Technical Model Assessment Commission • CVM – Comissão de Valores Mobiliários (Securities and Exchange Commission) D • DRL – Liquidity Risk Statement • DV - Delta Variation Risk E • EP – Equator Principles • EVE – Economic Value od Equity F • FCC – Fator de Conversão de Crédito (Credit Conversion Factor) • FCL - Fator de Conversão de Crédito de Operações a Liquidar (Unsettled Operation Credit Conversion Factor) • FEBRABAN – Federação Brasileira de Bancos • FIDC - Fundo de Investimento em Direitos Creditórios (Credit Rights Investment Funds) • FPR - Fator de Ponderação de Risco (weighting factor) G • GDP - Gross Domestic Product • GHG – Greenhouse Gas 50 Itaú Unibanco Risk and Capital Management – Pillar 3 11 Glossaries 11.1 Glossary of Acronyms A • ACCP – Adicional de Contracíclico de Capital Principal (Countercyclical Capital Buffer) • ACP – Adicional de Capital Principal (Additional Capital Buffer) • ARF – Área de Riscos e Finanças (Risk and Finance Department) • ASF – Available Stable Funding • AVA - Avaliação de Vulnerabilidades e Ameaças (Threats and Vulnerabilities Analysis) B • BACEN - Banco Central do Brasil (Central Bank of Brazil) • BCBS – Basel Committee on Banking Supervision • BCP – Business Continuity Plan • BIA - Business Impact Analysis • BIS - Bank for International Settlements C • CCB – Cédula de Crédito Bancário • CDP – Carbon Disclosure Project • CDS - Credit Default Swap • CEM - Current Exposure Method • CEO - Chief Executive Officer • CGRC - Comitê de Gestão de Risco e Capital (Risk and Capital Management Committee) • CMN - Conselho Monetário Nacional (National Monetary Council) • CNSP - Conselho Nacional de Seguros Privados (National Council of Private Insurance) • Comef - Comitê de Estabilidade Financeira (Financial Stability Committee) • CRA – Certificados de Recebíveis do Agronegócio (Agribusiness Receivables Certificate) • CRI - Certificados de Recebíveis Imobiliários (Securitized Real Estate Loans) • CRO - Chief Risk Officer • CTAM – Technical Model Assessment Commission • CVM – Comissão de Valores Mobiliários (Securities and Exchange Commission) D • DRL – Liquidity Risk Statement • DV - Delta Variation Risk E • EP – Equator Principles • EVE – Economic Value od Equity F • FCC – Fator de Conversão de Crédito (Credit Conversion Factor) • FCL - Fator de Conversão de Crédito de Operações a Liquidar (Unsettled Operation Credit Conversion Factor) • FEBRABAN – Federação Brasileira de Bancos • FIDC - Fundo de Investimento em Direitos Creditórios (Credit Rights Investment Funds) • FPR - Fator de Ponderação de Risco (weighting factor) G • GDP - Gross Domestic Product • GHG – Greenhouse Gas 50 Itaú Unibanco

Risk and Capital Management – Pillar 3 • G-SIBs - Global Systemically Important Banks H • HQLA – High quality liquid assets I • ICAAP - Internal capital adequacy assessment process • IPV – Independent Price Validation • IRB – Internal Ratings-Based • IRRBB – Interest Rate Risk in the Banking Book • IT - Information Technology K • KYC – Know Your Client • KYE – Know Your Employee • KYP – Know Your Partner • KYS – Know Your Supplier L • LCR – Liquidity Coverage Ratio M • MtM - Mark to Market N • NII – Net Interest Income • NSFR – Net Stable Funding Ratio P • PCN - Planos de Continuidade de Negócios (Business Continuity Plans) • PCR – Potential Credit Risk • PR - Patrimônio de Referência (Total Capital) • PREVIC - Superintendência Nacional de Previdência Complementar (National Superintendence of Supplementary Pension) • PRI – Principles for Responsible Investment • P&L – Profit and Loss Statement R • RA - Risk Assessment • RAS - Risk Appetite Statement • RCAP - Regulatory Consistency Assessment Programme • RCP - Risco de Crédito Potencial (Potential Credit Risk) • RSF – Required Stable Funding • RWA - Risk Weighted Asset • RWACPAD - Portion relating to exposures to credit risk • RWAMINT - Portion relating to exposures to market risk, using internal approach • RWA - Portion relating to exposures to market risk, calculated using standard approach MPAD • RWA - Portion relating to the calculation of operational risk capital requirements OPAD S • SA-CCR – Standardised Approach to Counterparty Credit Risk • SARB – Sistema de Autorregulação Bancária (Self-Regulation Banking System) • SFN – Sistema Financeiro Nacional (National Financial System) 51 Itaú Unibanco Risk and Capital Management – Pillar 3 • G-SIBs - Global Systemically Important Banks H • HQLA – High quality liquid assets I • ICAAP - Internal capital adequacy assessment process • IPV – Independent Price Validation • IRB – Internal Ratings-Based • IRRBB – Interest Rate Risk in the Banking Book • IT - Information Technology K • KYC – Know Your Client • KYE – Know Your Employee • KYP – Know Your Partner • KYS – Know Your Supplier L • LCR – Liquidity Coverage Ratio M • MtM - Mark to Market N • NII – Net Interest Income • NSFR – Net Stable Funding Ratio P • PCN - Planos de Continuidade de Negócios (Business Continuity Plans) • PCR – Potential Credit Risk • PR - Patrimônio de Referência (Total Capital) • PREVIC - Superintendência Nacional de Previdência Complementar (National Superintendence of Supplementary Pension) • PRI – Principles for Responsible Investment • P&L – Profit and Loss Statement R • RA - Risk Assessment • RAS - Risk Appetite Statement • RCAP - Regulatory Consistency Assessment Programme • RCP - Risco de Crédito Potencial (Potential Credit Risk) • RSF – Required Stable Funding • RWA - Risk Weighted Asset • RWACPAD - Portion relating to exposures to credit risk • RWAMINT - Portion relating to exposures to market risk, using internal approach • RWA - Portion relating to exposures to market risk, calculated using standard approach MPAD • RWA - Portion relating to the calculation of operational risk capital requirements OPAD S • SA-CCR – Standardised Approach to Counterparty Credit Risk • SARB – Sistema de Autorregulação Bancária (Self-Regulation Banking System) • SFN – Sistema Financeiro Nacional (National Financial System) 51 Itaú Unibanco

Risk and Capital Management – Pillar 3 • SOC - Security Operation Center • SUSEP - Superintendência de Seguros Privados (Superintendence of Private Insurance) T • TRS - Total Return Swap • TR - Taxa Referencial (Referential Rate) • TVM - Títulos de valores mobiliários (Securities) V • VaR - Value at Risk 52 Itaú Unibanco Risk and Capital Management – Pillar 3 • SOC - Security Operation Center • SUSEP - Superintendência de Seguros Privados (Superintendence of Private Insurance) T • TRS - Total Return Swap • TR - Taxa Referencial (Referential Rate) • TVM - Títulos de valores mobiliários (Securities) V • VaR - Value at Risk 52 Itaú Unibanco

Risk and Capital Management – Pillar 3 11.2 Glossary of Regulations th • BACEN Circular No. 3,082, of January 30 , 2002 th • BACEN Circular No. 3,316, of April 30 , 2008 th • BACEN Circular No. 3,354, of June 27 , 2007 th • BACEN Circular No. 3,640, of March 04 , 2013 th • BACEN Circular No. 3,644, of March 04 , 2013 th • BACEN Circular No. 3,646, of March 04 , 2013 st • BACEN Circular No. 3,674, of October 31 , 2013 st • BACEN Circular No. 3,676, of October 31 , 2013 st • BACEN Circular No. 3,678, of October 31 , 2013 th • BACEN Circular No. 3,701, of March 13 , 2014 th • BACEN Circular No. 3,748, of February 26 , 2015 th • BACEN Circular No. 3,749, of March 05 , 2015 th • BACEN Circular No. 3,751, of March 19 , 2015 th • BACEN Circular No. 3,769, of October 29 , 2015 th • BACEN Circular No. 3,809, of August 25 , 2016 th • BACEN Circular No. 3,846, of September 13 , 2017 th • BACEN Circular No. 3.848, of September 18 , 2017 th • BACEN Circular No. 3.849, of September 18 , 2017 th • BACEN Circular No. 3,869, of December 19 , 2017 st • BACEN Circular No. 3,876, of January 31 , 2018 th • BACEN Circular No. 3,904, of June 06 , 2018 th • BACEN Circular No. 3,921, of December 5 , 2018 th • BACEN Circular Letter No. 3,706 of May 05 , 2015 th • BACEN Circular Letter No. 3,775 of December 16 , 2015 th • BACEN Circular Letter No. 3,782 of September 19 , 2016 th • BACEN Circular Letter No. 3,841 of July 27 , 2017 st • BACEN 30.371, of January 31 , 2017 st • BACEN 34.724, of November 21 , 2019 th • CNSP Resolution No. 321, of July 15 , 2015 th • CMN Resolution No. 3,263, of February 24 , 2005 st • CMN Resolution No. 3,533 of January 31 , 2008 th • CMN Resolution No. 3,921, of November 25 , 2010 th • CMN Resolution No. 4,090, of May 24 , 2012 st • CMN Resolution No. 4,192, of March 1 , 2013 st • CMN Resolution No. 4,193, of March 1 , 2013 st • CMN Resolution No. 4,195, of March 1 , 2013 st • CMN Resolution No. 4,280, of October 31 , 2013 th • CMN Resolution No. 4,502, of June 30 , 2016 th • CMN Resolution No. 4,512, of July 28 , 2016 rd • CMN Resolution No. 4,557, of February 23 , 2017 th • CMN Resolution No. 4,615, of November 30 , 2017 th • CMN Resolution No. 4,680, of July 31 , 2018 • Normative SARB 017/2016, of August 25th, 2016 53 Itaú Unibanco Risk and Capital Management – Pillar 3 11.2 Glossary of Regulations th • BACEN Circular No. 3,082, of January 30 , 2002 th • BACEN Circular No. 3,316, of April 30 , 2008 th • BACEN Circular No. 3,354, of June 27 , 2007 th • BACEN Circular No. 3,640, of March 04 , 2013 th • BACEN Circular No. 3,644, of March 04 , 2013 th • BACEN Circular No. 3,646, of March 04 , 2013 st • BACEN Circular No. 3,674, of October 31 , 2013 st • BACEN Circular No. 3,676, of October 31 , 2013 st • BACEN Circular No. 3,678, of October 31 , 2013 th • BACEN Circular No. 3,701, of March 13 , 2014 th • BACEN Circular No. 3,748, of February 26 , 2015 th • BACEN Circular No. 3,749, of March 05 , 2015 th • BACEN Circular No. 3,751, of March 19 , 2015 th • BACEN Circular No. 3,769, of October 29 , 2015 th • BACEN Circular No. 3,809, of August 25 , 2016 th • BACEN Circular No. 3,846, of September 13 , 2017 th • BACEN Circular No. 3.848, of September 18 , 2017 th • BACEN Circular No. 3.849, of September 18 , 2017 th • BACEN Circular No. 3,869, of December 19 , 2017 st • BACEN Circular No. 3,876, of January 31 , 2018 th • BACEN Circular No. 3,904, of June 06 , 2018 th • BACEN Circular No. 3,921, of December 5 , 2018 th • BACEN Circular Letter No. 3,706 of May 05 , 2015 th • BACEN Circular Letter No. 3,775 of December 16 , 2015 th • BACEN Circular Letter No. 3,782 of September 19 , 2016 th • BACEN Circular Letter No. 3,841 of July 27 , 2017 st • BACEN 30.371, of January 31 , 2017 st • BACEN 34.724, of November 21 , 2019 th • CNSP Resolution No. 321, of July 15 , 2015 th • CMN Resolution No. 3,263, of February 24 , 2005 st • CMN Resolution No. 3,533 of January 31 , 2008 th • CMN Resolution No. 3,921, of November 25 , 2010 th • CMN Resolution No. 4,090, of May 24 , 2012 st • CMN Resolution No. 4,192, of March 1 , 2013 st • CMN Resolution No. 4,193, of March 1 , 2013 st • CMN Resolution No. 4,195, of March 1 , 2013 st • CMN Resolution No. 4,280, of October 31 , 2013 th • CMN Resolution No. 4,502, of June 30 , 2016 th • CMN Resolution No. 4,512, of July 28 , 2016 rd • CMN Resolution No. 4,557, of February 23 , 2017 th • CMN Resolution No. 4,615, of November 30 , 2017 th • CMN Resolution No. 4,680, of July 31 , 2018 • Normative SARB 017/2016, of August 25th, 2016 53 Itaú Unibanco