Exhibit 99.1

Itau Risk and capital management Pillar 3 First quarter of 2022

Contents Objective 1 Key indicators 1 Prudential Metrics and Risk Management 2 KM1: Key metrics at consolidated level 2 OVA: Bank risk management approach 3 Scope and main characteristics of risk management 3 Risk and Capital Governance 4 Risk Appetite 5 Risk Culture 5 Stress Testing 6 Recovery Plan 7 Capital Adequacy Assessment 8 Capital Adequacy 8 OV1: Overview of risk-weighted assets (RWA) 9 Links between financial statements and regulatory exposures 10 LIA: Explanations of differences between accounting and regulatory exposure amounts 10 LI1: Differences between accounting and regulatory scopes of consolidation and mapping of financial statement categories with regulatory risk categories LI2: Main sources of differences between regulatory exposure amounts and carrying values in financial statements PV1: Prudent valuation adjustments (PVA) 12 Institutions that comprise the Financial Statement of Itau Unibanco Holding 13 Non Consolidated Institutions 17 Material Entities 17 Composition of Capital 18 CCA: Main features of regulatory capital instuments 18 CC1: Composition of regulatory capital 19 CC2: Reconciliation of regulatory capital to balance sheet 21 Macroprudential Indicators 22 CCyB1: Geographical distribution of credit risk exposures considered in the calculation of the Countercyclical Capital Buffer GSIB1: Disclosure of G-SIB indicators 22 Leverage Ratio 22 LR1: Summary comparison of accounting assets vs leverage ratio exposure measure (RA) 23 LR2: Leverage ratio common disclosure 23 Liquidity Ratios 24 LIQA: Liquidity Risk Management Information 24 Framework and Treatment 24 LIQ1: Liquidity Coverage Ratio (LCR) 25 LIQ2: Net Stable Funding Ratio (NSFR) 26 Credit Risk 27 CRA: Qualitative information on credit risk management 27 CR1: Credit Quality of Assets 28 CR2: Changes in Stock of defaulted loans and debts securities 29 CRB: Additional disclosure related to the credit quality of assets Credit risk mitigation 29 Exposure by industry 30 Exposure by remaining maturity 30 Overdue exposures 31 Exposure by geographical area in Brazil and by country 31 Largest debtors exposures 32 Restructured exposures 32 Corporativo | Interno

CRC: Qualitative disclosure related to Credit Risk Mitigation techniques 32 CR3: Credit Risk mitigation techniques—overview 33 CR4: Standardized Approach—Credit Risk exposure and credit risk mitigation effects 34 CR5: Standardized Approach—exposures by asset classes and risk weights 34 Counterparty Credit Risk (CCR) 34 CCRA: Qualitative disclosure related to CCR 34 CCR1: Analysis of CCR exposures by approach 35 CCR3: Standardized approach—CCR exposures by regulatory portfolio and risk weights 35 CCR5: Composition of collateral for CCR exposures 36 CCR6: CCR associated with credit derivatives exposures 36 CCR8: CCR associated with Exposures to central counterparties 37 Securitization Exposures 37 SECA: Qualitative disclosure requirements related to securitisation exposures 37 SEC1: Securitisation exposures in the banking book 38 SEC2: Securitisation exposures in the trading book 38 SEC3: Securitisation exposures in the banking book and associated regulatory capital requirements—38 bank acting as originator or as sponsor SEC4: Securitisation exposures in the banking book and associated capital requirements—bank acting as investor 38 Market Risk 39 MRA: Qualitative disclosure requirements related to market risk 39 MR1: Market risk under standa rdized approach 41 MRB: Qualitative disclosures on market risk in the Internal Models Approach (IMA) 41 MR2: RWA flow statements of market risk exposures under an IMA 44 Exposures subject to market risk 44 MR3: IMA values for trading portfolios 44 MR4: Comparison of VaR estimates with gains/losses 45 Backtesting 45 Total Exposure associated with Derivatives 46 IRRBB 46 IRRBBA: IRRBB risk management objectives and policies 46 Framework and Treatment 47 Other Risks 49 Insurance products, pension plans and premium bonds risks 49 Social and Environmental Risk and Climate Risk 50 Model Risk 51 Regulatory or Compliance Risk 51 Reputational Risk 51 Country Risk 53 Business and Strategy Risk 53 Contagion Risk 53 Emergent Risks 53 Operational Risk 54 Crisis Management and Business Continuity 55 Independent Validation of Risk Models 56 Glossa ry of Acronyms 57 Glossa ry of Regulations 62 Corporativo | Interno

Risk and Capital Management—Pillar 3 Objective This document presents Itau Unibanco Holding S.A. (Itau Unibanco) information required by the Central Bank of Brazil (BACEN) through Resolution BCB n° 54 and subsequent amendments, which addresses the disclosure of information on risks and capital management, the comparison between accounting and prudential information, the liquidity and market risk indicators, the calculation of risk-weighted assets (RWA), the calculation of the Total Capital (“Patrimonio de Referenda”—PR), and the compensation of management members. 1 The referred Resolution brought several amendments in the disclosure format of the Pillar 3 information, besides changes in the scope and frequency of the information disclosed. All these amendments, implemented by the Central Bank, aim the convergence of the Brazilian financial regulation to the recommendations of the Basel Committee, seeking to harmonize the information disclosed by financial institutions at an international level, and taking into account the structural conditions of the Brazilian economy. The disclosure policy of the Risk and Capital Management Report presents the guidelines and responsibilities of the areas involved in its preparation, as well as the description of the information that must be disclosed and the integrity endorsement and approval governance, as established by the article 56 of the Resolution n°. 4,557. Key indicators Itau Unibanco’s risk and capital management focuses on maintaining the institution in line with the risk strategy approved by the Board of Directors. The key indicators based on the Prudential Consolidation, on March 31, 2022, are summarized below. 11.1% 12.5% 13.9% December 31, 2021 11.3% December 31, 2021 13.0% December 31, 2021 14.7% In R$ million In RS million In RS million R$ 129,053 R$ 145,402 R$ 162,203 December 31, 2021 R$ 130,715 December 31, 2021 R$ 149,912 December 31, 2021 R$ 169,797 In RS million R$ 1,164,324 December 31, 2021 R$ 1,153,841 13,0% -0,5% 0,2% -0,3% 12,5% 11,3% 11,1% Tier I Net Income in the quarter Risk-Weighted Assets1 Acquisition of Itau Additional Tier I Capital Tier I Dec-21 and Interest on Own Capital Corpbanca Colombia, (AT1)-exchange variation Mar-22 Voluntary Severance Program and others Common Equity Tier I (CET I) Additional Tier I (AT1) (1) Excluding the exchange rate variation for the period. 1 Compensation of management members data is reported annually. Itau Unibanco 1

Risk and Capital Management—Pillar 3 Prudential Metrics and Risk Management Itau Unibanco invests in robust and company-wide risk management processes to serve as a basis for its strategic decisions intended to ensure business sustainability. The key prudential metrics related to regulatory capital and information on the bank’s integrated risk management are presented below. KM1: Key metrics at consolidated level In order to ensure the soundness of Itau Unibanco and the availability of capital to support business growth, Itau Unibanco maintains capital levels above the minimum requirements, as demonstrated by the Common Equity Tier I, Additional Tier I Capital and Total CapitaI ratios. On March 31, 2022, the Total Capital (PR) reached R$ 162,203 million, R$ 145,402 million of Tier I and R$ 16,801 million of Tier II. R$ million 03/31/2022 12/31/2021 09/30/2021 06/30/2021 03/31/2021 Available capital (amounts) Common Equity Tier 1 (CET1) 129,053 130,716 123,547 124,964 121,025 Tier 1 145,402 149,912 141,409 141,674 139,552 Total capital 162,203 169,797 161,099 156,561 155,280 Excess of capital committed to ajusted permanent assets Total capital detached Risk-weighted assets (amounts) Total risk-weighted assets (RWA) 1,164,324 1,153,841 1,095,194 1,048,628 1,072,193 Risk-based capital ratios as a percentage of RWA Common Equity Tier 1 ratio (%) 11.1% 11.3% 11.3% 11.9% 11.3% Tier 1 ratio (%) 12.5% 13.0% 12.9% 13.5% 13.0% Total capital ratio (%) 13.9% 14.7% 14.7% 14.9% 14.5% Additional CET1 buffer requirements as a percentage of RWA Capital conservation buffer requirement (%) (1)(1) 2.0% 2.0% 1.625% 1.625% 1.25% Countercyclical buffer requirement (%) (2)® Bank G-SIB and/or D-SIB additional requirements (%) 1.0% 1.0% 1.0% 1.0% 1.0% Total of bank CET1 specific buffer requirements (%) (3)(3) 3.0% 3.0% 2.625% 2.625% 2.25% CET1 available after meeting the bank’s minimum capital requirements (%) 2.9% 3.5% 4.0% 4.2% 4.1% Basel III leverage ratio Total Basel III leverage ratio exposure measure 2,015,946 2,018,692 1,969,517 1,883,388 1,918,231 Basel III leverage ratio (%) 7.2% 7.4% 7.2% 7.5% 7.3% Liquidity Coverage Ratio Total high-quality liquid assets (HQLA) 293,573 307,280 315,791 324,440 356,222 Total net cash outflow 196,328 193,093 184,568 179,322 186,513 LCR (%) 149.5% 159.1% 171.1% 180.9% 191.0% Net Stable Funding Ratio Total available stable funding 1,021,581 1,016,989 978,802 949,811 990,197 Total required stable funding 852,481 839,830 811,430 774,165 792,199 NSFR (%) 119.8% 121.1% 120.6% 122.7% 125.0% For purposes of calculating the Conservation capital buffer, BACEN Resolution 4,958 establishes, for defined periods, percentages to be applied to the RWA value with a gradual increase until April/22, when it reaches 2.5%. The countercyclical capital buffer is fixed by the Financial Stability Committee (Comef) based on discussions about the pace of credit expansion (BACEN Communication No. 38,373/22), and currently is set to zero. Should the requirement increase, the new percentage takes effect twelve months after the announcement. The BACEN rules establish Capital Buffers, that corresponds to the sum of the Conservation, Contracyclical and Systemic requirements, as defined in CMN Resolution 4,958. Itau Unibanco 2

Risk and Capital Management—Pillar 3 The Basel Ratio reached 13.9% on March 31, 2022, a decrease of 80 basis points compared to December 31, 2021 driven by the extraordinary events (mainly acquisition of Itau Corpbanca Colombia and Voluntary Severance Program) and reduction in Tier I and Tier II debts. Besides, Itau Unibanco has a R$ 69,057 million capital excess in relation to its minimum required Total Capital. It corresponds to 5,9 pp above the minimum requirement (8%) and higher than the Capital Buffer requirement of 3.0% (R$ 34,930 million). Considering the Capital Buffers, the capital excess would be 2,9 pp. The fixed assets ratio shows the commitment percentage of adjusted Referential Equity with the adjusted permanent assets. Itau Unibanco falls within the maximum limit of 50% of adjusted PR, established by BACEN. On March 31, 2022, fixed assets ratio reached 17.3%, showing a surplus of R$ 53,056 million. OVA—Bank risk management approach Scope and main characteristics of risk management To undertake and manage risks is one of the activities of Itau Unibanco. For this reason, the institution must have clearly established risk management objectives. In this context, the risk appetite defines the nature and the level of risks acceptable for the institution, while the risk culture guides the attitudes required to manage them. Itau Unibanco invests in robust risk management processes, that are the basis for its strategic decisions to ensure business sustainability and maximize shareholder value creation. These processes are in line with the guidelines of the Board of Directors and Executives who, through corporate bodies, define the institution’s global objectives, which are then translated into targets and thresholds for the business units that manage risks. Control and capital management units, in turn, support Itau Unibanco’s management through the processes of analysis and monitoring of capital and risk. The principles that provide the risk management and the risk appetite foundations, as well as guidelines regarding the actions taken by Itau Unibanco’s employees in their daily routines are as follows: Sustainability and customer satisfaction: the vision of Itau Unibanco is to be a leading bank in sustainable performance and customer satisfaction. For this reason, the institution is concerned about creating shared values for employees, customers, shareholders and society to ensure the longevity of the business. Itau Unibanco is concerned about doing business that is good for customers and for the institution; Risk culture: the institution’s risk culture goes beyond policies, procedures and processes. It strengths the individual and collective responsibility of all employees to manage and mitigate risks consciously, respecting the ethic way of doing business. The risk culture is described in the item “Risk Culture”; Risk Pricing: Itau Unibanco operates and assumes risks in business that it knows and understands, avoids the ones that are unknown or that do not provide competitive advantages, and carefully assesses risk-return ratios; Diversification: the institution has low appetite for volatility in its results. Accordingly, it operates with a diversified base of customers, products and business, seeking risk diversification and giving priority to low-risk transactions; Operational excellence: Itau Unibanco intends to provide agility, as well as a robust and stable infrastructure, in order to offer high quality services; Itau Unibanco 3

Risk and Capital Management—Pillar 3 Ethics and respect for regulations: at Itau Unibanco, ethics is non-negotiable. For this reason, the institution promotes an institutional environment of integrity, educating its employees to cultivate ethical relationships and businesses, as well as respecting the norms, and therefore looking after the institution’s reputation. Since August, 2017, the Resolution CMN 4,557 came into force, which established the structure of risk and capital management. The resolution highlights are the implementation of a continuous and integrated risk management framework; the requirements for the definition of the Risk Appetite Statement (RAS) and the stress test program; the establishment of a Risk Committee; the indication, before BACEN, of the Chief Risk Officer (CRO); and the CRO’s roles, responsibilities and independence requirements. Risk and Capital Governance The Board of Directors is the main body responsible for establishing the guidelines, policies and authority levels regarding risk and capital management. In turn, the Risk and Capital Management Committee (CGRC) provides support to the Board of Directors in the performance of their duties relating to risk and capital management. At the executive level, corporate bodies headed by Itau Unibanco’s Chief Executive Officer (CEO) are established to manage risks and capital. Their decisions are overseen by the CGRC. Additionally, the Itau Unibanco Holding has corporate bodies that perform delegated duties in the risk and capital management, under the responsibility of CRO (Chief Risk Officer). To support this structure, the Risk Area is structured with specialized departments. The objective is to provide independent and centralized management of the institution’s risks and capital, and to ensure the accordance with the established rules and procedures. Itau Unibanco’s risk management organizational structure complies with Brazilian and international regulations in place and is aligned with the market’s best practices, including governance for identifying emerging risks, which are those with medium and long-term impact potentially material about the business. Responsibilities for risk management at Itau Unibanco are structured according to the concept of three lines of defense, namely: in the first line of defense, the business and corporate support areas manage risks they give rise to, by identifying, assessing, controlling and reporting such risks; in the second line of defense, an independent unit provides central control, so as to ensure that Itau Unibanco’s risk is managed according to the risk appetite and established policies and procedures. This centralized control provides the Board and executives with a global overview of Itau Unibanco’s exposure, to ensure correct and timely corporate decisions; in the third line of defense, internal audit provides an independent assessment of the institution’s activities, so that senior management can see that controls are adequate, risk management is effective and institutional standards and regulatory requirements are being complied with. Itau Unibanco uses robust automated systems for full compliance with capital regulations, as well as for measuring risks in accordance with the regulatory determinations and models in place. It also monitors adherence to the qualitative and quantitative regulators’ minimum capital and risk management requirements. Itau Unibanco 4

Risk and Capital Management—Pillar 3 Risk Appetite Itau Unibanco has a risk appetite policy, which was established and approved by the Board of Directors and guides the institution’s business strategy. The bank’s risk appetite is grounded on the following declaration of the Board of Directors: “We are a universal bank, operating predominantly in Latin America. Supported by our risk culture, we operate based on rigorous ethical and regulatory compliance standards, seeking high and growing results, with low volatility, by means of the long-lasting relationship with clients, correctly pricing risks, well-distributed fund-raising and proper use of capital.” Based on this declaration, the bank established five dimensions, each of which comprising a set of metrics associated with the key risks involved, combining complementary measurements and seeking a comprehensive view of its exposure: Capitalization: establishes that Itau Unibanco should have sufficient capital to protect itself against a serious recession or stress events without the need to adjust its capital structure under adverse circumstances. It is monitored by following up the bank’s capital ratios, in usual or stress situations, and the institution’s debt issue ratings. Liquidity: establishes that the institution’s liquidity should be able to support long stress periods. It is monitored by following up on liquidity ratios. Composition of results: establishes that business will mainly focus on Latin America, where Itau Unibanco will have a diversified range of customers and products, with low appetite for results volatility and high risk. This dimension includes business and profitability, as well as market and credit risks aspects. The metrics monitored by the bank seek to ensure, by means of exposure concentration limits such as, for example, industry sectors, quality of counterparties, countries and geographic regions and risk factors, a suitable composition of the bank’s portfolios, aiming at low volatility of results and business sustainability. Operational risk: focuses on controlling operational risk events that may adversely impact the bank’s business strategy and operations. This control is carried out by monitoring key operational risk events and incurred losses. Reputation: deals with risks that may impact brand value and the institution’s reputation before its customers, employees, regulators, investors and the general public. In this dimension, risks are monitored by following up on customers’ satisfaction or dissatisfaction, media exposure and observation of the institution’s conduct. The Board of Directors is responsible for approving risk appetite guidelines and limits, performing its activities with the support of the Risk and Capital Management Committee (CGRC) and the Chief Risk Officer (CRO). Metrics are regularly monitored and must comply with the limits defined. The monitoring is reported to the risk commissions and to the Board of Directors, guiding the use of preventive measures to ensure that exposures are within the limits provided and in line with the bank’s strategy. Itau Unibanco 5

Risk and Capital Management—Pillar 3 Risk Culture Aiming at strengthening its values and aligning the behavior of its employees with risk management guidelines, the institution adopts several initiatives to disseminate and strengthen its Risk Culture, which is based on four principles: conscious risk taking, discussions and actions on the institution’s risks, and each and everyone’s responsibility for risk management. Chart 1—Risk Culture Itau Unibanco Besides the risk management policies, procedures and processes, the institution promotes its Risk Culture by emphasizing a behavior that helps people of all company levels to undertake and manage risks in a conscious way. By disseminating these principles, the institution fosters the understanding and the open discussion about risks, so that they are kept within the risk appetite levels established and each employee individually, regardless of their position, area or duties, may also assume responsibility for managing the risks of the business. Itau Unibanco also makes some channels available for communication of operating failures, internal or external fraud, conflicts at the workplace, or cases that may result in inconveniences and/or losses for the institution or its customers. All employees or third parties are responsible for informing any problems immediately, as soon as they become aware of the situation. Stress Testing The stress test is a process of simulating extreme economic and market conditions on Itau Unibanco’s results, liquidity and capital. The institution has been carrying out this test in order to assess its solvency in plausible scenarios of crisis, as well as to identify areas that are more susceptible to the impact of stress that may be the subject of risk mitigation. For the purposes of the test, the economic research area estimates macroeconomic variables for each stress scenario. The elaboration of stress scenarios considers the qualitative analysis of the Brazilian and the global conjuncture, historical and hypothetical elements, short and long term risks, among other aspects, as defined in CMN Resolution 4,557. Itau Unibanco 6

Risk and Capital Management—Pillar 3 In this process, the main potential risks to the economy are assessed based on the judgment of the bank’s team of economists, endorsed by the Chief Economist of Itau Unibanco and approved by the Board of Directors. Projections for the macroeconomic variables (such as GDP, the basic interest rate and inflation) and for variables in the credit market (such as raisings, lending, rates of default, margins and charges) used are based on exogenous shocks or through use of models validated by an independent area. Then, the stress scenarios adopted are used to influence the budgeted result and balance sheet. In addition to the scenario analysis methodology, sensitivity analysis and the Reverse Stress Test are also used. Itau Unibanco uses the simulations to manage its portfolio risks, considering Brazil (segregated into wholesale and retail) and External Units, from which the risk-weighted assets and the capital and liquidity ratios are derived. The stress test is also an integral part of the ICAAP (Internal Capital Adequacy Process), the main purpose of which is to assess whether, even in severely adverse situations, the institution would have adequate levels of capital and liquidity, without any impact on the development of its activities. This information enables potential offenders to the business to be identified and provides support for the strategic decisions of the Board of Directors, the budgeting and risk management process, as well as serving as an input for the institution’s risk appetite metrics. Recovery Plan In response to the latest international crises, the Central Bank issued the Resolution No. 4,502, which requires the development of a Recovery Plan for the financial institutions that are classified in the Segment 1, with a total exposure of more than 10% of Gross Domestic Product (GDP). This plan aims to reestablish adequate levels of capital and liquidity, above the regulatory requirements, through appropriate strategies in the event of severe stress shocks of a systemic or idiosyncratic nature. Accordingly, each institution would be able to preserve its financial feasibility and, at the same time, mitigate the impact on the National Financial System. Itau Unibanco has a Recovery Plan that contemplates the entire Conglomerate, including foreign subsidiaries, and contains the description of the following items: Critical functions rendered by Itau Unibanco to the market, activities that, if abruptly interrupted, could impact the National Financial System (SFN) and the functioning of the real economy; Institution’s essential services: activities, operations or services which discontinuity could compromise the bank’s viability; Monthly monitoring program, establishing critical levels for a set of indicators, with a view to risk monitoring and eventual trigger for the execution of the Recovery Plan; Stress scenarios, contemplating events that may threaten the business continuity and the viability of the institution, including reverse tests, which seek to identify remote risk scenarios, contributing to an increase of the management sensitivity; Recovery strategies in response to different stress scenarios, including the main risks and barriers, as well as the mitigators of the latter and the procedures for the operationalization of each strategy; Communication plan with stakeholders, seeking its timely execution with the market, regulators and other stakeholders; Governance mechanisms necessary for the coordination and execution of the Recovery Plan, such as the definition of the director responsible for the exercise at Itau Unibanco. Itau Unibanco 7

Risk and Capital Management—Pillar 3 This plan is reviewed annually and is subjected to the approval of the Board of Directors. With this practice, Itau Unibanco has been able to continuously demonstrate, that even in severe scenarios, with remote probability of occurrence, it has strategies capable of generating sufficient resources to ensure the sustainable maintenance of critical activities and essential services, without losses to customers, to the financial system and to other participants in the markets in which it operates. Itau Unibanco ensures the exercise maintenance to guarantee that strategies remain up-to-date and viable in the face of organizational, competitive or systemic changes. Capital Adequacy Assessment For its capital adequacy assessment process, the annual Itau Unibanco’s procedure is as follows: Identification of material risks and assessment of the need for additional capital; Preparation of the capital plan, both in normality and stress situations; Internal assessment of capital adequacy; Structuring of capital contingency and recovery plans; Preparation of management and regulatory reports. By adopting a prospective stance regarding capital management, Itau Unibanco implemented its capital management structure and its ICAAP in order to comply with National Monetary Council (CMN) Resolution 4,557, BACEN Circular 3,846 and BACEN Circular Letter 3,907. The result of the last ICAAP, which includes stress tests—dated as of December 2021—showed that, in addition to having enough capital to face all material risks, Itau Unibanco has a significant buffer, thus ensuring the soundness of its equity position. Capital Adequacy Itau Unibanco, through the ICAAP process, assesses the adequacy of its capital to face the incurred risks, composed by regulatory capital for credit, market and operational risks and by the necessary capital to face other risks. In order to ensure the soundness and the availability of Itau Unibanco’s capital to support business growth, the Total Capital levels were maintained above the minimum requirements. Itau Unibanco 8

Risk and Capital Management—Pillar 3 OV1—Overview of risk-weighted assets (RWA) According to CMN Resolution 4,958 and subsequent amendments, for assessing the minimum capital requirements, the RWA must be calculated by adding the following risk exposures: RWA = RWACPAD + RWAMINT + RWAOPAD RWACPAD = portion related to exposures to credit risk, calculated using standardized approach; RWAMINT = portion related to the market risk capital requirement, made up of the maximum between the internal model and 80% of the standardized model, and regulated by BACEN Circulars 3,646 and 3,674; RWAOPAD = portion related to the operational risk capital requirement, calculated using standardized approach. Minimum capital requirements RS million 03/31/2022 12/31/2021 03/31/2022 Credit Risk: standardised approach 1,045,152 1,044,344 83,612 Credit risk (excluding counterparty credit risk) 924,394 922,824 73,952 Counterparty credit risk (CCR) 44,278 42,898 3,542 Of which: standardised approach for counterparty credit risk (SA-CCR) 29,142 27,616 2,331 Of which: Current Exposure Method approach (CEM) ——Of which: other CCR 15,136 15,282 1,211 Credit valuation adjustment (CVA) 7,964 8,102 637 Equity investments in funds—look-through approach 4,931 5,001 394 Equity investments in funds—mandate-based approach 249 95 20 Equity investments in funds—fall-back approach 1,886 824 151 Securitisation exposures—standardised approach 2,892 2,195 231 Amounts below the thresholds for deduction 58,558 62,405 4,685 Market risk 25,773 22,985 2,062 Of which: standardised approach 32,216 28,731 2,577 Of which: internal models approach (IMA) 19,013 14,751 1,521 Operational risk 93,399 86,512 7,472 Total 1,164,324 1,153,841 93,146 The higher amount of RWA was mainly due to the increase in the operational risk (RWAOPAD). Itau Unibanco 9

Risk and Capital Management—Pillar 3 Links between financial statements and regulatory exposures LIA: Explanations of differences between accounting and regulatory exposure amounts The main difference between the accounting carrying value and the amounts considered for regulatory purposes is the non-consolidation of non-financial companies (especially Insurance, Pension Plan and Capitalization companies) in the regulatory consolidated, a difference that also impacts the elimination of related parties transactions. Within the regulatory scope, the procedures for assessing the need for prudent valuation adjustments (PVAs) arising from the pricing of financial instruments, as well as the description of the systems and controls used to ensure its reliability are described below. The pricing methodology for the financial instruments subject to Resolution No. 4,277, of October 31st, 2013, conducted by an independent area from the business areas, considers, in addition to benchmarks, the risks listed in the closeout uncertainty, market concentration, early termination, model risk, investing and funding costs, unearned credit spread and others. The fair value measurement at Itau Unibanco follows the principles enclosed in the main regulatory bodies, such as CVM and BACEN. The institution follows the best practices in terms of pricing policies, procedures and methodologies and is committed to secure the pricing of financial instruments in its balance sheet with prices quoted and disclosed by the market, and in the impossibility of doing so, expends its best efforts to estimate which would be the fair price at which financial assets would be effectively traded, maximizing the use of relevant observable data and, under specific conditions, these instruments can be valued on a model basis. In all of these situations, the organization has control over its pricing methods and model risk management. The process of independent price verification (IPV) follows the guidelines included in Resolution No. 4,277, with daily verification of prices and market inputs, which is performed by a team independent from the pricing team. This process is also subject to an independent evaluation by the internal control, internal audit and external audit teams. The institution has a hybrid model for assessing the need for prudent valuation adjustments with two components. The first component is a timely assessment model that assesses new products, operations and risk factors traded and verifies the compliance and liability with any components of the existing prudent valuation adjustments. The second is a periodic assessment that aims to analyze the existing prudent valuation adjustments in relation to adequate pricing. The process and methodology are evaluated periodically and independently by internal controls and internal audit. In the line Other Differences of the table LI2, are reported the transactions subject to credit risk and counterparty credit risk, which are not accounted for in the balance sheet or in the off-balance sheet amounts. Itau Unibanco 10

Risk and Capital Management—Pillar 3 LI1: Differences between accounting and regulatory scopes of consolidation and mapping of financial statement categories with regulatory risk categories RS million, at the end of the period 03/31/2022 Carrying values of items: Carrying values Carrying values Not subject to as reported in under scope of subject to subject to Subject to the subject to the capital published reaulatory risk counterparty market risk or financial regulatory credit risk credit risk securitisation market risk subject to , , consolidation framework framework framework statements framework framework framework framework deduction from capital Assets Current assets and Long-term receivables 2,155,198 1,923,839 1,551,057 324,938 11,939 220,189 31,200 Cash 42,722 42,629 42,629 — 9,646—Interbank investments 243,140 240,505 74,013 166,492—13,632—Securities and derivative financial instruments 726,362 503,356 413,793 71,889 11,939 44,152 1,030 Interbank accounts 159,887 159,887 145,931 ——13,956 Interbranch accounts 247 247 — — 247 Loan, lease and other credit operations 771,073 771,972 764,179 — 56,839 7,793 Other receivables 207,982 201,615 106,884 86,557—95,920 8,174 Deferred tax assets—56,412 48,303 ——8,109 Sundry—145,203 58,581 86,557—95,920 65 Other assets 3,785 3,628 3,628 — — Permanent assets 28,112 45,952 27,879 ——18,074 Investments 5,422 24,341 21,979 ——2,362 Real estate 6,315 5,811 5,811 ... . Goodwill and Intangible assets 16,375 15,800 89 ——15,712 Goodwill—2,268 .... 2,269 Intangible assets—13,443 . 13,443 Other—89 89 ——Total assets 2,183,310 1,969,791 1,578,936 324,938 11,939 220,189 49,274 Liabilities Current and Long-term Liabilities 2,029,408 1,815,003—305,711—229,679 1,509,292 Deposits 807,043 818,014 ——51,081 818,014 Deposits received under securities repurchase 278,295 273,295 265 ,616 . 12 12,679 agreements . , , , Funds from acceptances and issuance of securities 172,058 172,058 ——19,293 172,058 Interbank accounts 71,866 71,866 — — 71,866 Interbranch accounts 12,242 12,246 ——141 12,246 Borrowings and onlending 107,890 107,890 ——16,780 107,890 Derivative financial instruments 64,663 64,664—40,095—2,924 24,569 Technical provision for insurance, pension plan and 308 capitalization ‘ Provisions 16,948 16,574 .... 16,574 Allowance for financial guarantees provided and loan commitments Other liabilities 271,643 267,944 ——139,448 267,944 Deferred tax liabilities—3,052 .... 3,052 Sundry—264,892 ——139,448 264,892 Total liabilities 2,029,408 1,815,003—305,711—229,679 1,509,292 Itau Unibanco 11

Risk and Capital Management—Pillar 3 LI2: Main sources of differences between regulatory exposure amounts and carrying values in financial statements R$ million 03/31/2022 Carrying values of items: Total Subject to Subject to subject to the Subject to the Total counterparty credit risk securitisation market risk credit risk framework , framework framework framework Asset carrying value amount under scope of regulatory consolidation 1,920,517 1,578,936 324,938 11,939 220,189 Liabilities carrying value amount under regulatory scope of consolidation 305,711—305,711—229,679 Total net amount under regulatory scope of consolidation 1,614,806 1,578,936 19,227 11,939 (9,490) Off-balance sheet amounts 167,222 145,843 21,379 — Differences in valuations — ——Other differences 124,348 (10,000) 134,348 — Exposure amounts considered for regulatory purposes 1,906,376 1,714,779 174,954 11,939 (9,490) PV1: Prudent valuation adjustments (PVA) In R$ million 03/31/2022 Of which: In Of which: In Equity Interest FX Credit Commodities Total the trading the banking book book Closeout uncertainty, of which: ——21—21 2 19 Closeout cost ——20—20 2 18 Concentration ——1—1—1 Early termination—53—55—108 2 106 Model risk—44—54—98 5 93 Operational risk .... . . . . Investing and funding costs .... . . . . Unearned credit spreads . . . . . . . . Future administrative costs .... . . . . Other — — — — Total adjustment — 97 â– 130—227 9 218 Itau Unibanco 12

Risk and Capital Management—Pillar 3 Institutions that comprise the Financial Statements of Itau Unibanco Holding The lists below provide the institutions that comprise the financial statements and the Prudential Consolidation of Itau Unibanco Holding S.A.. Institutions that comprise the financial statements and the Prudential Consolidation (1) Country*2* % Equity share on capital A1 Hedge Orange Master Fundo de Investimento Multimercado Brazil 100.00% Aj Titulos Publicos Fundo de Investimento Renda Fixa Referenciado DI Brazil 100.00% Banco Investcred Unibanco S.A. Brazil 50.00% Banco Itau (Suisse) S.A. Switzerland 100.00% Banco Itau Argentina S.A. Argentina 100.00% Banco Itau BBA S.A. Brazil 100 00% Banco Itau Consignado S.A. Brazil 100 00% Banco Itau International United States 100.00% Banco Itau Paraguay S.A. Paraguay 100.00% Banco Itau Uruguay S/A Uruguay 100.00% Banco Itau Veiculos S.A. Brazil 100.00% Banco Itau Bank S.A. Brazil 100.00% Banco Itaucard S.A. Brazil 100.00% Cloudwalk Kick Ass I Fundo De Investimento Em Direitos Creditdrios Brazil 94.96% Dibens Leasing S.A.—Arrendamento Mercantil Brazil 100 00% FIDC B2cycle NPL Brazil 100.00% FIDC Cloudw Akira I Brazil 97.03% Fll Kinea Desenv. LO Brazil 100.00% Financeira Itau CBD S.A. Credito, Financiamento e Investimento Brazil 50.00% Fundo A1 Hedge Orange Fundo de Investimento em Cotas de Fundos de Investimento Multimercado Brazil 100.00% Fundo De Invest Dir Creditorios Nao Padron NPL II Brazil 100.00% Fundo de Investimento em Direitos Creditorios Nao-Padronizados Barzel Brazil 100 00% Fundo de Investimento em Direitos Creditdrios Rede Brazil 100 00% Fundo em Direitos Creditdrios Cielo Emissores I Brazil 90.28% Fundo Fortaleza de Investimento lmobiliario Brazil 100.00% Fundo Goal Perfo III Argentina 100.00% Fundo Kinea Acoes Brazil 100.00% Hipercard Banco Multiplo S.A. Brazil 100.00% Intrag Distribuidora de Titulos e Valores Mobiliarios Ltda. Brazil 100.00% Iresolve Companhia Securitizadora de Creditos Financeiros S.A. Brazil 100.00% Itau (Panama) S.A. Panama 55.66% Itau Administradora de Consorcios Ltda. Brazil 100 00% Itau Asset Management Colombia S.A. Sociedad Fiduciaria Colombia 55.65% Itau Bank & Trust Bahamas Ltd. Bahamas 100.00% Itau Bank & Trust Cayman Ltd. Cayman Islands 100.00% Itau Bank, Ltd. Cayman Islands 100.00% Itau BBA Europe S.A. Portugal 100.00% Itau BBA International Pic. United Kingdom 100.00% Itau BBA Trading Agro S.A. Brazil 100.00% Itau BBA USA Securities Inc. United States 100 00% Itau Cia. Securitizadora de Creditos Financeiros Brazil 100 00% Itau Comisionista de Bolsa Colombia S.A. Colombia 55.66% Itau CorpBanca Chile 55.96% Itau CorpBanca Colombia S.A. Colombia 55.66% As of December 2019, the funds Crddito University rio FIDC I and Crddito University rio FIDC II were consolidated in the Itau Unibanco Holding S.A Prudential Conglomerate. The institutions operate in their respective countries of origin, Itau Unibanco 13

Risk and Capital Management—Pillar 3 Institutions that comprise the financial statements and the Prudential Consolidation|1} Country(2) % Equity share on capital Itau CorpBanca New York Branch United States 55.96% Itau Corredores de Bolsa Limitada Chile 55.96% Itau Corretora de Valores S.A. Brazil 100.00% Itau Distribuidora de Titulos e Valores Mobiliarios S.A. Brazil 100.00% Itau EU Lux-ltau Latin America Equity Fund Luxembourg 70.05% Itau International Securities Inc. United States 100.00% Itau Invest Casa de Bolsa S.A. Paraguay 100.00% Itau Kinea Private Equity Multimercado Fundo de Investimento em Cotas de Fundos de Investimento Credito Privado Brazil 100.00% Itau OT Titulos Publicos Renda Fixa Referenciado DI Fundo de Investimento em Cotas de Fundos de Investimento Brazil 0.04% Itau Securities Services Colombia S.A. Sociedad Fiduciaria Colombia 55.67% Itau Unibanco Holding S.A. Brazil 100.00% Itau Unibanco Holding S.A, Grand Cayman Branch Cayman Islands 100.00% Itau Unibanco S.A. Brazil 100.00% Itau Unibanco S.A., Grand Cayman Branch Cayman Islands 100.00% Itau Unibanco S.A., Miami Branch United States 100.00% Itau Unibanco S.A., Nassau Branch Bahamas 100.00% Itau Unibanco Veiculos Administradora de Consorcios Ltda. Brazil 100.00% Itau Valores S.A. Argentina 100.00% ITB Holding Ltd. Cayman Islands 100.00% Kinea Acoes Fundo de Investimento em Acoes Brazil 100.00% Kinea CO-investimento Fundo de Investimento Imobiliario Brazil 99.90% Kinea I Private Equity FIP Multiestrategia Brazil 99.64% Kinea KP Fundo de Investimento Multimercado Credito Privado Brazil 100.00% Kinea Ventures FIP Brazil 100.00% Licania Fund Limited Cayman Islands 100.00% Luizacred S.A. Sociedade de Credito, Financiamento e Investimento Brazil 50.00% MCC S.A. Corredores de Bolsa Chile 100.00% Microinvest S.A. Soc. de Credito a Microempreendedor Brazil 100.00% OCA Dinero Electronico S.A. Uruguay 100.00% OCA S.A. Uruguay 100.00% Oiti Fundo de Investimento Multimercado Credito Privado Investimento no Exterior Brazil 100.00% Redecard Instituigao de Pagamento S.A. Brazil 100.00% RT Itau DJ Titulos Publicos Fundo de Investimento Renda Fixa Referenciado DI Brazil 100.00% RT Scala Renda Fixa—Fundo de Investimento em Cotas de Fundos de Investimento Brazil 100.00% RT Voyager Renda Fixa Credito Privado—Fundo de Investimento Brazil 100.00% Tarume Fundo Incentivado de Investimento em Debentures de Infraestrutura Renda Fixa Credito Privado Brazil 100.00% As of December 2019, the funds Credito Unversitario FIDC I and Credito Universitano FIDC II were consolidated in the Itau Unibanco Holding S.A Prudential Conglomerate. The institutions operate in their respective countries of origin. Itau Unibanco 14

Risk and Capital Management—Pillar 3 Institutions that comprise the Financial Statements of Itau Unibanco Holding Institutions that comprise only the Financial Statements Country(1) % Equity share on capital Aj II Titulos Publicos Fundo de Investimento Renda Fixa Referenciado DI Brazil 57.96% Albarus S.A. Paraguay 100.00% Ank Platform S.A. Argentina 100.00% BICSA Holdings, Ltd. Cayman Islands 100.00% Borsen Renda Fixa Credito Privado—Fundo de Investimento Brazil 100.00% CGB II SPA Chile 100.00% CGB III SPA Chile 100.00% Cia. Itau de Capitalizagao Brazil 100.00% Estrel Servicos Administrativos S.A. Brazil 100.00% FC Recovery S.A.U. Argentina 100.00% FIC Promotora de Vendas Ltda. Brazil 50.00% iCarros Ltda. Brazil 100.00% IGA Participacoes S.A. Brazil 100.00% Investimentos Bemge S.A. Brazil 86.81% Itau Administradora General de Fondos S.A. Chile 55.96% Itau Asesorias Financieras Limitada Chile 55.96% Itau Asia Limited Hong Kong 100.00% Itau Asset Management Administradora de Fondos Patrimoniales de Inversion S.A. Paraguay 100.00% Itau Asset Management S.A. Sociedad Gerente de Fondos Comunes de Inversion Argentina 100.00% Itau Bahamas Directors Ltd. Bahamas 100.00% Itau Bahamas Nominees Ltd. Bahamas 100.00% Itau BBA International (Cayman) Ltd. Cayman Islands 100.00% Itau BBA Mexico, S.A. de C.V.(2) Uruguay 100.00% Itau Chile Inversiones, Servicios y Administracion S.A. Chile 100.00% Itau Consultoria de Valores Mobiliarios e Participagoes S.A. Brazil 100.00% Itau Corredor de Seguros Colombia S.A. Colombia 55.95% Itau Corredores de Seguras S.A. Chile 55.96% Itau Corretora de Seguros S.A. Brazil 100.00% Itau Europa Luxembourg S.A. Luxembourg 100.00% Beta Correspondente e Tecnologia Ltda. Brazil 100.00% Itau Holding Colombia S.A.S. Colombia 55.96% Itau Institucional Renda Fixa Fundo de Investimento Brazil 100.00% Itau International Holding Limited United Kingdom 100.00% Itau Rent Administracao e Participagoes Ltda. Brazil 100.00% Itau Seguros Paraguay S.A. Paraguay 100.00% Itau Seguros S.A. Brazil 100.00% Itau Unibanco Asset Management Ltda. Brazil 100.00% Itau Unibanco Comeroializadora de Energia Ltda. Brazil 100.00% Itau USA Asset Management Inc. United States 100.00% Itau Vida e Previdencia S.A. Brazil 100.00% Itauseg Participagoes S.A. Brazil 100.00% Itauseg Saude S.A. Brazil 100.00% ITB Holding Brasil Participagoes Ltda. Brazil 100.00% IU Corretora de Seguras Ltda. Brazil 100.00% IUPP S.A. Brazil 100.00% Karen International Limited Bahamas 100.00% The institutions operate in their respective countries of origin. The company is transferring its location from Mexico to Uruguay. Awaiting local approvals. Itau Unibanco 15

Risk and Capital Management—Pillar 3 Institutions that comprise only the Financial Statements Country(1) % Equity share on capital Kinea Investimentos Ltda. Brazil 80.00% Maxipago Servicos de Internet Ltda. Brazil 100.00% MCC Asesorias SpA Chile 100.00% Mundostar S.A. Uruguay 100.00% Proserv—Promociones y Servicios, S.A. de C.V. Mexico 100.00% Provar Negocios de Varejo Ltda. Brazil 100.00% Recaudaciones y Cobranzas Limitada Chile 55.96% Recovery do Brasil Consultoria S.A. Brazil 100.00% RJ Niteroi Icarai Ltda. Brazil 100.00% RT Alm 5 Fundo de Investimento Renda Fixa Brazil 100.00% RT Alm Soberano 2 Fundo de Investimento Renda Fixa Brazil 100.00% RT Defiant Multimercado—Fundo de Investimento Brazil 100.00% RT Endeavour Renda Fixa Credito Privado—Fundo de Investimento Brazil 100.00% RT Multigestor 4 Fundo de Investimento em Cotas de Fundos de Investimento Multimercado Brazil 100.00% RT Nation Renda Fixa—Fundo de Investimento Brazil 100.00% RT Valiant Renda Fixa—Fundo de Investimento Brazil 100.00% SAGA II SPA Chile 100.00% SAGA III SPA Chile 100.00% SP Amadeu Amaral Ltda. Brazil 100.00% SP Antonio de Queiroz Ltda Brazil 100.00% SP Augusta Ltda Brazil 100.00% SP Av Juscelino Kubitschek Ltda Brazil 100.00% SP Av Luis Carlos Berrini Ltda Brazil 100.00% SP Av Morumbi Ltda Brazil 100.00% SP Av. Santa Catarina Ltda. Brazil 100.00% SP Bairro Moema Ltda. Brazil 100.00% SP Bairro Sumarezinho Ltda Brazil 100.00% SP Bairro Vila Guilherme Ltda. Brazil 100.00% SP Brooklin Rua Santo Amaro Ltda Brazil 100.00% SP Brooklin St. Amaro Ltda. Brazil 100.00% SP Butanta Ltda Brazil 100.00% SP CEAGESP Ltda Brazil 100.00% SP Vila Clementino LTDA Brazil 100.00% SP Clelia Ltda Brazil 100.00% SP Interlagos Ltda Brazil 100.00% SP Itaberaba Ltda Brazil 100.00% SP Itaim Paulista Ltda. Brazil 100.00% SP Maracatins Ltda Brazil 100.00% SP Nova JK Ltda Brazil 100.00% SP Rua Da Consolacao Ltda Brazil 100.00% SP Santos Embare Ltda. Brazil 100.00% SP Santos Jose Menino Ltda. Brazil 100.00% SP Serra De Braganca Ltda Brazil 100.00% SP Tatuape Ltda Brazil 100.00% SP Vila Guilherme Ltda Brazil 100.00% SP Vila Olimpia Araguari Ltda. Brazil 100.00% Tulipa S.A. Brazil 100.00% Union Capital AFAP S.A. Uruguay 100.00% Zup I.T. Solucoes em Informatica LTDA. Brazil 52.96% 1) The institutions operate in their respective countries of origin. Itau Unibanco 16

Risk and Capital Management—Pillar 3 The institutions presented in the tables above represent the total scope of companies of Itau Unibanco Holding. Non Consolidated Institutions Non consolidated Institutions Country(1) % Equity share on capital BSF Holding S.A Brazil 49.00% CIP S.A Brazil 23.33% Compania Uruguaya de Medios de Procesamiento S.A. Uruguay 29.24% ConectcarSolugdesde Mobilidade Eletronica S.A. Brazil 50.00% Gestora de Inteligencia de Credito S.A Brazil 19.64% Kinea Private Equity Investimentos S.A. Brazil 80.00% Olimpia Promopao e Servicos S.A. Brazil 50.00% Porto Segura Itau Unibanco Participacoes S.A. Brazil 42.93% Pravaler S.A. Brazil 52.62% Rias Redbanc S.A. Uruguay 25.00% Tecnologia Bancaria S.A. Brazil 28.05% 1) The institutions operate in their respective countries of origin. Material entities Total assets, stockholders’ equity, country and the activities of the material entities, including those subject to the risk weight for the purpose of capital requirements are as follows: R$ million 03/31/2022 12/31/2021 Institutions Country Activity Total Assets Equity Total Assets Equity Cia. Itau de Capitalizato Brazil Premium bonds 3,850 478 3,841 406 Itau Consultoria de Valores Mobilterios e Participacoes S.A. Brazil Financial institution holding company 1,157 1,102 1,138 1,080 Itau Corretora de Seguras S.A. Brazil Insurance, pension plans and health brokers 1,312 423 1,686 796 Itau Seguros S.A. Brazil Insurance 6,554 1,751 6,636 1,529 Itau Vida e Previdencia S.A. Brazil Pension plan 218,178 3,676 214,736 3,622 Itauseg Participacoes S.A. Brazil Non financial institution holding company 11,072 10,569 1 0,781 10,116 ITB Holding Brasil Participacoes Ltda. Brazil Financial institution holding company 24,821 24,326 29,231 28,557 Provar Negdcios de Varejo Ltda. Brazil Other auxiliary activities for financial services 2,412 2,357 2,380 2,325 Itau Unibanco 17

Risk and Capital Management—Pillar 3 Composition of Capital CCA: Main features of regulatory capital instruments The authorized regulatory capital instruments may be extinguished according to the criteria established in Resolution n° 4,955 in articles 17, item XV, or 20, item X, such as non-compliance with the minimum regulatory ratios, decree of temporary special administration regime or intervention, application of public resources or upon the Central Bank of Brazil determination. Should any criteria for the extinction of subordinated instruments be triggered, the area responsible for Itau Unibanco’s Capital management will activate the areas involved to execute the following action plan: The treasury, through the payment agent of the subordinated instruments or straight through the central depository, will notify its holders and take actions to ensure that Itau Unibanco’s trading desks cease to trade such instruments; The operational and accounting areas will carry out the necessary procedures for the proper treatment of the extinction; and The Investor Relations area will communicate the market of the extinction of the subordinated instruments. The table CCA—Main features of regulatory capital instruments, is available at www.itau.com.br/investor-relations, section “Results and Reports”, “Regulatory Reports”, “Pillar 3”. Itau Unibanco 18

Risk and Capital Management—Pillar 3 CC1—Composition of regulatory capital 03/31/2022 Balance Sheet Value (R$ Thousand) Reference Common Equity Tier I: instruments and reserves Instruments Eligible for the Common Equity Tier I 90,729,000 (k) Revenue reserves 60,801,341 (I) Other revenue and other reserve (7,047,020) (m) Common share capital issued by subsidiaries and held by third parties (amount allowed in group CET1 capital) 7,956,527 (j) Common Equity Tier I before regulatory adjustments 152,439,848 Common Equity Tier I: prudential adjustments Prudential adjustments related to the pricing of financial instruments 226,623 Goodwill (net of related tax liability) 2,981,845 (e) Intangible assets 13,442,833 (h) I (i) Tax credits arising from income tax losses and social contribution tax loss carryfowards and those originating from this contribution 3,160,661 (b) related to determination periods ended until December 31, 1998 ’ ’ 11 Adjustments related to the market value of derivative financial instruments used to hedge the cash flows of protected items whose mark- 167 to-market adjustments are not recorded in the books. ’ Actuarial assets related to defined benefit pension funds 39,983 (d) Shares or other instruments issued by the bank authorized to compose the Core Capital, acquired directly, indirectly or synthetically 79,212 (n) Reciprocal cross-holdings in common equity—Total value of adjustments related to net non-significant investments in the Common Equity Tier I of companies that are similar to non- consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and sponsored pension fund—entities Total value of adjustments related to net significant investments in the Common Equity Tier I of companies that are similar to non- consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and sponsored pension fund—entities, that exceeds 10% of the amount of the Common Equity Tier I, disregarding specific adjustments 1 Total value of adjustments related to tax credits arising from temporary differences that depend on the generation of income or future taxable income for their realization, above the limit of 10% of the Common Equity Tier I, disregarding specific deductions Amount that exceeds 15% of the Common Equity Tier I 3,622,679 Of which: arising from net investments in the Common Equity Tier I of companies that are similar to non-consolidated financial 1,651,751 institutions, insurance companies, reinsurance companies, capitalization companies and open ended pension entities ’ ’ Of which: arising from tax credits resulting from temporary differences that depend on the generation of income or future taxable income 1,970,928 25 for their realization National specific regulatory adjustments—26.a Deferred permanent assets—(g) .b Investment in dependence, financial institution abroad or non-financial entity that is part of the conglomerate, with respect to which the Central Bank of Brazil does not have access to information, data and documents 26.d Increase of unauthorized capital—26.e Excess of the amount adjusted of Common Equity Tier I—26.f Deposit to cover capital deficiency—26.g Amount of intangible assets established before Resolution No. 4,192 of 2013 comes into effect—(i) 26.h Excess of resources invested on permanent assets—26.i Total capital detached—26.j Other residual differences concerning the Common Equity Tier I calculation methodology for regulatory purposes—Other residual differences related to the calculation of the Common Equity Tier I for regulatory purposes—Total regulatory deductions from the Common Equity Tier I 23,386,605 Common Equity Tier I 129,053,243 Additional Tier I Capital: instruments Instruments eligible for the Additional Tier I Capital 15,926,131 Of which: classified as equity under applicable accounting standards—Of which: classified as liabilities under applicable accounting standards 15,926,131 Instruments authorized to compose the Additional Tier I Capital before Resolution No. 4,192 of 2013 comes into effect—Additional Tier 1 instruments issued by subsidiaries and held by third parties (amount allowed in group additional Tier 1 capital) 422,764 Of which: instruments issued by subsidiaries before Resolution No. 4,192 of 2013 comes into effect—Additional Tier I Capital before regulatory adjustments 16,348,895 Itau Unibanco 19

Risk and Capital Management—Pillar 3 Additional Tier I Capital: regulatory adjustments Shares or other instruments issued by the bank authorized to compose the Additional Tier I Capital, acquired directly, indirectly or synthetically 38 Reciprocal cross-holdings in additional Tier 1 instruments—Total value of adjustments related to net non-significant investments in the Additional Tier I Capital of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation Total value of adjustments related to net significant investments in the Additional Tier I Capital of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation National specific regulatory adjustments—41.b Non-controlling interest in Additional Tier I Capital—.c Other residual differences concerning the Additional Tier I Capital calculation methodology for regulatory purposes—Regulatory adjustments applied to the Additional Tier I Capital due to the insufficient Tier 11 Capital to cover deductions—Total regulatory deductions from the Additional Tier I Capital—Additional Tier I Capital (AT1) 16,348,895 Tier I 145,402,138 Tier II: instruments Instruments eligible for Tier II 16,707,126 Instruments that are authorized to compose Tier II before Resolution No. 4,192 of 2013 comes into effect—Tier 2 instruments issued by subsidiaries and held by third parties (amount allowed in group Tier 2) 94,115 Of which: instruments issued by subsidiaries before Resolution No. 4,192 of 2013 comes into effect—Tier II before regulatory adjustments 16,801,241 Tier II: regulatory adjustments Shares or other instruments issued by the bank authorized to compose Tier II, acquired directly, indirectly or synthetically—Reciprocal cross-holdings in Tier 2 instruments—Total value of adj ustments related to net non-significant investments in the Tier II and other TLAC liabilities of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation Total value of adjustments related to net significant investments in the Tier II and other TLAC liabilities of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation National specific regulatory adjustments—56.b Non-controlling interest in Tier II—56.c Other residual differences concerning Tier II calculation methodology for regulatory purposes—Total regulatory deductions from Tier II Capital—Tier II 16,801,241 Referential Equity (Tier I + Tier II) 162,203,379 Total risk-weighted assets 1,164,323,759 BIS Ratios and Additional Capital Buffers Common Equity Tier I Ratio 11.1% Tier I Ratio 12.5% BIS Ratio 13.9% Additional Capital Buffers (% of RWA) 3.0% Of which: capital conservation buffer requirement 2.0% Of which: bank-specific countercyclical buffer requirement—Of which: capital buffer for institutions that are systemically important at global level (G-SIB) 1.0% Common Equity Tier 1 capital available after meeting the bank’s minimum capital requirements (% of RWA) 2.9% Amounts below the limit for deduction (non-weighted by risk) Total value, subject to risk weighting, of non-significant investments in the Common Equity Tier I of institutions authorized to operate by the Central Bank of Brazil, non-consolidated overseas financial institutions, companies that are similar to non-consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and open ended pension entities, as well as non-significant 539,980 investments in the Additional Tier I, Tier II and other TLAC liabilities of institutions authorized to operate by the Central Bank of Brazil or by a financial institution abroad outside the scope of regulatory consolidation Total value, subject to risk weighting, of significant investments in the Common Equity Tier I of institutions authorized to operate by the Central Bank of Brazil, non-consolidated overseas financial institutions, companies that are similar to non-consolidated financial institutions, 8,826,224 (f) / (a) insurance companies, reinsurance companies, capitalization companies and sponsored pension fund entities 75 Tax credits arising from temporary differences, not deducted from the Common Equity Tier I 15,525,496 (c) Instruments authorized to compose the Referential Equity before Resolution No. 4,192 of 2013 comes into effect (applicable between October 1, 2013 and January 1, 2022) Instruments that are authorized to compose the Additional Tier I Capital before Resolution No. 4,192 of 2013 comes into effect—Amount excluded from the Additional Tier I Capital due to the line 82 limit—Instruments that are authorized to compose Tier II before Resolution No. 4,192 of 2013 comes into effect—Amount excluded from Tier 11 due to the line 84 limit—Itau Unibanco 20

Risk and Capital Management—Pillar 3 CC2: Reconciliation of regulatory capital to balance sheet RS million, at the end of the period 03/31/2022 Balance Sheet as in Under regulatory published financial scope of Reference(2) statements consolidation Consolidated Balance Sheet(1) Assets Current assets and Long-term receivables 2,155,198 1,923,839 Cash 42,722 42,629 Interbank investments 243,140 240,505 Securities and derivative financial instruments 726,362 503,356 Interbank accounts 159,887 159,887 Interbranch accounts 247 247 Loan, lease and other credit operations 771,073 771,972 Other receivables 207,982 201,615 Deferred tax assets—56,412 (b)/(c) Sundry—145,203 (b) I (d) Other assets 3,785 3,628 Permanent assets 28,112 45,952 Investments 5,422 24,341 (a)/(e)/(f) Realestate 6,315 5,811 Goodwill and Intangible assets 16,375 15,800 Goodwill—2,268 (e) Intangible assets—13,443 (h) / (i) Other—89 Total assets 2,183,310 1,969,791 Liabilities Current and Long-term Liabilities 2,029,408 1,815,003 Deposits 807,043 818,014 Deposits received under securities repurchase agreements 278,295 278,295 Funds from acceptances and issuance of securities 172,058 172,058 Interbank accounts 71,866 71,866 Interbranch accounts 12,242 12,246 Borrowings and onlending 107,890 107,890 Derivative financial instruments 64,663 64,664 Technical provision for insurance, pension plan and capitalization 221,308—Provisions 16,948 16,574 Allowance for financial guarantees provided and loan commitments 5,452 5,452 other liabilities 271,643 267,944 Deferred tax liabilities—3,052 (b)/(c) Sundry—264,892 (d) Non-controlling interest in subsidiaries 9,509 10,384 (j) Stockholders’ equity 144,393 144,404 Capital 90,729 90,729 (k) Other Revenues and Other Reserves (7,339) (7,047) (m) Revenue reserves 61,082 60,801 (I) (Treasury shares) (79) (79) (n) Total liabilities and stockholders’ equity 2,183,310 1,969,791 Differences are mainly due to non-consolidation of non financial companies (highlighting the following companies: Insurance, Pension Plan and Premium Bonds) within the Prudential Conglomerate and also by the eliminations of transactions with related parties. Prudential information 1hat is presented in the Template CC1 of this document. Itau Unibanco 21

Risk and Capital Management—Pillar 3 Macroprudential Indicators CCyB1: Geographical distribution of credit risk exposures considered in the calculation of the Countercyclical Capital Buffer The following table details the geographic distribution of credit risk exposures considered in the calculation of the Countercyclical Capital Buffer, according to Circular 3,769 of 29 October 2015: RS million 03/31/2022 Exposure values and/or risk- weighted assets (RWA) used in the computation of the countercyclical capital buffer Bank-specific .. ,. . . Countercyclical Countercyclical capital Geographical breakdown capjta| buffer rate Amount of credit risk exposure countercyclical capital buffer amount’3’ to the non-banking private RWACPrNB buffer rate sector Brazil—1,634,090 709,804—Luxembourg 0.50% 2,435 1,672—Norway 1.00% 312 216—Hong Kong 1.00% 11 11—Sum(1) 1,636,848 711,703 Total(2) 1,950,036 917,327 — Sum of RWACPrNBi portions related to credit risk exposures to the non-banking private sector in Brazil and jurisdictions with a percentage of the countercyclical buffer with values greater than zero. Total of RWA for non-bank private credit risk exposures to all jurisdictions in which the bank has exposure, including jurisdictions with no countercyclical buffer percentage applied or with a countercyclical percentage equal to zero. Calculated according to Circular 3.769, employing the discretionary exclusion of jurisdiction. GSIB1: Disclosure of G-SIB indicators The GSIB1 table, disclosure of global systemically important bank (G-SIB) indicators, will be available on the website www.itau.com.br/investor-relations, section “Reports”, “Pillar 3 and Global Systemically Important Banks”, within the period stipulated by BCB Resolution 54/20. Leverage Ratio The Leverage Ratio is defined as the ratio between Tier I Capital and Total Exposure, calculated according to BACEN Circular 3,748, which minimum requirement is of 3%. The ratio is intended to be a simple measure of non-risk-sensitive leverage, and so it does not take into account risk weights or risk mitigation. The following information is based on the methodology and standard format introduced by BACEN Circular 3,748. Itau Unibanco 22

Risk and Capital Management—Pillar 3 LR1: Summary comparison of accounting assets vs leverage ratio exposure measure (RA) R$ million 03/31/2022 12/31/2021 Total consolidated assets as published financial statements 2,183,310 2,166,019 Adjustment from differences of consolidation (213,519) (211,471) Total assets of the individual balance sheet or of the requlatory consolidation, in the case of Leverage Ratio on a consolidated . basic 1,969,791 1.954,548 basis Adjustments for derivative financial instruments 20,309 21,429 Adjustment for securities financing transactions (ie repos and similar secured lending) 15,240 19,552 Adjustment for off-balance sheet items (ie conversion to credit equivalent amounts of off-balance sheet exposures) 154,484 153,139 Other adjustments (143,878) (129,976) Total Exposure 2,015,946 2,018,692 LR2: Leverage ratio common disclosure R$ million 03/31/2022 12/31/2021 Items shown in the Balance Sheet Balance sheet items except derivative financial instruments, securities received on loan and resales for settlement under 1,609,833 repurchase transactions Adjustments for equity items deducted in the calculation of Tier I (26,517) (25,408) Total exposure shown in the Balance Sheet 1,585,943 1,584,425 Transactions using Derivative Financial Instruments Replacement value for derivatives transactions 51,480 54,800 Potential future gains from derivatives transactions 14,317 14,997 Adjustment for collateral in derivatives transactions—Adjustment related to the deduction of the exposure because of the qualified central counterparty (QCCP) in derivative transactions on behalf of clients in which there is no contractual obligation to reimburse due to bankruptcy or default of the (6,948) (8,038) entities responsible for the settlement and compensation of transactions Reference value for credit derivatives 14,750 1 5,447 Adjustment of reference value calculated for credit derivatives (3,647) (4,443) Total exposure for derivative financial instruments 69,952 72,763 Repurchase Transactions and Securities Lending (TVM) Investments in repurchase transactions and securities lending 166,492 166,141 Adjustment for repurchases for settlement and creditors of securities lending — Amount of counterparty credit risk 15,239 1 9,552 Amount of counterparty credit risk in transactions as intermediary 23,836 22,671 Total exposure for repurchase transactions and securities lending 205,567 208,364 Off-balance sheet items Reference value of off-balance sheet transactions 484,565 474,931 Adjustment for application of FCC specific to off-balance sheet transactions (330,081) (321,791) Total off-balance sheet exposure 154,484 153,140 Capital and Total Exposure Tier I 145,402 149,912 Total Exposure 2,015,946 2,018,692 Leverage Ratio Basel III Leverage Ratio 7.2% 7.4% Itau Unibanco 23

Risk and Capital Management—Pillar 3 Liquidity Ratios LIQA: Liquidity Risk Management Information Framework and Treatment Liquidity risk is defined as the likelihood of the institution not being able to effectively honor its expected and unexpected obligations, current and future, including those from guarantees commitment, without affecting its daily operations or incurring in significant losses. In line with the fundraising strategy, Itau Unibanco has diversified and stable sources of funding available, monitored through concentration and maturity indicators, in order to mitigate liquidity risks, in accordance with the institution’s risk appetite. The governance of the liquidity risk management is based on advisory boards, subordinated to the Board of Directors or the executive structure of Itau Unibanco. Such boards establish the institution’s risk appetites, define the limits related to the liquidity control and monitor the liquidity indicators. The control of the liquidity risk is carried out by an area that is independent of the business areas, responsible for defining the composition of the reserve, estimating the cash flow and the exposure to liquidity risk in different time horizons and monitoring short and long term liquidity indicators (LCR and NSFR respectively). In addition, it proposes minimum limits to absorb losses in stress scenarios for each country where Itau Unibanco operates and reports any non-compliance to the competent authorities. All activities are subject to verification by the independent validation, internal controls and audit departments. Additionally, and pursuant to the requirements of Resolution 4,557, BACEN Circular 3,749 and Circular 3,869, the Liquidity Risk Statement (DRL—LCR) and the Long Term Liquidity Statement (DLP—NSFR) are monthly sent to BACEN. Finally, the following items are periodically prepared and submitted to senior management for monitoring and decision support: Stress of liquidity indicators based on macroeconomic scenarios, simulation of reverse stress based on risk appetite, and projection of the main liquidity indicators to support decisions; Contingency and recovery plans for crisis situations, with actions that provide for a gradation according to the level of criticality determined by the easiness of implementation, taking into account the characteristics of the local market in which it operates, seeking a rapid restoration of liquidity indicators; Reports and graphs that describe risk positions; Concentration indicators of funding providers and time. The document that details the liquidity risk control institutional policy is on the Investor Relations website https://www.itau.com.br/investor-relations,section “Itau Unibanco”, under “Corporate Governance”, “Rules and Policies, Reports”. Itau Unibanco 24

Risk and Capital Management—Pillar 3 LIQ1: Liquidity Coverage Ratio (LCR) 03/31/2022(1) 12/31/2021(1) Total unweighted Total weighted Total unweighted Total weighted value (In value (In value (In value (In thousand RS)(2) thousand RS)(3) thousand RS)(2) thousand R$)(3) High Quality Liquidity Assets (HQLA) Total High Quality Liquid Assets (HQLA) 293,572,797 307,279,779 Cash Outflows(4) Retail deposits and deposits from small business customers, of which: 469,060,510 44,218,079 465,057,968 43,342,772 Stable deposits 237,326,736 11,866,337 238,521,337 11,926,067 Less stable deposits 231,733,774 32,351,742 226,536,631 31,416,705 Unsecured wholesale funding, of which: 324,602,905 141,612,539 328,185,258 143,118,243 Operational deposits (all counterparties) and deposits in networks of cooperative banks 14,059,236 3,419,739 14,924,291 3,692,762 Non-operational deposits (all counterparties) 308,190,848 135,839,979 310,707,840 136,872,354 Unsecured debt 2,352,821 2,352,821 2,553,127 2,553,127 Secured wholesale funding 21,315,346 25,331,027 Additional requirements, of which: 301,842,854 37,078,709 285,726,288 29,383,849 Outflows related to derivative exposures and other collateral requirements 30,477,236 17,454,220 21,298,944 10,462,035 Outflows related to loss of funding on debt products 640,255 640,255 581,330 581,330 Credit and liquidity facilities 270,725,363 18,984,234 263,846,014 18,340,484 Other contractual funding obligations 83,297,016 83,297,016 79,177,512 79,177,512 Other contingent funding obligations 144,332,333 21,956,800 1 39,315,950 20,699,884 Total Cash Outflows 349,4/8,489 341,053,287 Cash Inflows(4) Secured lending (eg reverse repos) 150,903,339 2,209,271 164,230,369 2,114,760 Inflows from fully performing exposures 39,430,666 24,981,746 38,150,251 23,924,273 Other cash inflows 141,912,604 125,959,791 135,614,926 121,921,427 Total Cash Inflows 332,246,609 153,150,808 337,995,546 147,960,460 Total Adjusted Total Adjusted Value(5) Value*5’ Total HQLA 293,572,797 307,279,779 Total net cash outflows 196,327,681 193,092,827 Liquidity Coverage Ratio (%) 149.5% 159.1% Corresponds to 62 daily average observations at 1Q22 and 63 daily at 4Q21 Total balance off the cash inflows or outflows After application of weighting factors Potential cash outflows (Outflows e) and inflows (inflows e) Amount calculated after applying weighting factors and limits set by BACEN Circular 3,749 Itau Unibanco has High Quality Liquidity Assets (HQLA) that amounted to R$ 293.6 billion on average for the quarter, mainly composed of Sovereign Securities, Central Bank Reserves and Cash. Net Cash Outflows amounted to R$ 196.3 billion on average for the quarter, which are mostly comprised of Retail Funding, Wholesale, Additional Requirements, Contractual and Contingent Obligations, offset by Cash inflows from loans and other Cash inflows. The table shows that the average LCR in the quarter is 149.5%, above the limit of 100% and therefore the institution has high quality liquidity resources comfortably available to support the losses in the standardized stress scenario for the LCR. Itau Unibanco 25

Risk and Capital Management—Pillar 3 LIQ2: Net Stable Funding Ratio (NSFR) Value per residual effective maturity term (RS thousand) Greater than or equal . Weighted Value (1) Lower than six . . .. Greater than or equal ,. . 03/31/2022 No Maturity(1) to six months, and (In thousand months(1) to 1 year(1) R$(2) lower than 1 year(1) RS)(2) Available Stable Funding (ASF)(3) Capital—196,542,712 196,542,712 Reference Equity, gross of regulatory deductions ——154,970,153 154,970,153 Other capital instruments not included in line 2 ——41,572,559 41,572,559 Retail Funding: 206,835,238 279,212,946 1,762,197 1,289,223 452,434,463 Stable Funding 124,464,705 117,807,877 45,365 40,677 230,242,726 Less Stable Funding 82,370,533 161,405,069 1,716,832 1,248,546 222,191,737 Wholesale Funding: 79,881,543 580,403,954 76,455,154 120,355,588 330,021,133 Operational deposits and deposits of member cooperatives 11,962,483 ——5,981,242 Other Wholesale Funding 67,919,060 580,403,954 76,455,154 120,355,588 324,039,891 Opertions in which the institution acts exclusively as intermediary, not undertaking any rights or 94,517,601 obligations, even if contingent Other liabilities, in which: 94,914,880 125,380,017 2,079,474 41,543,265 42,583,002 Derivatives whose replacement values are lower than zero 18,530,343 — Other liability or equity elements not included above 94,914,880 106,849,674 2,079,474 41,543,265 42,583,002 Total Available Stable Funding (ASF) 1,021,581,310 Required Stable Funding (RSF)(3) Total NSFR high quality liquid assets (HQLA) 14,088,609 Operational deposits held at other financial institutions—Performing loans and securities (financial institutions, corporates and central banks) 2,723,082 425,294,506 114,612,591 509,988,010 618,581,618 Performing loans to financial institutions secured by Level 1 HQLA—36,980,138 909 1 69,798 3,868,266 Performing loans to financial institutions secured by non-Level 1 HQLA and unsecured performing loans to 2,157,470 43 56S170 4 558287 36,028,469 45,262,523 financial institutions Perfooming loans to non-financial corporate clients, loans to tatal and small business customers and loans to 565,612 315,178,079 84,665,423 228,575,750 339,248,908 sovereigns, central banks, of which: With a risk weight of less than or equal to 35%, approach for credit risk, according to Circular 3,644 ——4,350,202 2,827,631 Performing residential mortgages, of which:—7,439,035 7,139,554 116,005,073 100,173,750 Which are in accordance to Circular 3,644, 2013, art. 22 ——76,667,253 65,653,325 Securities that are not in default and do not qualify as HQLA. including exchange-traded equities—22,129,084 18,248,418 129,208,920 130,028,171 Operations in which the institution acts exclusively as intermediary, not undertaking any rights or obligations, even if contingent Other assets, in which: 68,020,737 169,121,575 9,422,740 94,750,802 197,461,563 Transactions with gold and commodities, including those with expected physical settlement — Assets posted as initial margin for derivatives contracts and participation in mutual guarantee funds of 6 clearinghouses or providers of clearing and settlement services which acts as central counterparty, Derivatives whose replacement values are higher than or equal to zero 25,733,191—7,388,389 7,388,389 Derivatives whose replacement values are less than zero, gross of the deduction of any collateral provided as a result of deposit of variation margin ‘ ‘ 1,201,254 1,201,254 All other assets not included in the above categories 68,020,737 143,388,384 9,422,740 70,103,486 175,222,898 Off-balance sheet transactions 582,221,621 7,420,665 — 22,348,910 Total Required Stable Funding (RSF) 852,480,700 NSFR (%) 119.8% Corresponds to the total amount of Available Stable Funding (ASF) or Required Stable funding (RSF). Corresponds to the amount after application of weighting factors. Corresponds to the Available Stable Funding (ASF) or Required Stable Funding (RSF). Total Adjusted Value(1) R$ thousand 03/31/2022 12/31/2021 Total Available Stable Funding (ASF) 1,021,581,310 1,016,989,399 Total Required Stable Funding (RSF) 852,480,700 839,830,476 NSFR (%) 119.8% 121.1% 1) Corresponds to the amount calculated after application of the weighting factors and limits set forth in BACEN Circular 3,869. Itau Unibanco 26

Risk and Capital Management—Pillar 3 Itau Unibanco has an Available Stable Funding (ASF) amounted to R$ 1,021.6 billion in the 1 quarter, mainly composed of Capital, Retail Funding and Wholesale. In addition, the Required Stable Funding (RSF) amounted to R$ 852.5 billion in the 1 quarter, which is mostly composed of loans and financing granted to wholesale, retail, central economies and central bank operations. The table shows that the NSFR at the end of the quarter is 119.8%, above the limit of 100%, and therefore the institution has Available Stable Funding to support the Required Stable Funding comfortably in the long-term, according to the metric. Credit Risk CRA: Qualitative information on credit risk management Itau Unibanco defines credit risk as the risk of loss associated with: failure by a borrower, issuer or counterparty to fulfill their respective financial obligations as defined in the contracts; value loss of credit agreements resulting from deterioration of the borrower’s, issuer’s or counterparty’s credit rating; reduction of profits or income; benefits granted upon subsequent renegotiations; or debt recovery costs. The management of credit risk is intended to preserve the quality of the loan portfolio at levels compatible with the institution’s risk appetite for each market segment in which Itau Unibanco operates. The governance of credit risk is managed through corporate bodies, which report to the Board of Directors or to the Itau Unibanco executive structure. Such corporate bodies act primarily by assessing the competitive market conditions, setting the credit limits for the institution, reviewing control practices and policies, and approving these actions at the respective authority levels. The risk communication and reporting process, including disclosure of institutional and supplementary policies on credit risk management, are also function of this structure. Itau Unibanco manages the credit risk to which it is exposed during the entire credit cycle, from before approval, during the monitoring process and up to the collection or recovery phase, with the periodic monitoring of problematic assets, which are defined as: Overdue Transactions for more than 90 days; Restructured Operations for Problematic Assets; Counterparties that present inability to pay, whether by legal measures, bankruptcy, loss, among others; Significant deterioration in credit quality, which can be identified by deterioration in internal rating metrics, guarantees honored, overdue exposure, among others. Additionally, if it is identified that a CNPJ may contaminate the counterparties, they may be marked as Problematic Assets. The monitoring contains information on significant exposures, including recovery history and prospects, as well as restructuring information. These analyzes are generated monthly for executives and quarterly for the Board of Directors through the Risk and Capital Management Committee (CGRC). There is a credit risk management and control structure, centralized and independent of the business units which defines operational limits, risk mitigation mechanisms and processes, and instruments to measure, monitor and control the credit risk inherent to all products, portfolio concentrations and impacts to potential changes in the economic environment. Such structure is subjected to internal and external auditing processes. The credit’s portfolio, policies and strategies are continuously monitored so as to ensure compliance with the rules and laws in effect in each country. The Itau Unibanco 27

Risk and Capital Management—Pillar 3 key assignments of the business units are (i) monitoring of the portfolios under their responsibility, (ii) granting of credit, taking into account current approval levels, market conditions, the macroeconomic prospects and changes in markets and products, and (iii) credit risk management aimed at making the business sustainable. Itau Unibanco’s credit policy is based on internal factors, such as: client rating criteria, performance and evolution of the portfolio, default levels, return rates and allocated economic capital, among others; and also take into account external factors such as: interest rates, market default indicators, inflation and changes in consumption, among others. With respect to individuals, small and medium companies, retail public, the credit ratings are assigned based on statistical application (in the early stages of relationship with a customer) and behavior score (used for customers with whom Itau Unibanco already has a relationship) models. For wholesale public, the classification is based on information such as the counterparty’s economic and financial situation, its cash-generating capacity, and the business group to which it belongs, the current and prospective situation of the economic sector in which it operates. Credit proposals are analyzed on a case-by-case basis through the approval governance. The concentrations are monitored continuously for economic sectors and largest debtors, allowing preventive measures to be taken to avoid the violation of the established limits. Itau Unibanco also strictly controls credit exposure to clients and counterparties, acting to reverse occasional limit breaches. In this sense, contractual covenants may be used, such as the right to demand early payment or require additional collateral. To measure credit risk, Itau Unibanco takes into account the probability of default by the borrower, issuer or counterparty, the estimated amount of exposure in the event of default, past losses from default and concentration of borrowers. Quantifying these risk components is part of the lending process, portfolio management and definition of limits. The models used by Itau Unibanco are independently validated, to ensure that the databases used in constructing the models are complete and accurate, and that the method of estimating parameters is adequate. Itau Unibanco also has a specific structure and processes aimed at ensuring that other aspects of credit risk, such as country risk, are managed and controlled, described in the item “Other Risks”. In compliance with CMN Resolution 4,557, the document “Public Access Report—Credit Risk,” which describes the guidelines established in the institutional ruling on credit risk control, can be viewed on the website www.itau.com.br/investor-relations, section “Itau Unibanco”, under “Corporate Governance”, “Rules and Policies”, “Reports”. Itau Unibanco 28

Risk and Capital Management—Pillar 3 CR1: Credit Quality of Asset .... 03/31/2022 R$ million Gross carrying values of Allowances, Unearned Revenues and ECL ... Defaulted exposures (a) Non-defaulted .. . . Net values (a+b-c) (1) accounting provision (1) exposures (b) Loans 58,076 890,750 137,398 811,428 Debt Securities 4,902 414,121 4,742 414,281 in which: Sovereigns—217,136 1,518 215,618 in which: Other Debts 4,902 196,985 3,224 198,663 Off—balance sheet exposures—485,732 797 484,935 Total 62,978 1,790,603 142,937 1,710,644 1) Pursuant to Resolution 54, as of 01/01/2022, defaulted exposures operations correspond to those characterized as problematic assets, a concept defined in Resolution 4,557. CR2: Changes in Stock of defaulted loans and debts securities R$ million Total Defaulted loans and debt securities at end of the previous reporting period (12/31/2021 )(1)(2) 62,079 Loans and debt securities that have defaulted since the last reporting period 7,413 Amount returned to non-defaulted status (369) Amount written off (8,477) Other changes 2,332 Defaulted loans and debt securities at end of the reporting period (03/31/2022)(1) 62,978 1) Pursuant to Resolution 54, as of 01/01/2022, defaulted exposures operations correspond to those characterized as problematic assets, a concept defined in Resolution 4,557. 2) For purposes of comparability, for December/21, the same criterion as in March/22 was used. CRB: Additional disclosure related to the credit quality of assets The tables below contain additional disclosure related to the credit quality exposures reported in the table CR1. Where is informed breakdown of exposures by geographical area, industry and defaulted exposures. In addition, the total exposures by residual maturity by delay range, the total of restructured exposures and the percentage of the ten and one hundred largest exposures are reported. Itau Unibanco 29

Risk and Capital Management—Pillar 3 Exposure by industry Total Exposure Total defaulted loans and debt securities R$ million 03/31/2022 RS million 03/31/2022 Portfolio Portfolio Total Exposure (Net Total Exposure Defaulted Expected Credit values) (Gross values} Exposures(1) Loss Companies 1,019,073 1,055,611 Companies 23,371 6,658 Public sector 282,707 284,455 Public sector Energy 707 707 Energy — Petrochemical and Chemical 3,387 3,325 Petrochemical and Chemical — Sundry 278,613 280,423 Sundry — Private sector 736,366 771,156 Private sector 23,371 6,658 Sugar and Alcohol 8,904 9,264 Sugar and Alcohol 291 177 Agribusiness and Fertilizers 32,483 33,228 Agribusiness and Fertilizers 288 187 Food and Beverage 34,997 36,528 Food and Beverage 940 409 Banks and Other Financial Institutions 88,412 88,924 Banks and Other Financial Institutions 35 17 Capital Assets 11,819 12,299 Capital Assets 181 52 Pulp and Paper 5,934 6,011 Pulp and Paper 21 5 Electronic and IT 18,503 19,362 Electronic and IT 645 181 Packaging 6,300 6,515 Packaging 300 (94) Energy and Sewage 49,378 50,266 Energy and Sewage 222 95 Education 7,118 7,518 Education 277 88 Pharmaceuticals and Cosmetics 19,217 19,869 Pharmaceuticals and Cosmetics 440 160 Real Estate Agents 49,002 51,826 Real Estate Agents 1,446 771 Entertainment and Tourism 12,863 15,294 Entertainment and Tourism 1,715 614 Wood and Furniture 8,673 9,341 Wood and Furniture 425 140 Construction Material 11,626 12,445 Construction Material 287 93 Steel and Metallurgy 15,372 16,032 Steel and Metallurgy 501 77 Media 1,567 1,607 Media 35 11 Mining 8,112 8,863 Mining 530 503 Infrastructure Work 13,327 14,435 Infrastructure Work 702 260 Oil and Gas 13,515 14,246 Oil and Gas 265 126 Petrochemical and Chemical 17,769 18,267 Petrochemical and Chemical 251 71 Health Care 12,889 13,369 Health Care 157 42 Insurance and Reinsurance and Pension Plans 259 266 Insurance and Reinsurance and Pension Plans — Telecommunications 13,297 13,572 Telecommunications 61 21 Clothing and Footwear 8,173 8,822 Clothing and Footwear 534 85 Trading 4,596 4,748 Trading 75 27 Transportation 39,602 42,935 Transportation 957 412 Domestic Applianoes 5,298 5,420 Domestic Appliances 85 20 Vehicles and Autoparts 27,570 28,852 Vehicles and Autoparts 870 301 Third Sector 3,291 3,452 Third Sector 4 1 Publishing and Printing 3,603 3,947 Publishing and Printing 207 67 Commerce—Sundry 48,394 51,942 Commerce—Sundry 2,250 912 Industry—Sundry 12,986 13,116 Industry—Sundry 66 17 Sundry Services 64,545 68,710 Sundry Services 3,187 1,439 Sundry 56,972 59,865 Sundry 5,121 (629) Individuals 691,571 797,970 Individuals 39,607 14,094 Total 1,710,644 1,853,581 Total 62,978 20,752 1) Pursuant to Resolution 54, as of 01/01/2022, defaulted exposures operations correspond to those characterized as problematic assets, a concept defined in Resolution 4,557. Exposure by remaining maturity R$ million 03/31/2022 R$ million 03/31/2022 Remaining maturities of transactions (Net values)(1) Remaining maturities of transactions (Gross values)(1) up to 6 months 6 to 12 months 1 to 5 years above 5 years Total up to 6 months 6 to 12 months 1 to 5 years above 5 years Total 408,537 103,338 459,447 340,609 1,311,931 437,759 106,513 518,334 391,972 1,454,578 Overdue exposures R$ million 03/31/2022 Gross portfolio Itau Unibanco 30

Risk and Capital Management—Pillar 3 Overdue amounts1 Less than 30 days 8,323 31 to 90 days 13,782 91 to 180 days 12,382 181 to 365 days 14,072 above 365 days 3,054 Total 51,613 1) According to Circular Letter 4,068, the table follows the same scope as table CR1. Exposure by geographical area in Brazil and by country Total Exposure Total defaulted loans and debt securities R$ million 03/31/2022 R$ million 03/31/2022 Portfolio Portfolio Total Exposure Total Exposure Defaulted Expected Credit (Net values} (Gross values) Exposures(2) Loss Southeast 829,008 905,052 Southeast 43,207 12,715 South 128,946 145,046 South 6,092 2,085 North 23,256 29,143 North 1,607 604 Northeast 104,450 123,807 Northeast 6,861 3,057 Midwest 59,008 68,175 Midwest 3,471 1,241 National territory(1) 215,618 217,100 National territory — Brazil 1,360,286 1,488,323 Brazil 61,238 19,702 Argentina 7,227 7,542 Argentina 25 19 Chile 183,266 187,722 Chile 1,092 599 Colombia 38,809 47,572 Colombia 422 274 United States 21,662 22,091 United States 11 11 Paraguay 15,712 15,866 Paraguay 102 77 United Kingdom 18,540 18,737 United Kingdom — Swiss 3,386 3,386 Swiss — Uruguay 25,864 26,193 Uruguay 88 70 Other 35,892 36,149 Other — Foreign 350,358 365,258 Foreign 1,740 1,050 Total 1,710,644 1,853,581 Total 62,978 20,752 Itau Unibanco 31 1 Considers only Brazilian goverment bonds.

Risk and Capital Management—Pillar 3 Largest debtors exposures R$ million 03/31/2022 Loans, Debt Securities and Off-balance sheet exposures (CR1)(1) Exposure % of portfolio 10 largest debtors 288,415 17.0% 100 largest debtors 435,668 26.0% 1) According to Circular Letter 4,068, the table follows the same scope as table CR1, in which the exposure value considers sovereign debt securities. Restructured exposures RS million 03/31/2022 Overdue Others Restructured Exposures 23,478 110 1) Pursuant to Resolution 54, as of 01/01/2022, defaulted exposures operations correspond to those characterized as problematic assets, a concept defined in Resolution 4,557. CRC: Qualitative disclosure related to Credit Risk Mitigation techniques Itau Unibanco uses guarantees to increase its recovery capacity in operations subject to credit risk. The guarantees used can be financial, credit derivatives, fiduciary, real, legal structures with mitigation power and offsetting agreements. For these guarantees to be considered as credit risk mitigating instruments, it is necessary that they comply with the requirements and determinations of the that regulate them, whether internal or external, and that they are legally enforceable (effective), enforceable and regularly evaluated. The information regarding the possible concentration associated with the mitigation of credit risk considers these different mitigating instruments, segregating by type and by provider. For reasons of confidentiality, the institution determines the non-disclosure of information beyond the classification of the type of guarantor, but ensuring adherence to the general requirements. • Financial Guarantees: the borrower or third party highlights a financial asset (deposits, bonds, shares, shares of low-risk equity, among others), in such a way as to guarantee the creditor’s reimbursement in case of default. • Fiduciary Guarantees and credit derivatives: a third party assumes the responsibility for fulfilling the obligation contracted by the debtor, which falls on the general equity of that third party. Avals, sureties and CDS are examples of these guarantees. Itau Unibanco 32

Risk and Capital Management—Pillar 3 Fiduciary guarantees are segregated into the following providers: Legal Entities; Multilateral Development Entities (EMD); Financial Institutions, Sovereigns, National Treasury or Central Bank. Itau Unibanco also uses credit derivatives to mitigate the credit risk of its securities portfolios. These instruments are priced based on models that use the fair price of market variables, such as credit spreads, recovery rates, correlations and interest rates. They are also segregated into: Legal Entities; Multilateral Development Entities (EMD); Financial Institutions and Sovereigns. • Real Guarantees: the borrower himself or a third party highlights an asset or a set of assets, movable or immovable, in such a way as to guarantee the reimbursement of the creditor in case of default. Examples of instruments and assets: mortgages on real estate, pledge of goods, fiduciary sale of real estate, vehicles, machinery and equipment. These guarantees are segregated by type: financial collateral, bilateral contracts and assets. • Clearing and Settlement of Obligations Agreement and legal structures with mitigating power: the clearing agreement aims to reduce the risk of credit exposure of one party to the other, resulting from transactions entered into between them, so that, in case of maturity, after offsetting, the net amount owed by the debtor to the creditor is identified. It is commonly used in derivative transactions, but it can also cover other types of financial transactions. In legal structures with mitigation power and compensation agreements, mitigation is based on methodologies established and approved by the business units responsible for credit risk management and by the centralized credit risk control area. Such methodologies consider factors related to the legal enforceability of the guarantees, the costs necessary for such and the expected value in the execution, taking into account the volatility and liquidity of the market. To control the mitigating instruments, there is periodic monitoring that monitors the level of compliance with the use of each instrument when compared to internal measurement policies, even including corrective action plans when there is noncompliance, analyzing concentration, types, providers, formalization. The parameters used are: HE (Haircut of execution) which evaluates the probability of success in executing the guarantee, HV (Volatility Haircut) represents the liquidity of the collateral being offered, and LMM (Maximum Mitigation Limit) which is the mitigation ceiling for real guarantees. CR3: Credit Risk mitigation techniques—overview(1) RS million 03/31/2022 Exposures . Exposures Exposures Unsecured Secured .. secured by , , secured by .. . secured by Exposures Exposures financial collateral . credit derivatives guarantees Loans 731,443 76,859 8,601 68,258 Debt securities 403,913 872 872—in which: Sovereigns 143,861 2,864 881 1,983 in which: Other Debts 351,962 3,768 3,768—Total 1,631,179 84,363 14,122 70,241—Of which defaulted(2) 18,398 575 221 354 1) The mitigating instruments contemplated in this table are those foreseen in BACEN Circular 3,809. 2) Pursuant to Resolution 54, as of 01/01/2022, defaulted exposures operations correspond to those characterized as problematic assets, a concept defined in Resolution 4,557. Increase in credit granted mainly observed in the line of retail, in relation to debt securities, the main variation comes from exposure to private securities. Variations partially offset by other operations with central governments. Itau Unibanco 33

Risk and Capital Management—Pillar 3 CR4: Standardized Approach—Credit Risk exposure and credit risk mitigation effects R$ million 03/31/2022 Exposures before CCF and CRM Exposures post-CCF and CRM RWA and RWA density On-balance sheet Off-balance On-balance Off-balance Off-balance Asset classes RWA (e) sheet amount amount (a) sheet amount (b) sheet amount (c) sheet amount (d) ... ... [e/(c+d)] Sovereigns and their central banks 473,768—473,768—15,374 3% Non-central government public sector entities 3,674 134 3,674 69 3,330 89% Multilateral development banks 477—477 ——Banks and other Financial Institutions authorized by Brazil Central Bank 133,192 8,360 133,192 4,036 48,814 36% Corporates 421,291 131,201 421,291 72,167 440,420 89% Regulatory retail portfolios 316,786 330,418 316,786 65,151 267,402 70% Secured by residential property 113,426 3,084 113,426 3,084 41,925 36% Secured by commercial real estate 251 543 251 543 397 50% Equity stake 19,978—19,978—19,111 96% Other assets 85,974 3,067 85,974 1,675 87,621 100% Total 1,568,817 476,807 1,568,817 146,725 924,394 54% CR5: Standardized Approach—exposures by asset classes and risk weights RS million Risk weight (FPR} 03/31/2022 Total Asset classes 0% 10% 20% 35% 50% 75% 85% 100% Others credit exposures amount (post CCF and post-CRM) Sovereigns and their central banks 449,656—1,702—16,348 — 4,468 1,594 473,768 Non-central government public sector entities 15—36—277—1,540 1,875—3,743 Multilateral development banks 477 477 Banks and other Financial Institutions authorized by Brazil Central 1 669 64 322 3 760 65 687 — 1 790—137 228 Bank Corporates 9,085 ——12,479—249,825 221,541 528 493,458 Regulatory retail portfolios 7,524 ——48,469 323,478 — 2,466 381,937 Secured by residential property 1 — 108,990 7,423 ——96 116,510 Secured by commercial real estate — — 794 — — 794 Equity stake — — 115—5,397 14,466—19,978 Other assets 28 ——— 87,621—87,649 Total 468,455 66,060 112,750 151,592 323,478 256,762 331,761 4,684 1,715,542 The increase in the total exposure of tables CR4 and CR5 occurred, mainly in the lines of retail and financial institutions, and was partially offset by the decrease in corporate exposures. Counterparty Credit Risk (CCR) CCRA: Qualitative disclosure related to CCR Counterparty credit risk is the possibility of noncompliance with obligations related to the settlement of transactions that involve the trading of financial assets with a bilateral risk. It encompasses derivative financial instruments, settlement pending transactions, securities lending and repurchase transactions. Itau Unibanco has well-defined rules for calculating its managerial and regulatory exposure to this risk, and the models developed are used both for the governance of consumption of limits and management of counterparties sub-limits, as well as for the allocation of capital, respectively. The managerial volatility of the potential credit risk (PCR) of derivatives (interpreted as the amount of potential financial exposure that an operation can reach until its maturity) and the volatility of repurchase agreements and foreign Itau Unibanco 34

Risk and Capital Management—Pillar 3 exchange transactions are monitored periodically to maintain the exposure at levels considered acceptable by the institution’s management. The risk may be mitigated by the use of margin call, initial margin or other mitigating instrument. Currently, Itau Unibanco does not have impact in the amount of collateral that the bank would be required to provide given a credit rating downgrade. The regulatory exposures of counterparty credit risk are presented as follows. CCR1: Analysis of CCR exposures by approach RS million 03/31/2022 Replacement Potential future Multiplier applied to ead r . the calculation of . ... .. RWA cost exposure EAD post mitigation SA-CCR Approach 19,419 6,846 1.4 36,771 28,699 OEM Approach — — Simple Approach for CCR mitigation (for SFTs and asset loans) — Comprehensive Approach for CCR mitigation (for SFTs and asset 764 . 166 469,764 IO, 166 loans) Total 41,865 CCR3: Standardised approach—CCR exposures by regulatory portfolio and risk weights R$ million Risk weight (FPR) 03/31/2022 Counterparties 0% 10% 20% 50% 75% 85% 100% 150% Others Total Sovereigns 131,996 131,996 Non-central government public sector entities — ——115 7 — 122 Multilateral development banks 6,000 6,000 Banks and other Financial Institutions authorized by Brazil Central ,1,187 . 69,37—1,187 13,681 — 12 — 84,254 Bank , . . . Corporates 246,271 — — 19,646 17,349 — 283,266 Regulatory retail portfolios Other Counterparties 156 — 238 — 503 — 897 Total 453,797—1,187 13,919—19,761 17,871 — 506,535 In tables CCR1 and CCR3, there was an increase in the exposure of repo operations, mainly in Governments and Central Banks and Multilateral Organisms and Multilateral Development Entities (EMD), partially offset by the decrease in exposure to financial institutions and others authorized by the Central Bank of Brazil. Itau Unibanco 35

Risk and Capital Management—Pillar 3 CCR5: Composition of collateral for CCR exposures R$ million 03/31/2022 . . .. . . .. . .. Collateral used in SFTs and asset Collateral used in derivative transactions loans Fair value of collateral received Fair value of posted collateral Fair value of Fair value of collateral received posted collateral Segregated Unsegregated Segregated Unsegregated Cash—domestic currency—4,703 — 160,935 225,255 Cash—other currencies — 43 2,247 5,557 38,589 Domestic sovereign debt — 7,446—242,502 160,924 Government agency debt — 7,338 1 6,266 4,922 Corporate bonds — 35,467—25,159 536 Equity securities .—. . 289—Other collateral — 2,592 ——Total â– 4,703 52,886 2,248 440,708 430,226 CCR6: CCR associated with credit derivatives exposures In R$ million 03/31/2022 Protection bought Protection sold Notionals Single-name credit default swaps 4,570 8,757 Index credit default swaps — Total return swaps—5,992 Total notionals 4,570 14,749 Fair values 102 (56) Positive fair value (asset) 111 55 Negative fair value (liability) (9) (111) Itau Unibanco 36

Risk and Capital Management—Pillar 3 CCR8: CCR associated with Exposures to central counterparties R$ 03/31/2022 RS million EAD (post-CRM) RWA Exposures to qualifying CCPs (QCCPs total) 2,413 Exposures for trades at QCCPs (excluding initial margin and default fund contributions); of which 16,302 450 (i) over-the-counter (OTC) derivatives — (ii) Exchange-traded derivatives 15,977 443 (iii) Securities financing transactions 289 6 (iv) Netting sets where cross-product netting has been approved 36 1 Segregated initial margin—Non-segregated initial margin 5,116 1,919 Pre-funded defaultfund contributions 75 44 Exposures to non-QCCPs (total)—Exposures for trades at non-QCCPs (excluding initial margin and default fund contributions); of which — (i) over-the-counter (OTC) derivatives — (ii) Exchange-traded derivatives — (iii) Securities financing transactions — (iv) Netting sets where cross-product netting has been approved — Segregated initial margin—Non-segregated initial margin — Pre-funded defaultfund contributions — In CCR8, there was an increase in exposures associated with operations to be settled in QCCPs, especially in Standardized Derivatives and Asset Loans and decrease in guarantees made available in favor of QCCPs. Securitisation Exposures SECA: Qualitative disclosure requirements related to securitisation exposures Currently, Itau Unibanco coordinates and distributes issues of securitized securities in the capital market with or without a firm placement guarantee. In case of exercising the firm guarantee, the bank will assume the risk as an investor in the operation. Itau Unibanco does not act as a sponsoring counterpart of any specific purpose company with the objective of operating in the securitisation market, nor does it manage entities that acquire securities issued or originated by their own. In relation to accounting, it should be noted that (i) assets representing third-party securitisations are accounted for as well as other assets owned by the Bank, according to the brazilian accounting standards; and (ii) securitisation credits originating from Itau Unibanco’s own portfolio remain accounted for in cases of credit assignment with co-obligation. In 2022, Itau Unibanco did not carry out the sale of credit assets without substantial risk retention and did not assign exposures with substantial risk retention, which have been honored, repurchased or written off as loss. Itau Unibanco 37

Risk and Capital Management—Pillar 3 SEC1: Securitisation exposures in the banking book R$ million 03/31/2022 Bank acts as originator Bank acts as sponsor Banks acts as investor Traditional Synthetic Subtotal Traditional Synthetic Subtotal Traditional Synthetic Subtotal Retail (total)—of which ——... 5,345 . 5,345 residential mortgage ——..... . credit card ——... 2,349—2,349 other retail exposures ——. 3,496—3,496 re- securitisation ——Wholesale (total)—of which — — — 1,411—1,411 loans to corporates — — — 1,411—1,411 commercial mortgage ——lease and receivables—....... . other wholesale ——re- securitisation — SEC2: Securitisation exposures in the trading book In Itau Unibanco’s current securitization portfolio, there are no exposures to be reported in table SEC2. SEC3: Securitisation exposures in the banking book and associated regulatory capital requirements—bank acting as originator or as sponsor In Itau Unibanco’s current securitization portfolio, there are no exposures to be reported in table SEC3. SEC4: Securitisation exposures in the banking book and associated capital requirements—bank acting as investor RS million 03/31/2022 Exposure values (by risk weight bands) regulatory approach) Capital Requirements al exposures—7,017 93 145 1 7,255 1 2,876 16 230 1 Traditional securitisation—7,017 93 14S 1 7,255 1 2,876 16 230 1 Of which securitisation—7,017 93 145 1 7,255 1 2,876 16 230 1 Of which retail underlying—5,606 93 145 1 5,844 1 2,524 16 202 1 Of which wholesale—1,411 ——1,411—352—28 Of which re-securitisation . . . . . . . . . . Synthetic securitisation ..... . . . . . . Of which secuntisation — — — — ——Of which retail underlying ..... . . . . . . Of which wholesale ..... Of which re-securitisation ..... . . . . . . Itau Unibanco 38

Risk and Capital Management—Pillar 3 Market Risk MRA: Qualitative disclosure requirements related to market risk Market risk is the possibility of losses resulting from fluctuations in the market values of positions held by a financial institution, including the risk of operations subject to variations in foreign exchange rates, interest rates, equity and commodity prices, as set forth by CMN. Price Indexes are also treated as a risk factor group. The institutional policy for market risk is in compliance with Resolution 4,557 and establishes the management structure and market risk control, which has the function of: • Provide visibility and comfort for all senior management levels that market risks assumed must be in line with Itau Unibanco risk-return objectives; • Provide a disciplined and well informed dialogue on the overall market risk profile and its evolution over time; • Increase transparency as to how the business works to optimize results; • Provide early warning mechanisms to facilitate effective risk management, without obstructing the business objectives; and • Monitoring and avoiding the concentration of risks. Market risk is controlled by an area independent of the business units, which is responsible for the daily activities: (i) measuring and assessing risk, (ii) monitoring stress scenarios, limits and alerts, (iii) applying, analyzing and stress testing scenarios, (iv) reporting risk to the individuals responsible in the business units, in compliance with Itau Unibanco’s governance, (v) monitoring the measures needed to adjust positions and/or risk levels to make them viable, and (vi) supporting the secure launch of new financial products. The market risk management framework categorizes transactions as part of either the Trading Book or the Baking Book, in accordance with general criteria established by CMN Resolution 4,557 and BACEN Circular 3,354. Trading Book is composed of all trades with financial and commodity instruments (including derivatives) undertaken with the intention of trading. Banking Book is predominantly characterized by portfolios originated from the banking business and operations related to balance sheet management, are intended to be either held to maturity, or sold in the medium and in the long term. The market risk management is based on the following key metrics: • Value at Risk (VaR): a statistical metric that quantifies the maximum potential economic loss expected in normal market conditions, considering a defined holding period and confidence interval; • Losses in Stress Scenarios (Stress Testing): a simulation technique to evaluate the impact, in the assets, liabilities and derivatives of the portfolio, of various risk factors in extreme market situations (based on prospective and historic scenarios); • Stop Loss: metrics that trigger a management review of positions, if the accumulated losses in a given period reach specified levels; • Concentration: cumulative exposure of certain financial instrument or risk factor calculated at market value (“MtM—Mark to Market”); and Itau Unibanco 39

Risk and Capital Management—Pillar 3 • Stressed VaR: statistical metric derived from VaR calculation, aimed at capturing the biggest risk in simulations of the current trading portfolio, taking into consideration the observable returns in historical scenarios of extreme volatility. In addition to the risk metrics described above, sensitivity and loss control measures are also analyzed. They include: • Gap Analysis: accumulated exposure of the cash flows by risk factor, which are marked-to-market and positioned by settlement dates; • Sensitivity (DV01—Delta Variation Risk): impact on the market value of cash flows when a 1 basis point change is applied to current interest rates or on the index rates; and • Sensitivities to Various Risk Factors (Greeks): partial derivatives of a portfolio of options on the prices of the underlying assets, implied volatilities, interest rates and time. In an attempt to fit the transactions into the defined limits, Itau Unibanco hedges its client transactions and proprietary positions, including investments overseas. Derivatives are the most commonly used instruments for carrying out these hedging activities, and can be characterized as either accounting or economic hedge, both of which are governed by institutional regulations at Itau Unibanco. The structure of limits and alerts is in alignment with the board of directors’ guidelines, being reviewed and approved on an annual basis. This structure extends to specific limits and is aimed at improving the process of risk monitoring and understanding as well as preventing risk concentration. Limits and alerts are calibrated based on projections of future balance sheets, stockholders’ equity, liquidity, complexity and market volatility, as well as the Itau Unibanco’s risk appetite. The consumption of market risk limits is monitored and disclosed daily through exposure and sensitivity maps. The market risk area analyzes and controls the adherence of these exposures to limits and alerts and reports them timely to the Treasury desks and other structures foreseen in the governance. Itau Unibanco uses proprietary systems to measure the consolidated market risk. The processing of these systems takes place in an access-controlled environment, being highly available, which has data safekeeping and recovery processes, and counts on an infrastructure to ensure the continuity of business in contingency (disaster recovery) situations. Itau Unibanco 40

Risk and Capital Management—Pillar 3 MR1: Market risk under standardized approach R$ million 03/31/2022 Risk factors RWAmpad Interest Rates 26,279 Fixed rate denominated in reais (RWAjur1) 8,420 Foreign exchange linked interest rate (RWAJ1JR2) 10,693 Price index linked interest rate (RWAJlJR3) 7,166 Interest rate linked interest rate (RWAJ[JR4)—Stock prices (RWAacs) 1,334 Exchange rates (RWACAM) 1,757 Commodity prices (RWACoM) 2,846 Total 32,216 In the increase of market RWA, we observed mainly a higher exposure to Brazilian interest, increasing the capital (compared to December) for the standardized model (RWAMPAD). MRB: Qualitative disclosures on market risk in the Internal Models Approach (IMA) In the internal models approach, the stressed VaR and VaR models are used. These models are applied to operations in the Trading Book and Banking Book. For the Trading Book, the risk factors considered are: interest rates, inflation rates, exchange rates, stocks and commodities. For the Banking Book, exchange rates and commodities are considered. The VaR and stressed VaR models are used in the companies of the Prudential Conglomerate that are presented in the following table: Itau Unibanco 41

Risk and Capital Management—Pillar 3 Institution Model considered for Market Risk A1 Hedge Orange Master Fundo de Investimento Multimercado VaR and Stressed VaR Aj Titulos Publicos Fundo de Investimento Renda Fixa Referenciado DI VaR and Stressed VaR Banco Investcred Unibanco S.A. VaR and Stressed VaR Banco Itau Argentina S.A. VaR and Stressed VaR Banco Itau BBA S.A. VaR and Stressed VaR Banco Itau Consignado S.A. VaR and Stressed VaR Banco Itau Veiculos S.A. VaR and Stressed VaR Banco ItauBank S.A. VaR and Stressed VaR Banco Itaucard S.A. VaR and Stressed VaR Cloudwalk Kick Ass I Fundo De Investimento Em Direitos Creditdrios VaR and Stressed VaR Dibens Leasing S.A.—Arrendamento Mercantil VaR and Stressed VaR Fl DC B2cycle NPL VaR and Stressed VaR Fl DC Cloudw Akira I VaR and Stressed VaR Fl I Kinea Desenv. LO VaR and Stressed VaR Financeira Itau CBD S.A. Credito, Financiamento e Investimento VaR and Stressed VaR Fundo A1 Hedge Orange Fundo de Investimento em Cotas de Fundos de Investimento Multimercado VaR and Stressed VaR Fundo De Invest Dir Creditorios Nao Padron NPL II VaR and Stressed VaR Fundo de Investimento em Direitos Creditorios Nao-Padronizados Barzel VaR and Stressed VaR Fundo de Investimentoem Direitos Creditorios Rede VaR and Stressed VaR Fundo em Direitos Creditorios Cielo Emissores I VaR and Stressed VaR Fundo Fortaleza de Investimento Imobiliario VaR and Stressed VaR Fundo Goal Perfo III VaR and Stressed VaR Fundo Kinea Acoes VaR and Stressed VaR Hipercard Banco Multiplo S.A. VaR and Stressed VaR Intrag Distribuidora de Titulos e Valores Mobiliarios Ltda. VaR and Stressed VaR Iresolve Companhia Securitizadora de Creditos Financeiros S.A. VaR and Stressed VaR Itau Administradora de Consorcios Ltda. VaR and Stressed VaR Itau Bank & Trust Bahamas Ltd, VaR and Stressed VaR Itau Bank & Trust Cayman Ltd. VaR and Stressed VaR Itau Bank, Ltd. VaR and Stressed VaR Itau BBA USA Securities Inc. VaR and Stressed VaR Itau Cia. Securitizadora de Creditos Financeiros VaR and Stressed VaR Itau Corretora de Valores S.A. VaR and Stressed VaR Itau Distribuidora de Titulos e Valores Mobiliarios S.A. VaR and Stressed VaR Itau Kinea Private Equity Multimercado Fundo de Investimento em Cotas de Fundos de Investimento Credito Privado VaR and Stressed VaR Itau OT Titulos Publicos Renda Fixa Referenciado DI Fundo de Investimento em Cotas de Fundos de Investimento VaR and Stressed VaR Itau Unibanco Holding S.A. VaR and Stressed VaR Itau Unibanco Holding S.A., Grand Cayman Branch VaR and Stressed VaR Itau Unibanco S.A. VaR and Stressed VaR Itau Unibanco S.A., Grand Cayman Branch VaR and Stressed VaR Itau Unibanco S.A., Nassau Branch VaR and Stressed VaR Itau Unibanco Veiculos Administradora de Consorcios Ltda. VaR and Stressed VaR Itau Valores S.A. VaR and Stressed VaR ITB Holding Ltd. VaR and Stressed VaR Kinea Acoes Fundo de Investimento em Acoes VaR and Stressed VaR Kinea CO-investimento Fundo de Investimento Imobiliario VaR and Stressed VaR Kinea I Private Equity FIP Multiestrategia VaR and Stressed VaR Kinea KP Fundo de Investimento Multimercado Credito Privado VaR and Stressed VaR Kinea Ventures FIP VaR and Stressed VaR Licania Fund Limited VaR and Stressed VaR Luizacred S.A. Sociedade de Credito, Financiamento e Investimento VaR and Stressed VaR Microinvest S.A. Soc. de Credito a Microempreendedor VaR and Stressed VaR Oiti Fundo de Investimento Multimercado Credito Privado Investimento no Exterior VaR and Stressed VaR Redecard Instituicao de Pagamento S.A. VaR and Stressed VaR RT Itau DJ Titulos Publicos Fundo de Investimento Renda Fixa Referenciado DI VaR and Stressed VaR RT Scala Renda Fixa—Fundo de Investimento em Cotas de Fundos de Investimento VaR and Stressed VaR Institution Model considered for Market Risk RT Voyager Renda Fixa Credito Privado—Fundo de Investimento VaR and Stressed VaR Taruma Fundo Incentivado de Investimento em Debentures de Infraestrutura Renda Fixa Credito Privado VaR and Stressed VaR Itau Unibanco 42

Risk and Capital Management—Pillar 3 Itau Unibanco, for regulatory purposes, uses the historical simulation methodology to calculate the VaR and Stressed VaR. This methodology uses the returns observed in the past to calculate the gains and losses of a portfolio over time, with a 99% confidence interval and a holding period of at least 10 days. On March 31, 2022, VaR represented 54% of the capital requirement, while the stressed VaR represented 46%. The same methodology is used for management purposes, that is, there are no differences between the managerial and regulatory models. In relation to the VaR model, the historical returns are daily updated. Itau Unibanco uses in its VaR model both the unweighted approach, in which historical data have the same weight, and the weighted by the volatility of returns. For the calculation of volatilities, the Exponentially Weighted Moving Average method is used. The Historical VaR methodology with 10-day maintenance periods assumes that the expected distribution for possible losses and gains for the portfolio can be estimated from the historical behavior of the returns of the market risk factors to which this portfolio is exposed. The returns observed in the past are applied to current operations, generating a distribution of probability of losses and simulated gains that are used to estimate the Historical VaR, according to the 99% confidence level and using a historical period of 1,000 days. Losses and gains from linear operations are calculated by multiplying mark-to- market by returns, while non-linear operations are recalculated using historical returns. The returns used in simulating the movements of risk factors are relative. Regarding the Stressed VaR model, the calculation is performed for a time horizon of 10 working days, considering the 99% confidence level and simple returns in the historical period of one year. The historical stress period is periodically calculated for the period since 2004 and can be revised whenever deemed necessary. This can occur when the composition of Itau Unibanco’s portfolios changes significantly, when changes are observed in the results of the simulation of historical returns or when a new market crisis occurs. Losses and gains from linear operations are calculated by multiplying mark to market by returns, while non-linear operations are recalculated using historical returns. In addition to the use of VaR, Itau Unibanco carries out daily risk analysis in extreme scenarios through a diversified framework of stress tests, in order to capture potential significant losses in extreme market situations. The scenarios are based on historical, prospective crises and predetermined shocks in risk factors. One factor that has a great influence on the results of the tests, for example, is the correlation between the assets and the respective risk factors, and this effect is simulated in several ways in the various scenarios tested. In order to identify its greatest risks and assist in the decision-making of treasury and senior management, the results of stress tests are assessed by risk factors, as well as on a consolidated basis. The effectiveness of the VaR model is proven by backtesting techniques, by comparing hypothetical and actual daily losses and gains, with the estimated daily VaR, according to BACEN Circular 3,646. The number of exceptions to the established VaR limits must be compatible, within an acceptable statistical margin, with three different confidence intervals (99%, 97.5% and 95%), in three different historical windows (250, 500 and 750 working days). This includes nine different samples, therefore ensuring the statistical quality of the historical VaR hypothesis. Itau Unibanco has a set of processes, which are periodically executed by the internal control teams, whose objective is to independently replicate the metrics that influence market risk capital by internal models. In addition to the results of the periodic processes, Itau Unibanco assesses the process of measuring time horizons by risk factors and the estimate of the stress period for calculating the stressed VaR. The validation of the internal model includes several topics considered essential for the critical analysis of the model, such as, the evaluation of the model’s limitations, the adequacy of the parameters used in the volatility estimate and the comprehensiveness and reliability of the input data. MR2: RWA flow statements of market risk exposures under an IMA Itau Unibanco 43

Risk and Capital Management—Pillar 3 Exposures subject to market risk The following table presents the exposures subject to market risk in the internal models approach, for calculating the capital requirement. RS million VaR Stressed VaR Other Total RWAMiNT RWAMINT—12/31/2021 ,718 3,654 6,379 14,751 Movement in risk levels 1,859 2,355—4,214 Updates/changes to the internal model Methodology and regulation Acquisitions and disposals — — Foreign exchange movements 208 (257)—(49) Other — 97 97 RWAMINT—03/31/2022 6,785 5,752 6,476 19,013 The increase in RWAMINT compared to the previous quarter was mainly due to the increase in the risk levels of the positions held by Itau Unibanco. MR3: IMA values for trading portfolios The following table presents the VaR and stressed VaR values determined by the internal market risk models. R$ million 03/31/2022 VaR (10 days, 99%) Maximum value 289 Average value 176 Minimum value 96 Quarter end 132 Stressed VaR (10 days, 99%) Maximum value 289 Average value 151 Minimum value 68 Quarter end 208 VaR and stressed VaR increased from the previous quarter due to increased exposure to interest rates. Itau Unibanco 44

Risk and Capital Management—Pillar 3 MR4: Comparison of VaR estimates with gains/losses Backtesting The effectiveness of the VaR model is validated by backtesting techniques, comparing daily hypothetical and actual results with the estimated daily VaR. The daily VaR is calculated over a one-day maintenance horizon, according to the 99% confidence level and using a historical period of 1,000 days. The percentage of capital requirement associated with this model is 100%. The backtesting analysis presented below considers the ranges suggested by the Basel Committee on Banking Supervision (BCBS). The ranges are divided into: • Green (0 to 4 exceptions): backtesting results that do not suggest any problem with the quality or accuracy of the adopted models; • Yellow (5 to 9 exceptions): intermediate range group, which indicates an early warning monitoring and may indicate the need to review the model; and • Red (10 or more exceptions): need for improvement actions. The following chart shows the comparison between VaR and actual and hypothetical results: VaR, actual and hypothetical P&L comparison The exceptions in relation to the hypothetical results occurred on 10/19/2021 and 10/21/2021, in the amounts of R$ 37,7 and R$ 7,9 million, respectively. These excesses were caused by the increased level of local interest market volatility. In relation to the actual results, the exceptions also ocurred on 10/19/2021 and 10/21/2021, in the amounts of R$ 23,2 and R$ 3,5 million, respectively. These excesses were caused by the increased level of local interest market volatility. The actual results do not include fees, brokerage fees and commissions. There are no profit reserves. Itau Unibanco 45

Risk and Capital Management—Pillar 3 Total Exposure associated with Derivatives The main purpose of the derivative positions is to manage risks in the Trading Book and in the Banking Book in the corresponding risk factors. Derivatives: Trading and Banking R$ million 03/31/2022 With Central Counterparty Without Central Counterparty Onshore Offshore Onshore Offshore Risk Factors Long Short Long Short Long Short Long Short Interest Rates 152,582 (188,403) 12,339 (11,411) 69,025 (80,134) 61,076 (129,226) Foreign Exchange 222,888 (211,760) 106,198 (102,362) 24,966 (42,459) 271,533 (252,094) Equities 10,203 (9,447) 162 (3,226) 14 (574) — Commodities 1,942 (2,280)—(6) 411 (4) — IRRBBA: IRRBB risk management objectives and policies BACEN’s (Central Bank of Brazil) Circular 3,876, published in January 2018, states on methodologies and procedures for evaluation of the capital adequacy, held to cover interest rates risk from instruments held in the banking book. For the purposes of this Circular, are defined: • AEVE (Delta Economic Value of Equity) is defined as the difference between the present value of the sum of repricing flows of instruments subject to IRRBB in a base scenario, and the present value of the sum of repricing flows of the same instruments in an interest-rate shocked scenario; • NII (Delta Net Interest Income) is defined as the difference between the result of financial intermediation of instruments subject to IRRBB in a base scenario, and the result of financial intermediation of the same instruments in an interest-rate shocked scenario. The sensibility analysis introduced here are just a static evaluation of the portfolio interest rate exposure, and, therefore, don’t consider the dynamic management of the treasury desk and risk control areas, which hold the responsibility for measures to mitigate risk under an adverse situation, minimizing significant losses. Moreover, it is highlighted, though, the results presented do not translate into accountable or economic results for certain, because this analysis has, only, an interest rate risk disclosure purpose and to demonstrate the principle protection actions, considering the instruments fair value, apart from any accounting practices adopted by Itau Unibanco. The institution uses an internal model to measure AEVE and ANII. AEVE results do not represent immediate impact in the stockholders’ equity. Meanwhile, ANII results indicate potential volatility in the projected interest rates results. In compliance with the circular 3,876, the following demonstrates qualitative and quantitative details of risk management for IRRBB in Itau Unibanco. Framework and Treatment Interest rate risk in the banking book refers to the potential risk of impact on capital sufficiency and/or on the results of financial intermediation due to adverse movements in interest rates, taking into account the principal flows of instruments held in the banking book. Itau Unibanco 46

Risk and Capital Management—Pillar 3 The main point of assets and liabilities management is to maximize the risk-return ratio of positions held in the banking book, taking into account the economic value of these assets/liabilities and the impact on actual and future bank’s results. The interest rate risk managing on transactions held in the banking book occurs within the governance and hierarchy of decision-making bodies and under a limits structure and alerts approved specifically for these purpose, which is sensitive due to different levels and classes of market risk. The management structure of IRRBB has it owns risk policies and controls intended to ensure adherence to the bank’s risk appetite. The IRRBB framework has granular management limits for several other risk metrics and consolidated limits for AEVE and ANII results, besides the limits associated with stress tests. The asset and liability management unit is responsible for managing timing mismatches between asset and liability flows, and minimizes interest rate risk by through strategies as economic hedge and accounting hedge. All the models associated with IRRBB have a robust independent validation process and are approved by a CTAM (Technical Model Assessment Commission). In addition, all the models and processes are assessed by internal audit. The interest rate risk framework in the banking book uses management measurements that are calculated daily for limit control. The AEVE and ANII metrics are calculated according to the risk appetite limits and the other risk metrics in terms of management risk limits. In the process of managing interest rate risk of the banking book, transactions subject to automatic options are calculated according to internal market models which split the products, as far as possible, into linear and non-linear payoffs. The linear payoffs are treated similarly to any other instruments without options, and for non-linear payoffs an additional value is computed and added on the AEVE and ANII metrics. In general terms, transactions subject to behavioral options are classified as deposits with no contractual maturity date defined or products subject to early repayment. Non-maturity deposits are classified according to their nature and stability to guarantee compliance with regulatory limits. A survival analysis model treats the products subject to prepayment, using the historical dataset to calibrate its parameters. The instruments flows with homogeneous characteristics are adjusted by specific models to reflect, in the most appropriate way, the repricing flows of the instruments. The banking book consists of asset and liability transactions originating in different commercial channels (retail and wholesale) of Itau Unibanco. The market risk exposures inherent in the banking book consists of various risk factors, which are primary components of the market in price formation. IRRBB also includes hedging transactions intended to minimize risks deriving from strong fluctuations of market risk factors and their accounting asymmetries. Market risk generated from structural mismatches is managed by a variety of financial instruments, such as exchange- traded and over-the-counter derivatives. In some cases, operations using derivative financial instruments can be classified as accounting hedges, depending on their risk and cash flow characteristics. In these cases, the supporting documentation is analyzed to enable the effectiveness of the hedge and other changes in the accounting process to be continuously monitored. The accounting and administrative procedures for hedging are defined in BACEN Circular 3,082. The IRRBB model includes a series of premises: • AEVE and ANII are measured on the basis of the cash flows of the banking book instruments, broken down into their risk factors to isolate the effect of the interest rate and the spread components; Itau Unibanco 47

Risk and Capital Management—Pillar 3 • For non-maturity deposits, the models are classified according to their nature and stability and distributed over time considering the regulatory limits; • The institution uses survival analysis models to handle credit transactions subject to prepayment, and empirical models for transactions subject to early redemption. Itau Unibanco 48

Risk and Capital Management—Pillar 3 Other Risks Insurance products, pension plans and premium bonds risks Products that compose portfolios of insurance companies of Itau Unibanco are related to life and elementary insurance, as well as pension plans and premium bonds. The main risks inherent in these products are described below and their definitions are given in their respective chapters. • Underwriting Risk: possibility of losses arising from insurance products, pension plans and premium bonds that go against institution’s expectations, directly or indirectly associated with technical and actuarial bases used for calculating premiums, contributions and technical provisions; • Market Risk; • Credit Risk; • Operational risk; • Liquidity risk. In line with domestic and international best practices, Itau Unibanco has a risk management structure which ensures that risks resulting from insurance, pension and special savings products are properly assessed and reported to the relevant forums. The process of risk management for insurance, pensions and premium bond plans is independent and focus on the special nature of each risk. The aim of Itau Unibanco is to ensure that assets serving as collateral for long-term products, with guaranteed minimum returns, are managed according to the characteristics of the liabilities, so that they are actuarially balanced and solvent over the long term. Social and Environmental Risk and Climate Risk Social and Environmental risk is the possibility of losses due to exposure to social and/or environmental events related to the activities developed by the ITAU UNIBANCO HOLDING. Social and environmental factors are considered relevant to the business of ITAU UNIBANCO HOLDING, since they may affect the creation of shared value in the short, medium and long term. The Policy on Sustainability and Social and Environmental Responsibility (PRSA) establishes the guidelines, strategies and underlying principles for social and environmental risk management, based on institutional issues and addressing, through specific procedures, the most significant risks for the Institution’s operation. Actions to mitigate the Social and Environmental Risk are taken based on the mapping of processes, risks and controls, monitoring of new standards related to the theme and record of occurrence in internal systems. In addition to the identification, the phases of prioritization, response to risk, mitigation, monitoring and reporting of assessed risks supplement the management of this risk at ITAU UNIBANCO HOLDING. In the management of social and environmental risk, business areas manage the risk in its daily activities, following the PRSA guidelines, specific processes, with the support of specialized assessment from dedicated technical teams Itau Unibanco 49

Risk and Capital Management—Pillar 3 located in Corporate Compliance, Credit Risk and Modeling, and Institutional Legal teams, that act on an integrated way in the management of all dimensions of the Social and Environmental Risk related to the conglomerate’s activities. As an example of the specific guidelines to manage this risk, business units count on the governance for approval of new products and services, which contemplates, in its assessments, the Social and Environmental Risk, ensuring the compliance with this requirement in new products approved by the Institution, as well as specific social and environmental procedures for the Institution’s operation (stockholders’ equity, branch infrastructure and technology), suppliers, credit, investments and key controls. Credit Risk and Modeling, Internal Controls and Compliance areas, in turn, support and ensure the governance of the business areas’ activities. The Internal Audit, acts on an independent manner, assessing risk management, controls and governance. Governance also counts on the Social and Environmental Risk Committee, whose main responsibility is to assess and deliberate about institutional and strategic matters, as well as to resolve on products, operations, and services, among others involving the Social and Environmental Risk, including Climate Risk. Climate Risk includes: (i) physical risks, arising from changes in weather patterns, such as increased rainfall and temperature and extreme weather events, and (ii) transition risks, resulting from changes in the economy as a result of climate actions, such as carbon pricing, climate regulation, market risks and reputational risks. Considering its relevance, climate risk has become one of the main priorities for ITAU UNIBANCO HOLDING, which supports the Task Force on Climate-related Financial Disclosures (TCFD) and it is committed to its implementation of its recommendations. With this purpose, ITAU UNIBANCO HOLDING is strengthening the governance and strategy related to Climate Risk and developing tools and methodologies to assess and manage these risks. ITAU UNIBANCO HOLDING measures the sensitivity of the credit portfolio to climate risks by applying the Climate Risk Sensitivity Assessment Tool, developed by FEBRABAN. The tool combines relevance and proportionality criteria to identify the sectors and clients within the portfolio that are more sensitive to climate risks, considering physical and transition risks. The sectors with the highest probability of suffering financial impacts from climate change for ITAU UNIBANCO HOLDING are: energy, transport, materials and construction, agriculture, food and forestry products. Model Risk The model risk arises from the incorrect development or maintenance of models, such as mistaken assumptions, and inappropriate use or application of the model. The use of models can lead to decisions that are more accurate and therefore it is a major practice in the institution. The models have supported strategic decisions in several contexts, such as credit approval, pricing, volatility curve estimation, calculation of capital, among others. Due to the increasing use of models, driven by the application of new technologies and the expansion of data use, Itau Unibanco has improved its governance in relation to its development, implantation, use and monitoring, through the definition of guidelines, policies and procedures aimed at assuring the quality and mitigation of the associated risks. The performance of the areas responsible for models is evaluated by the Operational Risk and Internal Audit teams to ensure adherence to such policies. The opportunities for improvement found during these assessments are duly addressed with action plans, which are followed up by the 3 lines of defense and by senior management until their conclusion. Itau Unibanco 50

Risk and Capital Management—Pillar 3 Regulatory or Compliance Risk Regulatory or Compliance risk is the risk associated with any nature, financial losses or damage to reputation, arising from non-compliance with external or internal standards, commitments to regulators, or other commitments undertaken voluntarily by adhering codes of self-regulation, methods or codes of conduct related to the activities of the Conglomerate. This risk is managed through a structured process aimed at identifying changes in the regulatory environment, analyzing their impacts on the departments of the institution and monitoring the actions directed at adherence to the regulatory requirements and other commitments mentioned above. This structured process includes the following actions: (i) to understand the changes in the regulatory environment; (ii) to monitor regulatory trends; (iii) to care for the relationship between the institution and the regulator, self-regulatory bodies and the representation entity; (iv) to monitor action plans on regulatory or self-regulatory compliance; (v) to coordinate a program to comply with significant norms, such as Integrity and Ethics; and (vi) to report regulatory issues in Operational and Compliance Risk forums, according to the structure of committees established in internal policies. Reputational Risk Itau Unibanco understands reputational risk as the risk arising from internal practices and/or external factors that may generate a negative perception of Itau Unibanco by customers, employees, shareholders, investors, regulatory bodies, government, suppliers, the press and the society in general. It can impact the bank’s reputation, the value of its brand and/or result in financial losses. Besides, this can affect the maintenance of existing business relationships, access to sources of fundraising, the attraction of new business and talent to compose the company’s staff or even the license to operate. The institution believes that its reputation is extremely important for achieving its long-term goals, which is why it seeks the alignment of the speech, the action and the ethical and transparent practice, essential to raise the confidence of Itau Unibanco’s stakeholders. Itau Unibanco’s reputation depends on its strategy (vision, culture and skills) and derives from direct or indirect experience of the relationship between Itau Unibanco and its stakeholders. Since the reputational risk directly or indirectly permeates all operations and processes of the institution, Itau Unibanco’s governance is structured in a way to ensure that potential risks are identified, analyzed and managed still in the initial phases of its operations and analysis of new products, including the use of new technologies. The treatment given to reputational risk is structured by means of many processes and internal initiatives, which, in turn, are supported by internal policies, and their main purpose is to provide mechanisms for the monitoring, management, control and mitigation of the main reputational risks. Among them are (i) risk appetite statement; (ii) process for the prevention and fight against unlawful acts; (iii) crisis management process and business continuity; (iv) processes and guidelines of the governmental and institutional relations; (v) corporate communication process; (vi) brand management process; (vii) ombudsman offices initiatives and commitment to customer satisfaction; and (vii) ethics guidelines and prevention of corruption. Financial institutions play a key role in preventing and fighting illegal acts, in particular money laundering, terrorist financing and fraud, in which the challenge is to identify and suppress increasingly sophisticated operations that seek to conceal the origin, location, disposition, ownership and movement of goods and money derived, directly or indirectly, from illegal activities. Itau Unibanco has introduced a corporate policy in order to prevent its involvement in illegal acts and to protect its reputation and image towards employees, clients, strategic partners, suppliers, service providers, regulators and society, through a governance structure based on transparency, strict compliance with rules and regulations, including BACEN Circular 3,978/20 among others, and cooperation with police and judicial authorities. It also seeks a continuously alignment with local and international best practices for preventing and fighting against illegal acts, through investing and training eligible employees. Itau Unibanco 51

Risk and Capital Management—Pillar 3 In compliance with the guidelines of this corporate policy, Itau Unibanco established a program to prevent and fight against illegal acts based on the following pillars: • Policies and Procedures; • Client Identification Process; • Know Your Customer (KYC) Process; • Know Your Partner (KYP) Process; • Know Your Supplier (KYS) Process; • Know Your Employee (KYE) Process; • Assessment of New Products and Services; • Compliance with Sanctions; • Monitoring, Selection and Analysis of Suspicious Operations or Situations; • Reporting Suspicious Transactions to the Regulatory Bodies; and • Training. This program applies to the entire institution, including subsidiaries and affiliates in Brazil and abroad. The preventing and combating unlawful acts governance is carried out by the Board of Directors, Audit Committee, Operational Risk Committee, Risk and Capital Management Commitee and Anti-Money Laundering Committees. The document that presents the guidelines established in the corporate program to prevent and combat unlawful acts may be seen on the www.itau.com.br/investor-relations, section Itau Unibanco, under Corporate Governance, Rules and Policies, Policies, Corporate Policy for Prevention and Fight Against Illegal Acts. In addition, Itau Unibanco has been developing various data analysis models to improve customer risk classification, transaction monitoring and KYC methodology to provide greater accuracy in its analysis and to decrease false-positives. Itau Unibanco has also been innovating its modeling solutions using new methods based on machine learning techniques to identify potentially suspicious activities. Besides, Itau Unibanco is committed to protecting corporate information and ensuring client and general public privacy in any transactions. To this end, it has a Corporate Information Security Policy and Cyber Secutity and has a governance, monitoring and process control structure that covers technology, business areas and international units, adhering to principal regulatory bodies and external audits, and best market practices and certifications. For this purpose, it has an expanded perimeter protection strategy, a concept that considers that information should be protected wherever it is: within the bank’s infrastructure, in a cloud service in a service provider or in an international unit, also taking into consideration the entire life cycle of information, from the moment it is collected, through processing, transmission, storage, analysis and destruction. This strategy is based on strict control processes, aimed at detection, prevention, uninterrupted monitoring and immediate response to attacks and attempted infrastructure invasions, thus ensuring the management of security risk and building a robust foundation for an increasingly digital future. Additionally, a Security Operation Center (SOC) that works 24/7 contributes to the cyber security of electronic channels and IT infrastructure, to the monitoring of operations and thus the minimization of the risk of a security incident. 52 Itau Unibanco

Risk and Capital Management—Pillar 3 The Corporate Information Security and Cyber Security Policy can be viewed on the website www.itau.com.br/ investor-relations, section Itau Unibanco, under Corporate Governance, Rules and Policies, Policies, Corporate Policy on Information Security and Cyber Security. Country Risk The country risk is the risk of losses related to non-compliance with obligations in connection with borrowers, issuers, counterparties or guarantors, as a result of political-economic and social events or actions taken by the government of the country. Itau Unibanco has a specific structure for the management and control of country risk, consisting of corporate bodies and dedicated teams, with responsibilities defined in policies. The institution has a structured and consistent procedure, including: (i) establishment of country ratings; (ii) determination of limits for countries; (iii) monitoring the use of limits. Business and Strategy Risk Business and strategy risk is the risk of a negative impact on the results or capital as a consequence of a faulty strategic planning, the making of adverse strategic decisions, the inability of Itau Unibanco to implement the proper strategic plans and/or changes in its business environment. Itau Unibanco has implemented many mechanisms that ensure that both the business and the strategic decisionmaking processes follow proper governance standards, have the active participation of executives and the Board of Directors, are based on market, macroeconomic and risk information and are aimed at optimizing the risk-return ratio. Decision-making and the definition of business and strategy guidelines, count on the full engagement of the Board of Directors, primarily through the Strategy Committee, and of the executives, through the Executive Committee. In order to handle risk adequately, Itau Unibanco has governance and processes to involve the Risk Area in business and strategy decisions, so as to ensure that risk is managed and decisions are sustainable in the long term. They are: (i) qualifications and incentives of board members and executives; (ii) budget process; (iii) product assessment; (iv) evaluation and prospecting of proprietary mergers and acquisitions; and (v) a risk appetite framework which, for example, restricts the concentration of credit and exposure to specific and material risks. Contagion Risk Contagion Risk is the possibility of losses occurring for entities that are part of the Prudential Conglomerate as a result of financial support to unconsolidated entities, in a stressful situation, in the absence or in addition to the obligations provided for in the contract. Itau Unibanco has a structure for risk management and control, a dedicated team and a policy that defines roles and responsibilities. This structure covers (i) the identification of entities in relation to the potential generation of contagion risk, (ii) the assessment of risks in relationships, (iii) the monitoring, control and mitigation of contagion risk, (iv) the assessment of impact on capital and liquidity and (v) reports. It is part of the scope of contagion risk governance: Related Party audiences, mainly composed of controllers, controlled and related entities (as defined in Res. 4,693 / 18), foundations, investments in non-consolidated entities, suppliers of critical products and services, assigness, buyers and sellers of relevant assets, third parties with products distributed by Itau Unibanco and third parties to whom Itau Unibanco distributes products, besides all the analysis of the international Units. Emerging Risks They are those with a potentially material impact on the business in the medium and long terms, but for which there are not enough elements yet for their complete assessment and mitigation due to the number of factors and impacts not yet totally known, such as technological alternatives in replacement of traditional banking services and the demographic transition of clients in contrast to technological innovations. Their causes can be originated by external events and result Itau Unibanco 53

Risk and Capital Management—Pillar 3 in the emergence of new risks or in the intensification of risks already monitored by ITAU UNIBANCO HOLDING CONSOLIDATED. The identification and monitoring of Emerging Risks are ensured by ITAU UNIBANCO HOLDING CONSOLIDATED’s governance, allowing these risks to be incorporated into risk management processes too. Operational Risk Operational risk is defined as the possibility of losses arising from failure, deficiency or inadequacy of internal process, people or systems or from external events that affect the achievement of strategic, tactical or operational objectives. It includes legal risk associated with inadequacy or deficiency in contracts signed by the institution, as well as penalties due to noncompliance with laws and punitive damages to third parties arising from the activities undertaken by the institution. Itau Unibanco internally classifies its risk events in: • Internal fraud; • External fraud; • Labor claims and deficient security in the workplace; • Inadequate practices related to clients, products and services; • Damages to own physical assets or assets in use by Itau Unibanco; • Interruption of Itau Unibanco’s activities; • Failures in information technology (IT) systems, processes or infrastructure; • Failures in the performance, compliance with deadlines and management of activities at Itau Unibanco. Operational risk management includes conduct risk, which is subject to mitigating procedures to assess product design and incentive models. The inspection area is responsible for fraud prevention. Irrespective of their origin, specific cases may be handled by risk committees and integrity and ethics committees. Itau Unibanco has a governance process that is structured through forums and corporate bodies composed of senior management, which report to the Board of Directors, with well-defined roles and responsibilities in order to segregate the business and management and control activities, ensuring independence between the areas and, consequently, well-balanced decisions with respect to risks. This is reflected in the risk management process carried out on a decentralized basis under the responsibility of the business areas and by a centralized control carried out by the internal control, compliance and operational risk department, by means of methodologies, training courses, certification and monitoring of the control environment in an independent way. The managers of the executive areas use corporate methods constructed and made available by the Operational Risk and Corporate Compliance and Money Laundering Prevention Areas. Among the methodologies and tools used are the self-evaluation and the map of the institution’s prioritized risks, the approval of processes, products, the monitoring of key risk indicators and the database of operational losses, guaranteeing a single conceptual basis for managing processes, risks, projects and new products and services. Itau Unibanco 54

Risk and Capital Management—Pillar 3 Within the governance of the risk management process, regularly, the consolidated reports on risk monitoring, controls, action plans and operational losses are presented to the business area executives. In line with CMN Resolution 4,557, the document “Public Report—Integrated Management of Operational Risk /Internal Controls/Compliance”, summarized version of the institutional operational risk management policy can be found on the website www.itau.com.br/investor-relations, section Itau Unibanco, under Corporate Governance, Rules and Policies, Reports. Crisis Management and Business Continuity Itau Unibanco’s Business Continuity Program’s purpose is to protect its employees, ensure the continuity of the critical functions of its business lines and sustain both the stability of the markets in which it operates and the confidence of its customers and strategic partners in its provision of services and products. It establishes the Business Continuity Plan (BCP), which consists of modular procedures that are available for use in the event of incidents. The descriptions/characteristics of the existing plans are: • Disaster Recovery: it aims to ensure the availability and integrity of Information Technology resources and communication in the event of a failure in the primary Data Center to maintain the processing of critical systems; • Workplace Contingency: alternative facilities to perform the activities in the event the administrative buildings become unavailable; • Operational Contingency: alternatives to carry out critical processes whether they are systemic, procedural or emergency responses. In order to keep the continuity solutions aligned with the business requirements (processes, minimum resources, legal requirements, etc) the Program applies the following tools to assess the institution: • Business Impact Analysis (BIA): evaluates the criticality and resumption requirement of the processes that support the delivery of products and services. • Threats and Vulnerabilities Analysis (AVA): identification of threats near to Itau Unibanco’s buildings. Considering the dependence that some processes have on third-party services, the Business Continuity Program conducts an assessment of the risk of unavailability of services provided with a view to resilience to threats of interruption. The institution has a Crisis Management Program, which is aimed at managing business interruption events, natural disasters, impacts of an environmental, social, and infrastructure/operational (including information technology) or of any other nature that jeopardize the image and reputation and/or viability of Itau Unibanco’s processes with its employees, clients, strategic partners and regulators, with timely and integrated responses. The Program establishes a frequent flow of acculturation with the company’s senior management, as well as a constant analysis of high-impact scenarios and events to establish response plans in line with current threats. To assess efficiency and identify points for improvement in crisis response plans, tests are carried out at least once a year. Itau Unibanco 55

Risk and Capital Management—Pillar 3 Independent Validation of Risk Models Itau Unibanco validates the processes and risk models independently. This is done by a department which is separate from the business and risk control areas, to ensure that its assessments are independent. The validation method, defined in an internal policy, meets regulatory requirements such as those of BACEN Circulars 3,646 and 3,674 and Resolutions 2,682 and 4,557. The validation stages include: • Verification of mathematical and theoretical development of the models; • Qualitative and quantitative analysis of the models, including the variables, construction of an independent calculator and the use of appropriate technical; • When applicable, comparison with alternative models and international benchmarks; • Historical Backtesting of the model; • Assessment of the adequacy of the implementation of the models in the systems used. Additionally, the validation area assesses the stress testing program. The performance of the independent validation area and the validation of the processes and models are assessed by Internal Audit and reported to the specific senior management committees. Action plans are prepared to address opportunities identified during the independent validation process, and are monitored by the 3 lines of defense and by senior management until the conclusion. Itau Unibanco 56

Risk and Capital Management—Pillar 3 Risk and Capital Management—Pillar 3 Glossary of Acronyms A • ASF—Available Stable Funding • ATI—Additional Tier 1 Capital • AVA—Avaliagao de Vulnerabilidade e Ameagas(Threats and Vulnerabilities Analysis) B • BACEN—Banco Central do Brasil (Central Bank of Brazil) • BCB—Banco Central do Brasil (Central Bank of Brazil) • BCP—Business Continuity Plan • BCBS—Basel Committee on Banking Supervision • BIA—Business Impact Analysis • BIS—Bank for International Settlements C • CCF—Credit Conversion Factor • CCP—Non-Qualified Central Counterparty • CCR—Counterparty Credit Risk • CDP—Carbon Disclosure Project • CEM—Current Exposure Method • CEO—Chief Executive Officer • CET 1—Common Equity Tier I • CGRC—Comite de Gestao de Risco e Capital (Risk and Capital Management Committee) • CMN—Conselho Monetario Nacional (National Monetary Council) • Comef—Comite de Estabilidade Financeira (Financial Stability Committee) • CRI—Real State Receivables Certificate Itau Unibanco 57

Risk and Capital Management—Pillar 3 • CRM—Credit Risk Mitigation • CRO—Chief Risk Officer • CTAM—Comissao Tecnica de Avaliagao de Modelos (Technical Model Assessment Commission) • CVA—Credit Valuation Adjustment • CVM—Comissao de Valores Mobiliarios (Brazilian Securities and Exchange Commission) D • DLP—Long- Term Liquidity Statement • DRL—Liquidity Risk Statement • D-SIB—Domestic Systemically Important Banks • DV—Delta Variation E • EAD—Exposure at Default • ECL—Expected Credit Losses • EMD—Entidades Multilaterais de Desenvolvimento (Multilateral Development Entities) • EP—Equator Principles • EVE—Economic Value of Equity F • FEBRABAN—Federagao Brasileira de Bancos (Brazilian Banking Federation) • FCC—Credit Conversion Credit • FIDC—Credit Rights Investment Funds • FPR—Fator de Ponderagao de Risco(Weighting Factor) G • GAP—Gap Analysis • GDP—Gross Domestic Product • GHG—Greenhouse Gas Protocol Itau Unibanco 58

Risk and Capital Management—Pillar 3 • Greeks—Sensitivities to Various Risk Factors • G-SIB—Global Systemically Important Banks H • HE—Haircut of Execution • HQLA—High Quality Liquid Assets • HV—Volatility Haircut I • ICAAP—Internal Capital Adequacy Assessment Process • IMA—Internal Models Approach • IPV—Independent Price Verification • IRRBB—Interest Rate Risk in the Banking Book • IT—Information Technology K • KYC—Know your Customer • KYP—Know your Partner • KYS—Know your Supplier • KYE—Know your Employee L • LCR—Liquidity Coverage Ratio • LMM—Limite de Mitigagao Maxima (Maximum Mitigation Limit) M • MtM—Mark to Market N • NII—Net Interest Income Itau Unibanco 59

Risk and Capital Management—Pillar 3 • NSFR—Net Stable Funding Ratio O • OTC—Over-the-Counter P • PR—Patrimonio de Referenda (Total Capital) • PRI—Principles for Responsible Investments • PRSA—Politica de Sustentabilidade e Responsabilidade Socioambiental (The Social and Environmental Responsability and Sustainability Policy) • PCR—Potential Credit Risk • PVA—Prudent Valuation Adjustments Q • QCCP—Qualified Central Counterparties R • RA—Leverage Ratio • RAS—Risk Appetite Statement • RSF—Required Stable Funding • RWA—Risk Weighted Assets • RWACPAD—Portion relating to exposures to credit risk • RWACPrNB—amount of risk-weighted assets corresponding to credit risk exposures to the non-banking private sector, calculated for jurisdictions whose ACCPi is different from zero • RWAMINT—Portion relating to exposures to market risk, using internal approach • RWAMPAD—Portion relating to exposures to market risk, calculated using standard approach • RWAOPAD—Portion relating to the calculation of operational risk capital requirements S • SA—Joint-Stock Company Itau Unibanco 60

Risk and Capital Management—Pillar 3 • SA-CCR—Standardised Approach to Counterparty Credit Risk • SFN—Sistema Financeiro Nacional(National Financial System) • SFT—Securities Financing Transactions • SOC—Security Operation Center T • TCFD—Task Force on Climate-Related Financial Disclosures • TLAC—Total Loss-Absorbing Capacity • TVM—Titulos de valores mobiliarios(Securities) V • VaR—Value at Risk Itau Unibanco 61

Risk and Capital Management—Pillar 3 Risk and Capital Management—Pillar 3 Glossary of Regulations • BACEN Circular No. 3,354, of June 27th, 2007 • BACEN Circular No. 3,644, of March 4th, 2013 • BACEN Circular No. 3,646, of March 04th, 2013 • BACEN Circular No. 3,674, of October 31st, 2013 • BACEN Circular No. 3,748, of February 26th, 2015 • BACEN Circular No. 3,749, of March 05th, 2015 • BACEN Circular No. 3,751 of March 19th, 2015 • BACEN Circular No. 3,769, of October 29th, 2015 • BACEN Circular No. 3,809, of August 25th, 2016 • BACEN Circular No. 3,846, of September 13rd, 2017 • BACEN Circular No. 3,869, of December 19th, 2017 • BACEN Circular Letter No. 3,907 of September 10th, 2018 • BACEN Circular Letter No. 4,068 of July 7th, 2020 • BACEN Circular Letter No. 3,876 of January 31st, 2018 • BACEN Circular Letter No. 3,082 of January 30th, 2012 • BACEN Circular Letter No. 3,978 of January 23rd, 2020 • BACEN Communication No. 38.373, of February 24th, 2022 • BCB Resolution No. 54, of December 16th, 2020 • CMN Resolution No. 2,682, of December 22nd, 1999 • CMN Resolution No. 4,327, of April 25th, 2014 • CMN Resolution No. 4,502, of June 30th, 2016 • CMN Resolution No. 4,557, of February 23rd, 2017 Itau Unibanco 62

Risk and Capital Management—Pillar 3 • CMN Resolution No. 4,589, of June 29th, 2017 • CMN Resolution No. 4,693, of October 29th, 2018 • CMN Resolution No. 4,955, of October 21st, 2021 • CMN Resolution No. 4,958, of October 21st, 2021 Itau Unibanco 63 1) Do not consider the amount of credits to be released. 2) Pursuant to Resolution 54, as of 01/01/2022, defaulted exposures operations correspond to those characterized as problematic assets, a concept defined in Resolution 4,557.