Exhibit 99.1

Risk and Capital Management Pillar 3 1Q20—BACEN Circular 3.930

Contents Objective 1 Key indicators 1 Prudential Metrics and Risk Management 2 KM1: Key metrics at consolidated level 2 OVA: Bank risk management approach 3 Scope and main characteristics of risk management 3 Risk and Capital Governance 3 Risk Appetite 4 Risk Culture 5 Stress Testing 5 Recovery Plan 6 Capital Adequacy Assessment 6 Capital Adequacy 7 OV1: Overview of risk-weighted assets (RWA) 8 leverage Ratio 8 lR1: Summary comparison of accounting assets vs leverage ratio exposure measure (RA) 8 lR2: leverage ratio common disclosure 9 liquidity Ratios 10 UQA: liquidity Risk Management Information 10 Framework and Treatment 10 UQ1: liquidity Coverage Ratio (lCR) 11 UQ2: Net Stable Funding Ratio (NSFR) 12 Market Risk 13 MRA: Qualitative disclosure requirements re lated to market risk 13 MR1: Market risk under standardized approach 14 MRB: Qualitative disclosures on market risk in the Internal Models Approach (IMA) 15 MR2: RWA flow statements of market risk exposures under an IMA 17 Exposures subject to market risk 17 MR3: IMA values for trading portfolios 17 MR4: Comparison of VaR estimates w ith gains/ losses 18 Backtesting 18 Evolution of the Derivatives Portfolio 19 Glossary of Acronyms 20 Glossary of Regulations 22

Risk and Capital Management – Pillar 3 Objective This document presents Itaú Unibanco Holding S.A. (Itaú Unibanco) information required by the Central Bank of Brazil (BACEN) through Circular 3,930, which address the disclosure of information on risks and capital management, comparison between accounting and prudential information, liquidity and market risk indicators, calculation of risk-weighted assets (RWA), calculation of the Total Capital (“Patrimônio de Referência”—PR), and the compensation of management members, in accordance with Itaú Unibanco’s institutional standards. The referred Circular brought several amendments in the disclosure format of the Pillar 3 information, besides changes in the scope and frequency of the information disclosed. All these amendments, implemented by the Central Bank, aim the convergence of the Brazilian financial regulation to the recommendations of the Basel Committee, seeking to harmonize the information disclosed by financial institutions at an international level, and taking into account the structural conditions of the Brazilian economy. Key indicators Itaú Unibanco’s risk and capital management focuses on maintaining the institution in line with the risk strategy approved by the Board of Directors. The key indicators based on the Prudential Consolidation, on March 31, 2020, are summarized below. Common Equity Tier I Ratio Tier I Ratio Total Capital Ratio 10.3% 12.0% 13.3% December 31, 2019: 13.2% December 31, 2019: 14.4% December 31, 2019: 15.8% Common Equity Tier I Tier I Total Capital R$ 107,668 million R$ 124,980 million R$ 139,218 million December 31, 2019: R$ 117,328 million December 31, 2019: R$ 128,696 million December 31, 2019: R$ 140,596 million RWA Credit Risk Exposure R$ 1,043,517 million R$ 917,107 million December 31, 2019: R$ 891,300 million December 31, 2019: R$ 784,730 million

Risk and Capital Management – Pillar 3 Prudential Metrics and Risk Management Itaú Unibanco invests in robust and company-wide risk management processes to serve as a basis for its strategic decisions intended to ensure business sustainability. The key prudential metrics related to regulatory capital, leverage ratio, liquidity standards and information on the bank risk management are presented below. KM1: Key metrics at consolidated level In order to ensure the soundness of Itaú Unibanco and the availability of capital to support business growth, Itaú Unibanco maintains capital levels above the minimum requirements, according to the Common Equity Tier I, Additional Tier I Capital, and Tier II minimum ratios. On March 31, 2020, the Total Capital (PR) reached R$ 139,218 million, R$ 124,980 million of Tier I and R$ 14,238 million of Tier II.    a b c d e R$ million 03/31/2020 12/31/2019 09/30/2019 06/30/2019 03/31/2019 Available capital (amounts)                1 Common Equity Tier 1 (CET1) 107,668 117,328 113,235 115,498 109,156 2 Tier 1 124,980 128,696 124,856 126,373 120,124 3 Total capital 139,218 140,596 136,755 138,267 132,056 3b Excess of capital committed to ajusted permanent assets - - - - - 3c Total capital detached - - - - - Risk-weighted assets (amounts)                4 Total risk-weighted assets (RWA) 1,043,517 891,300 887,513 847,001 823,818 Risk-based capital ratios as a percentage of RWA                5 Common Equity Tier 1 ratio (%) 10.3% 13.2% 12.8% 13.6% 13.3% 6 Tier 1 ratio (%) 12.0% 14.4% 14.1% 14.9% 14.6% 7 Total capital ratio (%) 13.3% 15.8% 15.4% 16.3% 16.0% Additional CET1 buffer requirements as a percentage of RWA                8 Capital conservation buffer requirement (2.5% from 2019) (%) 2.5% 2.5% 2.5% 2.5% 2.5% 9 Countercyclical buffer requirement (%)1 0.0% 0.0% 0.0% 0.0% 0.0% 10 Bank G-SIB and/or D-SIB additional requirements (%) 1.0% 1.0% 1.0% 1.0% 1.0% 11 Total of bank CET1 specific buffer requirements (%) (row 8 + row 9 + row 10) 3.5% 3.5% 3.5% 3.5% 3.5% 12 CET1 available after meeting the bank’s minimum capital requirements (%) 1.6% 4.3% 3.9% 4.8% 4.5% Basel III leverage ratio                13 Total Basel III leverage ratio exposure measure 1,743,174 1,546,564 1,509,172 1,470,864 1,463,219 14 Basel III leverage ratio (%) (row 2 / row 13) 7.2% 8.3% 8.3% 8.6% 8.2% Liquidity Coverage Ratio                15 Total high-quality liquid assets (HQLA) 186,705 170,004 152,914 157,474 170,648 16 Total net cash outflow 112,841 114,035 100,642 94,194 104,076 17 LCR (%) 165.5% 149.1% 151.9% 167.2% 164.0% Net Stable Funding Ratio                18 Total available stable funding 811,680 733,242 699,997 684,689 672,040 19 Total required stable funding 695,135 599,963 595,943 565,158 547,067 20 NSFR 116.8% 122.2% 117.5% 121.1% 122.8% (1) The countercyclical capital buffer is fixed by the Financial Stability Committee (Comef) based on discussions about the pace of credit expansion (BACEN Communication No. 35,259/20), and currently is set to zero. Should the requirement increase, the new percentage takes effect twelve months after the announcement.    The Total Capital Ratio reached 13.3% on March 31, 2020, reducing 250 basis points relatively to December 31, 2019, mainly due to the foreign exchange impact, the provision of interest on capital, dividends referring to fiscal year 2019, and increase in risk-weighted assets, partially compensated by the net income in the quarter and the issuance of level 1 and level 2 debts. Besides, Itaú Unibanco has an R$ 55,737 million capital excess in relation to its required Total Capital, higher than the Additional Capital Buffers requirement of R$ 36,523 million, largely covered by total capital available.    2 Itaú Unibanco

Risk and Capital Management – Pillar 3 OVA: Bank risk management approach Scope and main characteristics of risk management To undertake and manage risks is one of the activities of Itaú Unibanco. For this reason, the institution must have clearly established risk management objectives. In this context, the risk appetite defines the nature and the level of risks acceptable for the institution, while the risk culture guides the attitudes required to manage them. Itaú Unibanco seeks to maintain robust and company-wide risk management processes to serve as a basis for its strategic decisions intended to ensure business sustainability. These processes are in line with the guidelines of the Board of Directors and Executives who, through corporate bodies, define the institution’s global objectives, which are then translated into targets and thresholds for the business units that manage risks. Control and capital management units, in turn, support Itaú Unibanco’s management through the processes of analysis and monitoring capital and risk. The principles that provide risk management and risk appetite fundamentals, as well as guidelines regarding the actions taken by Itaú Unibanco’s employees in their daily routines are as follows:    Sustainability and customer satisfaction: the vision of Itaú Unibanco is to be a leading bank in sustainable performance and customer satisfaction. For this reason, the institution is concerned about creating shared values for employees, customers, shareholders and society to ensure the longevity of the business. Itaú Unibanco is concerned about doing business that is good for customers and for the institution;    Risk Culture: the institution’s risk culture goes beyond policies, procedures and processes, strengthening the employees’ individual and collective responsibility to do the right thing, at the right time and in the right way, with respect for ethical business. The Risk Culture is described in item 1.2 “Risk Culture”;    Risk Pricing: Itaú Unibanco operates and assumes risks in business that it knows and understands, avoids unknown risks or risks that provide no competitive advantages, and carefully assesses risk-return ratios;    Diversification: the institution has low appetite for volatility in its results. Accordingly, it operates with a diversified base of customers, products and business, seeking risk diversification and giving priority to low-risk transactions;    Operational excellence: Itaú Unibanco intends to provide agility, as well as a robust and stable infrastructure, in order to offer high quality services;    Ethics and respect for regulations: at Itaú Unibanco, ethics is non-negotiable. For this reason, the institution promotes an institutional environment of integrity, educating its employees to cultivate ethical relationships and businesses, as well as respecting the norms, and therefore caring for the institution’s reputation. On August 21, 2017, the Resolution CMN 4,557 came into force, which established the structure of risk and capital management. The resolution highlights are the implementation of a continuous and integrated risk management framework; the requirements for the definition of the Risk Appetite Statement (RAS) and the stress test program; the establishment of a Risk Committee; the indication, before BACEN, of the Chief Risk Officer (CRO); and the CRO’s roles, responsibilities and independence requirements. Risk and Capital Governance The Board of Directors is the main body responsible for establishing the guidelines, policies and authority levels regarding risk and capital management. In turn, the CGRC provides support to the Board of Directors in the performance of their duties relating to risk and capital management. At the executive level, corporate bodies headed by Itaú Unibanco’s Chief Executive Officer (CEO) are established to manage risks and capital. Their decisions are overseen by the CGRC.    3 Itaú Unibanco

Risk and Capital Management – Pillar 3 Additionally, the institution has corporate bodies that perform delegated duties in the risk and capital management, and that are headed by the Vice-President of the Risk and Finance Area (ARF). To support this structure, ARF is structured with specialized departments. The objective is to provide independent and centralized management of the institution’s risks and capital, and to ensure the accordance with the established rules and procedures. Itaú Unibanco’s risk management organizational structure complies with Brazilian and international regulations in place and is aligned with the market’s best practices. Responsibilities for risk management at Itaú Unibanco are structured according to the concept of three lines of defense, namely: in the first line of defense, the business and corporate support areas manage risks they give rise to, by identifying, assessing, controlling and reporting such risks; in the second line of defense, an independent unit provides central control, so as to ensure that Itaú Unibanco’s risk is managed according to the risk appetite and established policies and procedures. This centralized control provides the Board and executives with a global overview of Itaú Unibanco’s exposure, to ensure correct and timely corporate decisions;    in the third line of defense, internal audit provides an independent assessment of the institution’s activities, so that senior management can see that controls are adequate, risk management is effective and institutional standards and regulatory requirements are being complied with. Itaú Unibanco uses robust automated systems for full compliance with capital regulations, as well as for measuring risks in accordance with the regulatory determinations and models in place. It also monitors adherence to the qualitative and quantitative regulators’ minimum capital and risk management requirements. Risk Appetite Itaú Unibanco has a risk appetite policy, which was established and approved by the Board of Directors and guides the institution’s business strategy. The bank’s risk appetite is grounded on the following declaration of the Board of Directors:    “We are a universal bank, operating predominantly in Latin America. Supported by our risk culture, we operate based on rigorous ethical and regulatory compliance standards, seeking high and growing results, with low volatility, by means of the long-lasting relationship with clients, correctly pricing risks, well-distributed fund-raising and proper use of capital.” Based on this declaration, the bank established five dimensions, each of which comprising a set of metrics associated with the key risks involved, combining complementary measurements and seeking a comprehensive view of its exposure:    Capitalization: establishes that Itaú Unibanco should have sufficient capital to protect itself against a serious recession or stress events without the need to adjust its capital structure under adverse circumstances. It is monitored by following up the bank’s capital ratios, in usual or stress situations, and the institution’s debt issue ratings.    Liquidity: establishes that the institution’s liquidity should be able to support long stress periods. It is monitored by following up on liquidity ratios.    Composition of results: establishes that business will mainly focus on Latin America, where Itaú Unibanco will have a diversified range of customers and products, with low appetite for results volatility and high risk. This dimension includes business and profitability, as well as market and credit risks aspects. The metrics monitored by the bank seek to ensure, by means of exposure concentration limits such as, for example, industry sectors, quality of counterparties, countries and geographic regions and risk factors, a suitable composition of the bank’s portfolios, aiming at low volatility of results and business sustainability.    Operational risk: focuses on controlling operational risk events that may adversely impact the bank’s business strategy and operations. This control is carried out by monitoring key operational risk events and incurred losses.    4 Itaú Unibanco

Risk and Capital Management – Pillar 3    Reputation: deals with risks that may impact brand value and the institution’s reputation before its customers, employees, regulators, investors and the general public. In this dimension, risks are monitored by following up on customers’ satisfaction or dissatisfaction, media exposure and observation of the institution’s conduct.    The Board of Directors is responsible for approving risk appetite guidelines and limits, performing its activities with the support of the Risk and Capital Management Committee (CGRC) and the CRO. Metrics are regularly monitored and must comply with the limits defined. The monitoring is reported to the risk commissions and to the Board of Directors, guiding the use of preventive measures to ensure that exposures are within the limits provided and in line with the bank’s strategy. Risk Culture Aiming at strengthening its values and aligning the behavior of its employees with risk management guidelines, the institution adopts several initiatives to disseminate and strengthen its Risk Culture, which is based on four principles: conscious risk taking, discussions and actions on the institution’s risks, and each and everyone’s responsibility for risk management.    In addition to the bank’s policies, procedures and processes of risk management, the Risk Culture strengthens the employees’ individual and collective responsibility in understanding, identifying, measuring, managing and mitigating the risks connected to their activities, respecting the business management ethically.    The institution promotes its Risk Culture by emphasizing a behavior that helps people of all company levels to undertake and manage risks in a conscious way. By disseminating these principles, the institution fosters the understanding and the open discussion about risks, so that they are kept within the risk appetite levels established and each employee individually, regardless of their position, area or duties, may also assume responsibility for managing the risks of the business. Itaú Unibanco also makes some channels available for communication of operating failures, internal or external fraud, conflicts at the workplace, or cases that may result in inconveniences and/or losses for the institution or its customers. All employees or third parties are responsible for informing any problems immediately, as soon as they become aware of the situation. Stress Testing The stress test is a process of simulating extreme economic and market conditions on Itaú Unibanco’s results, liquidity and capital. The institution has been carrying out this test in order to assess its solvency in plausible scenarios of systemic crisis, as well as to identify areas that are more susceptible to the impact of stress that may be the subject of risk mitigation. For the purposes of the test, the economic research area estimates macroeconomic variables for each stress scenario. The elaboration of stress scenarios considers the qualitative analysis of the Brazilian and the global conjuncture, historical and hypothetical elements, short and long term risks, among other aspects, as defined in CMN Resolution 4,557. In this process, the main potential risks to the economy are assessed based on the judgment of the bank’s team of economists, endorsed by the Chief Economist of Itaú Unibanco and approved by the Board of Directors. Projections for the macroeconomic variables (such as GDP, the basic interest rate and inflation) and for variables in the credit market (such as raisings, lending, rates of default, margins and charges) used are based on exogenous shocks or through use of models validated by an independent area. Then, the stress scenarios adopted are used to influence the budgeted result and balance sheet. In addition to the scenario analysis methodology, sensitivity analysis and the Reverse Stress Test are also used. Itaú Unibanco uses the simulations to manage its portfolio risks, considering Brazil (segregated into wholesale and retail) and External Units, from which the risk-weighted assets and the capital and liquidity ratios are derived.    5 Itaú Unibanco

Risk and Capital Management – Pillar 3 The stress test is also an integral part of the ICAAP (Internal Capital Adequacy Process), the main purpose of which is to assess whether, even in severely adverse situations, the institution would have adequate levels of capital and liquidity, without any impact on the development of its activities. This information enables potential offenders to the business to be identified and provides support for the strategic decisions of the Board of Directors, the budgeting and risk management process, as well as serving as an input for the institution’s appetite metrics. Recovery Plan In response to the latest international crises, the Central Bank issued the Resolution No. 4,502, which requires the development of a Recovery Plan for the financial institutions that are classified in the Segment 1, with a total exposure of more than 10% of Gross Domestic Product (GDP). This plan aims to reestablish adequate levels of capital and liquidity, above the regulatory requirements, through appropriate strategies in the event of severe stress shocks of a systemic or idiosyncratic nature. Accordingly, each institution would be able to preserve its financial feasibility and, at the same time, mitigate the impact on the National Financial System. Itaú Unibanco has a Recovery Plan that contemplates the entire conglomerate, including foreign subsidiaries, and contains the description of the following items: I—Critical functions rendered by Itaú Unibanco to the market, activities that, if abruptly interrupted, could impact the National Financial System (SFN) and the functioning of the real economy; II—Institution’s essential services: activities, operations or services which discontinuity could compromise the bank’s viability; III—Monthly monitoring program, establishing critical levels for a set of indicators, with a view to risk monitoring and eventual trigger for the execution of the Recovery Plan; IV—Stress scenarios, contemplating events that may threaten the business continuity and the viability of the institution, including reverse tests, which seek to identify remote risk scenarios, contributing to an increase of the management sensitivity; V—Recovery strategies in response to different stress scenarios, including the main risks and barriers, as well as the mitigators of the latter and the procedures for the operationalization of each strategy; VI—Communication plan with stakeholders, seeking its timely execution with the market, regulators and other stakeholders; VII—Governance mechanisms necessary for the coordination and execution of the Recovery Plan, such as the definition of the director responsible for the exercise at Itaú Unibanco. This plan is reviewed annually and is subjected to the approval of the Board of Directors. With this practice, Itaú Unibanco has been able to continuously demonstrate, since its first edition in 2017, that even in severe scenarios, with remote probability of occurrence, it has strategies capable of generating sufficient resources to ensure the sustainable maintenance of critical activities and essential services, without losses to customers, to the financial system and to other participants in the markets in which it operates. Itaú Unibanco ensures the exercise maintenance to guarantee that strategies remain up-to-date and viable in the face of organizational, competitive or systemic changes. Capital Adequacy Assessment For its capital adequacy assessment process, the annual Itaú Unibanco’s procedure is as follows:    Identification of material risks and assessment of the need for additional capital;    Preparation of the capital plan, both in normality and stress situations;    Internal assessment of capital adequacy;    6 Itaú Unibanco

Risk and Capital Management – Pillar 3    Structuring of capital contingency and recovery plans;    Preparation of management and regulatory reports. By adopting a prospective stance regarding capital management, Itaú Unibanco implemented its capital management structure and its ICAAP in order to comply with National Monetary Council (CMN) Resolution 4,557, BACEN Circular 3,846 and BACEN Circular Letter 3,907. The result of the last ICAAP – dated as of December 2019 – showed that, in addition to having enough capital to face all material risks, Itaú Unibanco has a significant buffer, thus ensuring the soundness of its equity position. Capital Adequacy Itaú Unibanco, through the ICAAP process, assesses the adequacy of its capital to face the incurred risks, composed by regulatory capital for credit, market and operational risks and by the necessary capital to face other risks. In order to ensure the soundness and the availability of Itaú Unibanco’s capital to support business growth, the Total Capital levels were maintained above the minimum requirements.

Risk and Capital Management – Pillar 3 OV1: Overview of risk-weighted assets (RWA) According to CMN Resolution 4,193 and subsequent amendments, for assessing the minimum capital requirements, the RWA must be calculated by adding the following risk exposures: RWA = RWACPAD + RWAMINT + RWAOPAD    RWACPAD = portion related to exposures to credit risk, calculated using standardized approach; RWAMINT = portion related to the market risk capital requirement, made up of the maximum between the internal model and 80% of the standardized model, and regulated by BACEN Circulars 3,646 and 3,674; RWAOPAD = portion related to the operational risk capital requirement, calculated using standardized approach.    a b c    RWA Minimum capital                requirements R$ million 03/31/2020 12/31/2019 03/31/2020 0 Credit Risk: standardised approach 917,107 784,730 73,369 2 Credit risk (excluding counterparty credit risk) 747,680 690,474 59,814 6 Counterparty credit risk (CCR) 56,632 31,356 4,531 7 Of which: standardised approach for counterparty credit risk (SA-CCR) 40,281 16,523 3,222 7a Of which: Current Exposure Method approach (CEM) - - - 9 Of which: other CCR 16,351 14,833 1,308 10 Credit valuation adjustment (CVA) 9,576 3,494 766 12 Equity investments in funds—look-through approach 5,820 7,669 466 13 Equity investments in funds—mandate-based approach 264 205 21 14 Equity investments in funds—fall-back approach 1,520 1,133 122 16 Securitisation exposures—standardised approach - - - 25 Amounts below the thresholds for deduction 95,615 50,399 7,649 20 Market risk 33,934 25,002 2,715 21 Of which: standardised approach 39,942 28,328 3,195 22 Of which: internal models approach (IMA) 33,934 25,002 2,715 24 Operational risk 92,476 81,568 7,398 27 Total 1,043,517 891,300 83,481 The increase in RWA compared to the previous quarter was mainly due to the growth in the credit risk-weighted assets (RWACPAD), driven by the foreign exchange variation and expansion in credit portfolio. Leverage Ratio The Leverage Ratio is defined as the ratio between Tier I Capital and Total Exposure, calculated according to BACEN Circular 3,748. The ratio is intended to be a simple measure of non-risk-sensitive leverage, and so it does not take into account risk weights or risk mitigation.    As required by BACEN Circular Letter 3,706, Itaú Unibanco has since October 2015 been reporting the Leverage Ratio to BACEN monthly. As from January 1st, 2018, the Resolution 4,615 was put into force and established minimum requirement at 3% for the Leverage Ratio. The following information is based on the methodology and standard format introduced by BACEN Circular 3,748. LR1: Summary comparison of accounting assets vs leverage ratio exposure measure (RA) R$ million 03/31/2020 a 1 Total consolidated assets as per published financial statements 1,982,498 2 Adjustment for differences in consolidation of accounts - 199,571 1+2 Total individual balance sheet or regulatory consolidation, in case of Leverage Ratio on consolidation basis 1,782,927 4 Adjustments for derivative financial instruments 20,909 5 Adjustment for securities financing transactions (ie repos and similar secured lending) 12,451 6 Adjustment for off-balance sheet items (ie conversion to credit equivalent amounts of off-balance sheet exposures) 128,702 7 Other adjustments - 201,815 8 Exposição Total 1,743,174    8 Itaú Unibanco

Risk and Capital Management – Pillar 3    LR2: Leverage ratio common disclosure                a b R$ million 03/31/2020 12/31/2019 Items shown in the Balance Sheet                Balance sheet items other than derivative financial instruments, securities received on loan and resales for settlement    1    1,293,791 1,189,661 under repurchase transactions    2 Adjustments for equity items deducted in calculating Level I Capital - 42,184 - 34,260 3 Total exposure shown in the Balance Sheet 1,251,607 1,155,401 Transactions using Derivative Financial Instruments    4 Replacement value for derivatives transactions 57,616 28,149 5 Potential future gains from derivatives transactions 11,296 13,128 7 Adjustment for collateral in derivatives transactions - - Adjustment related to the deduction of the exposure because of the qualified central counterparty (QCCP) in    8 derivative transactions on behalf of clients in which there is no contractual obligation to reimburse due to bankruptcy - 6,457 - 6,080 or default of the entities responsible for the settlement and compensation of transactions    9 Reference value for credit derivatives 14,081 10,444 10 Adjustment of reference value calculated for credit derivatives - 1,152 - 706 11 Total exposure for derivative financial instruments 75,384 44,935 Repurchase Transactions and Securities Lending (TVM)    12 Investments in repurchase transactions and securities lending 263,386 196,504 13 Adjustment for repurchases for settlement and creditors of securities lending - - 14 Amount of counterparty credit risk 12,451 12,458 15 Amount of counterparty credit risk in transactions as intermediary 11,644 15,291 16 Total exposure for repurchase transactions and securities lending 287,481 224,253 Off-balance sheet items    17 Reference value of off-balance sheet transactions 392,721 375,391 18 Adjustment for application of FCC specific to off-balance sheet transactions - 264,019 - 253,417 19 Total off-balance sheet exposure 128,702 121,974 Capital and Total Exposure    20 Level I 124,980 128,696 21 Total Exposure 1,743,174 1,546,564 Leverage Ratio    22 Basel III Leverage Ratio 7.2% 8.3% The leverage ratio decreased by 1.1 p.p. compared to December/19, due to the R$ 3,716 million decrease in Tier I capital and the R$ 196,610 million increase in exposures, driven by the foreign exchange variation and expansion in credit portfolio.     9 Itaú Unibanco

Risk and Capital Management – Pillar 3 Liquidity Ratios LIQA: Liquidity Risk Management Information    Framework and Treatment Liquidity risk is defined as the likelihood of the institution not being able to effectively honor its expected and unexpected obligations, current and future, including those from guarantees commitment, without affecting its daily operations or incurring significant losses. In line with the fundraising strategy, Itaú Unibanco has diversified and stable sources of funding available, monitored through concentration and maturity indicators, in order to mitigate liquidity risks, in accordance with the institution’s risk appetite. The governance of the liquidity risk management is based on advisory boards, subordinated to the Board of Directors or the executive structure of Itaú Unibanco. Such boards establish the institution’s risk appetites, define the limits related to the liquidity control and monitor the liquidity indicators. The control of the liquidity risk is carried out by an area that is independent of the business areas, responsible for defining the composition of the reserve, estimating the cash flow and the exposure to liquidity risk in different time horizons and monitoring short and long term liquidity indicators (LCR and NSFR respectively). In addition, it proposes minimum limits to absorb losses in stress scenarios for each country where Itaú Unibanco operates and reports any non-compliance to the competent authorities. All activities are subject to verification by the independent validation, internal controls and audit departments. Additionally, and pursuant to the requirements of Resolution 4,557, BACEN Circular 3,749 and Circular 3,869, the Liquidity Risk Statement (DRL—LCR) and the Long Term Liquidity Statement (DLP—NSFR) are monthly sent to BACEN. Finally, the following items are periodically prepared and submitted to senior management for monitoring and decision support:    Stress of liquidity indicators based on macroeconomic scenarios, simulation of reverse stress based on risk appetite, and projection of the main liquidity indicators to support decisions;    Contingency and recovery plans for crisis situations, with actions that provide for a gradation according to the level of criticality determined by the easiness of implementation, taking into account the characteristics of the local market in which it operates, seeking a rapid restoration of liquidity indicators;    Reports and graphs that describe risk positions;    Concentration indicators of funding providers and time. The document that details the liquidity risk control institutional policy is on the Investor Relations website https://www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Reports.    10 Itaú Unibanco

Risk and Capital Management – Pillar 3    LIQ1: Liquidity Coverage Ratio (LCR)    a b    Total unweighted Total weighted value 03/31/2020 (1) value (3)    (In thousand R$)(2) (In thousand R$) High Quality Liquidity Assets (HQLA)    1 Total High Quality Liquid Assets (HQLA) 186,704,896 Cash Outflows (4)    2 Retail deposits and deposits from small business customers, of which: 296,206,563 25,694,306 3 Stable deposits 163,257,200 8,162,860 4 Less stable deposits 132,949,363 17,531,446 5 Unsecured wholesale funding, of which: 190,988,478 88,584,954 6 Operational deposits (all counterparties) and deposits in networks of cooperative banks 1,079,795 53,990 7 Non-operational deposits (all counterparties) 187,931,523 86,553,804 8 Unsecured debt 1,977,160 1,977,160 9 Secured wholesale funding 12,440,105 10 Additional requirements, of which: 248,398,774 32,527,090 11 Outflows related to derivative exposures and other collateral requirements 38,109,640 17,745,247 12 Outflows related to loss of funding on debt products 1,383,532 1,383,532 13 Credit and liquidity facilities 208,905,602 13,398,311 14 Other contractual funding obligations 68,898,360 68,898,360 15 Other contingent funding obligations 93,297,087 13,092,603 16 Total Cash Outflows 241,237,419 Cash Inflows (4)    17 Secured lending (eg reverse repos) 145,548,247 1,068,134 18 Inflows from fully performing exposures 33,507,923 20,703,815 19 Other cash inflows 119,500,991 106,624,842 20 TOTAL CASH INFLOWS 298,557,161 128,396,792    Adjusted Total value    (5) 21 Total HQLA 186,704,896 22 Total net cash outflows 112,840,627 23 Liquidity Coverage Ratio (%) 165.5% (1) It corresponds to 62 daily average observations (2) Total balance off the cash inflows or outflows (3) After aplication of weighting factors (4) Potential cash outflows (Outflows ) and inflows (inflows ) e e (5) Amount calculated after applying weighting factors and limits set by BACEN Circular 3,749 Itaú Unibanco has High Quality Liquidity Assets (HQLA) that amounted to R$ 186.7 billion on average for the quarter, mainly composed of Sovereign Securities, Central Bank Reserves and Cash. Net Cash Outflows amounted to R$ 112.8 billion on average for the quarter, which are mostly comprised of Retail Captures, Wholesale, Additional Requirements, Contractual and Contingent Obligations, offset by Cash inflows from loans and other Cash inflows. The table shows that the average LCR in the quarter is 165.5%, above the limit of 100%, and therefore the institution has high quality liquidity comfortably available to support the losses in the standardized stress scenario for the LCR. 11 Itaú Unibanco

Risk and Capital Management – Pillar 3 LIQ2: Net Stable Funding Ratio (NSFR)    a b c d e    Value per residual effective maturity term (R$ thousand)                Greater than or equal to                Lower than six Greater than or equal Weighted Value (2)    No Maturity (1) six months, and lower (1)    03/31/2020 months (1) than 1 year (1) to 1 year (In thousand R$) Available Stable Funding (ASF) (3)                1 Capital - - - 194,980,605 194,980,605 2 Reference Equity, gross of regulatory deductions - - - 137,430,011 137,430,011 3 Other capital instruments not included in line 2 - - - 57,550,594 57,550,594 4 Retail Funding: 170,828,358 167,161,822 5,255,610 12,929,246 330,077,701 5 Stable Funding 106,355,218 69,000,506 687,599 240,560 166,887,582 6 Less Stable Funding 64,473,139 98,161,316 4,568,012 12,688,686 163,190,118 7 Wholesale Fuding: 47,511,552 590,742,473 70,020,066 122,921,020 283,051,195 8 Operational deposits and deposits of member cooperatives 3,262,279 - - - 1,631,139 9 Other Wholesale Funding 44,249,274 590,742,473 70,020,066 122,921,020 281,420,056 Opertions in which the institution acts exclusively as                10 intermediary, not undertaking any rights or obligations, even if - 67,328,769 6,221,477 401,217 - contingent                11 Other liabilities, in which: 83,199,437 192,628,097 705,633 3,217,642 3,570,459 12 Derivatives whose replacement values are lower than zero 48,682,390 - - 13 Other liability or equity elements not included above 83,199,437 143,945,707 705,633 3,217,642 3,570,459 14 Total Available Stable Funding (ASF)    811,679,959 Required Stable Funding (RSF) (3)                15 Total NSFR high quality liquid assets (HQLA)    16,981,670 16 Operational deposits held at other financial institutions - - - - - Performing loans and securities (financial institutions,                17 - 477,502,650 95,107,100 351,502,424 443,424,000 corporates and central banks)                18 Performing loans to financial institutions secured by Level 1 HQLA - 20,697,926 - 8,795 2,078,588 Performing loans to financial institutions secured by non-Level 1                19 - 43,438,016 3,452,473 23,255,498 31,499,545 HQLA and unsecured performing loans to financial institutions                Performing loans to non-financial corporate clients, loans to retail and                20 small business customers, and loans to sovereigns, central banks, of - 393,075,750 75,351,648 191,285,945 282,684,421 which:                With a risk weight of less than or equal to 35%, approach for credit                21 - - - - - risk, according to Circular 3,644.                22 Performing residential mortgages, of which: - 4,866,047 4,188,457 67,217,298 53,861,404 23 Which are in accordance to Circular 3,644, 2013, art. 22 - - - 45,169,071 31,315,444 Securities that are not in default and do not qualify as HQLA,                24 - 15,424,910 12,114,523 69,734,888 73,300,042 including exchange-traded equities                Operations in which the institution acts exclusively as                25 intermediary, not undertaking any rights or obligations, even if - 68,247,631 6,835,420 899,993 - contingent                26 Other assets, in which: 4,860,726 244,786,428 9,191,679 151,125,334 217,858,533 Transactions with gold and commodities, including those with                27 -    - expected physical settlement                Assets posted as initial margin for derivatives contracts and                participation in mutual guarantee funds of clearinghouses or                28    - - 28,843,840 24,517,264 providers of clearing and settlement services which acts as central                counterparty.                29 Derivatives whose replacement values are higher than or equal to - - 51,112,292 2,294,379 Derivatives whose replacement values are less than zero, gross of                30 the deduction of any collateral provided as a result of deposit of - - 2,435,118 2,435,118 variation margin                31 All other assets not included in the above categories 4,860,726 244,786,428 9,191,679 68,734,084 188,611,773 32 Off-balance sheet transactions 408,000,058 - - - 16,870,353 33 Total Required Stable Funding (RSF)    695,134,557 34 NSFR (%)    116.8% (1) It corresponds the total amount of available stable funding (ASF) or required stable funding (RSF).    (2) Corresponds to the amount after application of weighting factors.                (3) Corresponds to available stable funding (ASF) or required stable funding (RSF).                Itaú Unibanco has Available Stable Funding (ASF) amounted to R$ 811.7 billion in the first quarter, mainly composed of Capital, Retail Funding and Wholesale. In addition, Required Stable Funding (RSF) amounted to R$ 695.1 billion in the 1st quarter, which are mostly composed of loans and financing granted to wholesale, retail, central economies and central bank operations. The table shows that the NSFR at the end of the quarter is 116.8%, above the limit of 100%, and therefore the institution has Available Stable Funding comfortably to support the Required Stable Funding in the long-term, according to the metric. 12 Itaú Unibanco

Risk and Capital Management – Pillar 3 Market Risk MRA: Qualitative disclosure requirements related to market risk Market risk is the possibility of losses resulting from fluctuations in the market values of positions held by a financial institution, including the risk of operations subject to variations in foreign exchange rates, interest rates, equity and commodity prices, as set forth by CMN. Price Indexes are also treated as a risk factor group. The institutional policy for market risk is in compliance with Resolution 4,557 and establishes the management structure and market risk control, which has the function of:    Provide visibility and comfort for all senior management levels that market risks assumed must be in line with Itaú Unibanco risk-return objectives;    Provide disciplined and informed dialogue on the overall market risk profile and its evolution over time;    Increase transparency as to how the business works to optimize results;    Provide early warning mechanisms to facilitate effective risk management, without obstructing the business objectives; and    Monitor and avoid concentration of risks. Market risk is controlled by an area independent of the business units, which is responsible for the daily activities: (i) measuring and assessing risk, (ii) monitoring stress scenarios, limits and alerts, (iii) applying, analyzing and stress testing scenarios, (iv) reporting risk to the individuals responsible in the business units, in compliance with Itaú Unibanco´s governance, (v) monitoring the measures needed to adjust positions and/or risk levels to make them viable, and (vi) supporting the secure launch of new financial products. Market risk management framework categorizes transactions as part of either the Trading Book or the Baking Book, in accordance with general criteria established by CMN Resolution 4,557 and BACEN Circular 3,354. Trading Book is composed of all trades with financial and commodity instruments (including derivatives) undertaken with the intention of trading. Banking Book is predominantly characterized by portfolios originated from the banking business and operations related to balance sheet management, are intended to be either held to maturity, or sold in the medium and in the long term. Market risk management is based on the following key metrics:    Value at Risk (VaR): a statistical metric that quantifies the maximum potential economic loss expected in normal market conditions, considering a defined holding period and confidence interval;    Losses in Stress Scenarios (Stress Testing): a simulation technique to evaluate the impact, in the assets, liabilities and derivatives of the portfolio, of various risk factors in extreme market situations (based on prospective and historic scenarios);    Stop Loss: metrics that trigger a management review of positions, if the accumulated losses in a given period reach specified levels;    Concentration: cumulative exposure of certain financial instrument or risk factor calculated at market value (“MtM—Mark to Market”); and    Stressed VaR: statistical metric derived from VaR calculation, aimed at capturing the biggest risk in simulations of the current trading portfolio, taking into consideration the observable returns in historical scenarios of extreme volatility. In addition to the risk metrics described above, sensitivity and loss control measures are also analyzed. They include:    Gap Analysis: accumulated exposure of the cash flows by risk factor, which are marked-to-market and positioned by settlement dates;    13 Itaú Unibanco

Risk and Capital Management – Pillar 3    Sensitivity (DV01 – Delta Variation Risk): impact on the market value of cash flows when a 1 basis point change is applied to current interest rates or on the index rates; and    Sensitivities to Various Risk Factors (Greeks): partial derivatives of a portfolio of options on the prices of the underlying assets, implied volatilities, interest rates and time. In an attempt to fit the transactions into the defined limits, Itaú Unibanco hedges its client transactions and proprietary positions, including investments overseas. Derivatives are the most commonly used instruments for carrying out these hedging activities, and can be characterized as either accounting or economic hedge, both of which are governed by institutional regulations at Itaú Unibanco. The structure of limits and alerts is in alignment with the board of directors’ guidelines, being reviewed and approved on an annual basis. This structure extends to specific limits and is aimed at improving the process of risk monitoring and understanding as well as preventing risk concentration. Limits and alerts are calibrated based on projections of future balance sheets, stockholders’ equity, liquidity, complexity and market volatility, as well as the Itaú Unibanco’s risk appetite.    The consumption of market risk limits is monitored and disclosed daily through exposure and sensitivity maps. The market risk area analyzes and controls the adherence of these exposures to limits and alerts and reports them timely to the Treasury desks and other structures foreseen in the governance. Itaú Unibanco uses proprietary systems to measure the consolidated market risk. The processing of these systems takes place in an access-controlled environment, being highly available, which has data safekeeping and recovery processes, and counts on an infrastructure to ensure the continuity of business in contingency (disaster recovery) situations. MR1: Market risk under standardized approach R$ million 03/31/2020 a Risk factors RWAMPAD 1 Interest Rates 35,707 1a Fixed rate denominated in reais (RWAJUR1 ) 2,851 1b Foreign exchange linked interest rate (RWAJUR2 ) 17,726 1c Price index linked interest rate (RWAJUR3 ) 15,130 1d Interest rate linked interest rate (RWAJUR4 ) - 2 Stock prices (RWAACS ) 490 3 Exchange rates (RWACAM ) 2,402 4 Commodity prices (RWACOM ) 1,343 9 Total 39,942    14 Itaú Unibanco

Risk and Capital Management – Pillar 3 MRB: Qualitative disclosures on market risk in the Internal Models Approach (IMA) In the internal models approach, the stressed VaR and VaR models are used. These models are applied to operations in the Trading Book and Banking Book. For the Trading Book, the risk factors considered are: interest rates, inflation rates, exchange rates, stocks and commodities. For the Banking Book, exchange rates and commodities are considered. The VaR and stressed VaR models are used in the companies in the prudential conglomerate, presented in the following table: Institution Model considered for Market Risk Aj Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI VaR and Stressed VaR Banco Investcred Unibanco S.A. VaR and Stressed VaR Banco Itaú Argentina S.A. VaR and Stressed VaR Banco Itaú BBA S.A. VaR and Stressed VaR Banco Itaú Consignado S.A. VaR and Stressed VaR Banco Itaú Veículos S.A. VaR and Stressed VaR Banco ItauBank S.A. VaR and Stressed VaR Banco Itaucard S.A. VaR and Stressed VaR Banco Itauleasing S.A. VaR and Stressed VaR Dibens Leasing S.A.—Arrendamento Mercantil VaR and Stressed VaR Fideicomisos Financiero Privados BHSA VaR and Stressed VaR Financeira Itaú CBD S.A. Crédito, Financiamento e Investimento VaR and Stressed VaR Fundo Crédito Universitário FIDC I VaR and Stressed VaR Fundo Crédito Universitário FIDC II VaR and Stressed VaR Fundo De Invest Dir Creditórios Não Padron NPL II VaR and Stressed VaR Fundo de Investimento em Direitos Creditórios Não-Padronizados Barzel VaR and Stressed VaR Fundo Even II Kinea FII VaR and Stressed VaR Fundo Fortaleza de Investimento Imobiliário VaR and Stressed VaR Fundo Kinea Ações VaR and Stressed VaR Hipercard Banco Múltiplo S.A. VaR and Stressed VaR Intrag Distribuidora de Títulos e Valores Mobiliários Ltda. VaR and Stressed VaR Iresolve Companhia Securitizadora de Créditos Financeiros S.A. VaR and Stressed VaR Itaú Administradora de Consórcios Ltda. VaR and Stressed VaR Itaú Bank & Trust Bahamas Ltd. VaR and Stressed VaR Itaú Bank & Trust Cayman Ltd. VaR and Stressed VaR Itaú Bank, Ltd. VaR and Stressed VaR Itaú BBA USA Securities Inc. VaR and Stressed VaR Itaú Cia. Securitizadora de Créditos Financeiros VaR and Stressed VaR Itaú Corretora de Valores S.A. VaR and Stressed VaR Itaú Distribuidora de Títulos e Valores Mobiliários S.A. VaR and Stressed VaR Itaú Kinea Private Equity Multimercado Fundo de Investimento em Cotas de Fundos de Investimento Crédito Privado VaR and Stressed VaR Itaú Unibanco Holding S.A. VaR and Stressed VaR Itaú Unibanco Holding S.A., Grand Cayman Branch VaR and Stressed VaR Itaú Unibanco S.A. VaR and Stressed VaR Itaú Unibanco S.A., Grand Cayman Branch VaR and Stressed VaR Itaú Unibanco S.A., Nassau Branch VaR and Stressed VaR Itaú Unibanco S.A., Tokyo Branch VaR and Stressed VaR Itaú Unibanco Veículos Administradora de Consórcios Ltda. VaR and Stressed VaR Itaú Valores S.A. VaR and Stressed VaR Itauvest Distribuidora de Títulos e Val. Mobiliários S.A. VaR and Stressed VaR ITB Holding Ltd. VaR and Stressed VaR Kinea Ações Fundo de Investimento em Ações VaR and Stressed VaR Kinea Ações Fundo de Investimento em Cotas de Fundos de Investimento em Ações VaR and Stressed VaR Kinea CO-investimento Fundo de Investimento Imobiliario VaR and Stressed VaR Kinea I Private Equity FIP Multiestrategia VaR and Stressed VaR Kinea II Macro Fundo de Investimento Multimercado Crédito Privado VaR and Stressed VaR Kinea KP Fundo de Investimento Multimercado Crédito Privado VaR and Stressed VaR Kinea Ventures FIP VaR and Stressed VaR Licania Fund Limited VaR and Stressed VaR Luizacred S.A. Sociedade de Crédito, Financiamento e Investimento VaR and Stressed VaR Microinvest S.A. Soc. de Crédito a Microempreendedor VaR and Stressed VaR Oiti Fundo de Investimento Multimercado Crédito Privado Investimento no Exterior VaR and Stressed VaR RedeCard S.A. VaR and Stressed VaR RT Itaú DJ Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI VaR and Stressed VaR RT Scala Renda Fixa—Fundo de Investimento em Cotas de Fundos de Investimento VaR and Stressed VaR RT Voyager Renda Fixa Crédito Privado—Fundo de Investimento VaR and Stressed VaR Universo FIP Multiestratégia VaR and Stressed VaR Itaú Unibanco, for regulatory purposes, uses the historical simulation methodology to calculate the VaR and Stressed VaR. This methodology uses the returns observed in the past to calculate the gains and losses of a portfolio over time, with a 99% confidence interval and a holding period of at least 10 days. On 03/31/2020, VaR    15 Itaú Unibanco

Risk and Capital Management – Pillar 3 represented 47% of the capital requirement, while the stressed VaR represented 53%. The same methodology is used for management purposes, that is, there are no differences between the managerial and regulatory models. In relation to the VaR model, the historical returns are updated daily. Itaú Unibanco uses in its VaR model both the unweighted approach, in which historical data have the same weight, and the weighted by the volatility of returns. For the calculation of volatilities, the Exponentially Weighted Moving Average method is used. The Historical VaR methodology with 10-day maintenance periods assumes that the expected distribution for possible losses and gains for the portfolio can be estimated from the historical behavior of the returns of the market risk factors to which this portfolio is exposed. The returns observed in the past are applied to current operations, generating a distribution of probability of losses and simulated gains that are used to estimate the Historical VaR, according to the 99% confidence level and using a historical period of 1,000 days. Losses and gains from linear operations are calculated by multiplying mark-to-market by returns, while non-linear operations are recalculated using historical returns. The returns used in simulating the movements of risk factors are relative Regarding the Stressed VaR model, the calculation is performed for a time horizon of 10 working days, considering the 99% confidence level and simple returns in the historical period of one year. The historical stress period is periodically calculated for the period since 2004 and can be revised whenever deemed necessary. This can occur when the composition of Itaú Unibanco’s portfolios changes significantly, when changes are observed in the results of the simulation of historical returns or when a new market crisis occurs. Losses and gains from linear operations are calculated by multiplying mark to market by returns, while nonlinear operations are recalculated using historical returns. In addition to the use of VaR, Itaú Unibanco carries out daily risk analysis in extreme scenarios through a diversified framework of stress tests, in order to capture potential significant losses in extreme market situations. The scenarios are based on historical, prospective crises and predetermined shocks in risk factors. One factor that has a great influence on the results of the tests, for example, is the correlation between the assets and the respective risk factors, and this effect is simulated in several ways in the various scenarios tested. In order to identify its greatest risks and assist in the decision-making of treasury and senior management, the results of stress tests are assessed by risk factors, as well as on a consolidated basis. The effectiveness of the VaR model is proven by backtesting techniques, by comparing hypothetical and actual daily losses and gains, with the estimated daily VaR, according to BACEN Circular 3,646. The number of exceptions to the established VaR limits must be compatible, within an acceptable statistical margin, with the hypothesis of 99% confidence intervals, considering a window of 250 working days. Confidence intervals of 97.5% and 95% and windows of 500 and 750 working days, respectively, are also considered. Itaú Unibanco has a set of processes, which are periodically executed by the internal control teams, whose objective is to independently replicate the metrics that influence market risk capital by internal models. In addition to the results of the periodic processes, Itaú Unibanco assesses the process of measuring time horizons by risk factors and the estimate of the stress period for calculating the stressed VaR. The validation of the internal model includes several topics considered essential for the critical analysis of the model, such as, the evaluation of the model’s limitations, the adequacy of the parameters used in the volatility estimate and the comprehensiveness and reliability of the input data.    16 Itaú Unibanco

Risk and Capital Management – Pillar 3 MR2: RWA flow statements of market risk exposures under an IMA Exposures subject to market risk The following table presents the exposures subject to market risk in the internal models approach, for calculating the capital requirement. a b e f R$ million VaR Stressed VaR Other Total RWAMINT 1 RWAMINT—12/31/2019 6,238 11,050 7,715 25,002 2 Movement in risk levels (350) (1,875) - (2,225) 3 Updates/changes to the internal model - - - - 4 Methodology and regulation - - - - 5 Acquisitions and disposals - - - - 6 Foreign exchange movements 513 (1,825) - (1,313) 7 Other - - 12,470 12,470 8 RWAMINT—03/31/2020 6,400 7,350 20,184 33,934 The increase in RWAMINT compared to the previous quarter was mainly due to the reduction of the diversification effect between the positions held by Itaú Unibanco. MR3: IMA values for trading portfolios The following table presents the VaR and stressed VaR values determined by the internal market risk models. R$ million a    VaR (10 days, 99%)    1 Maximum value 398 2 Average value 142 3 Minimum value 62 4 Quarter end 398 Stressed VaR (10 days, 99%)    5 Maximum value 394 6 Average value 197 7 Minimum value 101 8 Quarter end 394 The VaR and the stressed VaR increased compared to the previous quarter due to market volatility, caused by the COVID-19 pandemic.    17 Itaú Unibanco

Risk and Capital Management – Pillar 3 MR4: Comparison of VaR estimates with gains/losses Backtesting The effectiveness of the VaR model is validated by backtesting techniques, comparing daily hypothetical and actual results with the estimated daily VaR. The daily VaR is calculated over a one-day maintenance horizon, according to the 99% confidence level and using a historical period of 1,000 days. The percentage of capital requirement associated with this model is 100%.    Green (0 to 4 exceptions): backtesting results that do not suggest any problem with the quality or accuracy of the adopted models;    Yellow (5 to 9 exceptions): intermediate range group, which indicates an early warning monitoring and may indicate the need to review the model; and    Red (10 or more exceptions): need for improvement actions. The following chart shows the comparison between VaR and actual and hypothetical results. The Backtesting presented three exceptions in relation to the hypothetical results and two exceptions in relation to the actual results in the period. The first exception in relation to the hypothetical result occurred on 08/12/2019, in the amount of R$ 6.9 million, caused by the increased levels of volatility in the Argentine market. The second and third exceptions occurred on 03/09/2020 and 03/11/2020, in the amounts of R$ 48.5 million and R$ 4.5 million, respectively. These excesses were caused by the increased level of market volatility due to the COVID-19 pandemic. Regarding the actual result, the exceptions occurred on 03/09/2020 and 03/12/2020, in the amounts of R$ 68.3 million and R$ 32.7 million, respectively. These excesses were caused by the increased level of market volatility due to the COVID-19 pandemic. The actual results do not include fees, brokerage fees and commissions. There are no profit reserves.    18 Itaú Unibanco

Risk and Capital Management – Pillar 3 Evolution of the Derivatives Portfolio The main purpose of the derivative positions is to manage risks in the Trading Book and in the Banking Book in the corresponding risk factors. Derivatives: Trades in Brazil—Trading + Banking—With Central Counterparty    R$ million    03/31/2020 12/31/2019 03/31/2019 Risk Factors Long Short Long Short Long Short Interest Rates 135,276 (146,301) 284,380 (81,782) 121,116 (92,398) Foreign Exchange 240,554 (314,032) 166,314 (200,784) 44,810 (60,918) Equities 3,668 (3,299) 600 (186) 1,900 (500) Commodities 1,154 (1,259) 981 (1,100) 102 (118) Derivatives: Trades in Brazil—Trading + Banking—Without Central Counterparty    R$ million    03/31/2020 12/31/2019 03/31/2019 Risk Factors Long Short Long Short Long Short Interest Rates 34,287 (32,580) 31,517 (42,525) 43,269 (36,458) Foreign Exchange 26,193 (43,373) 16,863 (32,641) 16,172 (41,583) Equities - (4,048) 11 (79) - (67) Commodities 100 - 107 - 79 (50) Derivatives: Foreign Trades - Trading + Banking—With Central Counterparty    R$ million    03/31/2020 12/31/2019 03/31/2019 Risk Factors Long Short Long Short Long Short Interest Rates 19,216 (12,885) 21,929 (12,932) 535 (2,656) Foreign Exchange 52,614 (64,349) 62,843 (72,285) 76,365 (74,717) Equities 1,839 (3,677) 515 (770) 634 (2,471) Commodities - - - - - (31) Derivatives: Foreign Trades - Trading + Banking—Without Central Counterparty    R$ million    03/31/2020 12/31/2019 03/31/2019 Risk Factors Long Short Long Short Long Short Interest Rates 62,002 (97,177) 40,413 (91,245) 44,214 (103,024) Foreign Exchange 357,057 (347,109) 277,082 (265,414) 251,375 (244,894)    19 Itaú Unibanco

Risk and Capital Management – Pillar 3 Glossary of Acronyms A    ARF – Área de Riscos e Finanças (Risk and Finance Department) ASF – Available Stable Funding B    BACEN—Banco Central do Brasil (Central Bank of Brazil) C    CCR – Counterparty Credit Risk CEM—Current Exposure Method CEO—Chief Executive Officer CET1—Common Equity Tier I CGRC—Comitê de Gestão de Risco e Capital (Risk and Capital Management Committee) CMN—Conselho Monetário Nacional (National Monetary Council) Comef—Comitê de Estabilidade Financeira (Financial Stability Committee) CRO—Chief Risk Officer CVA—Credit Valuation Adjustment D    DLP—Long- Term Liquidity Statement DRL—Liquidity Risk Statement D-SIB—Domestic Systemically Important Banks DV—Delta Variation F    FCC—Credit Conversion Credit FPR—Fator de Ponderação de Risco (weighting factor) G    GAP—Gap Analysis GDP—Gross Domestic Product G-SIB – Global Systemically Important Banks H    HQLA – High quality liquid assets I    ICAAP—Internal capital adequacy assessment process L    LCR – Liquidity Coverage Ratio M    MtM— Mark to Market 20 Itaú Unibanco

Risk and Capital Management – Pillar 3 N    NSFR – Net Stable Funding Ratio P    PR—Patrimônio de Referência (Total Capital) R    RA – Leverage Ratio    RAS—Risk Appetite Statement    RSF – Required Stable Funding    RWA—Risk Weighted Assets    RWACPAD—Portion relating to exposures to credit risk    RWAMINT—Portion relating to exposures to market risk, using internal approach    RWAMPAD — Portion relating to exposures to market risk, calculated using standard approach    RWAOPAD—Portion relating to the calculation of operational risk capital requirements S    SA-CCR – Standardised Approach to Counterparty Credit Risk    SFN – Sistema Financeiro Nacional (National Financial System) T    TVM—Títulos de valores mobiliários (Securities) V    VaR—Value at Risk    21 Itaú Unibanco    

Risk and Capital Management – Pillar 3 Glossary of Regulations    BACEN Circular No. 3,354, of June 27th, 2007    BACEN Circular No. 3,646, of March 04th, 2013    BACEN Circular No. 3,674, of October 31st, 2013    BACEN Circular No. 3,748, of February 26th, 2015    BACEN Circular No. 3,749, of March 05th, 2015    BACEN Circular No. 3,846, of September 13rd, 2017    BACEN Circular No. 3,869, of December 19th, 2017    BACEN Circular No. 3,930, of February 14th, 2019    BACEN Circular Letter No. 3,706 of May 05th, 2015    BACEN Circular Letter No. 3,907 of September 10th, 2018    BACEN 35.259, of March 03rd, 2020    CMN Resolution No. 4,193, of March 1st, 2013    CMN Resolution No. 4,502, of June 30th, 2016    CMN Resolution No. 4,557, of February 23rd, 2017    22 Itaú Unibanco