Exhibit 99.1

2Q 22 Risk and capital management Pillar 3 Second quarter of 2022

Contents Objective 1 Key indicators 1 Prudential Metrics and Risk Management 2 KM1: Key metrics at consolidated level 2 OVA: Bank risk management approach 3 Scope and main characteristics of risk management 3 Risk and Capital Governance 4 Risk Appetite 5 Risk Culture 5 Stress Testing 6 Recovery Plan 6 Capital Adequacy Assessment 7 Capital Adequacy 8 OV1: Overview of risk-weighted assets (RWA) 9 Links between financial statements and regulatory exposures 10 LIA: Explanations of differences between accounting and regulatory exposure amounts 10 LI1: Differences between accounting and regulatory scopes of consolidation and mapping of financial 11 statement categories with regulatory risk categories LI2: Main sources of differences between regulatory exposure amounts and carrying values in financial 12 statements PV1: Prudent valuation adjustments (PVA) 12 Institutions that comprise the Financial Statement of Itaú Unibanco Holding 13 Non Consolidated Institutions 17 Material Entities 17 Composition of Capital 18 CCA: Main features of regulatory capital instuments 18 CC1: Composition of regulatory capital 19 CC2: Reconciliation of regulatory capital to balance sheet 21 Macroprudential Indicators 22 CCyB1: Geographical distribution of credit risk exposures considered in the calculation of the 22 Countercyclical Capital Buffer GSIB1: Disclosure of G-SIB indicators 22 Leverage Ratio 22 LR1: Summary comparison of accounting assets vs leverage ratio exposure measure (RA) 23 LR2: Leverage ratio common disclosure 23 Liquidity Ratios 24 LIQA: Liquidity Risk Management Information 24 Framework and Treatment 24 LIQ1: Liquidity Coverage Ratio (LCR) 25 LIQ2: Net Stable Funding Ratio (NSFR) 26 Credit Risk 27 CRA: Qualitative information on credit risk management 27 CR1: Credit Quality of Assets 29 CR2: Changes in Stock of defaulted loans and debts securities 29 CRB: Additional disclosure related to the credit quality of assets Credit risk mitigation 30 Exposure by industry 30 Exposure by remaining maturity 31 Overdue exposures 31 Exposure by geographical area in Brazil and by country 32 Largest debtors exposures 32 Restructured exposures 33

CRC: Qualitative disclosure related to Credit Risk Mitigation techniques 33 CR3: Credit Risk mitigation techniques – overview 34 CR4: Standardized Approach – Credit Risk exposure and credit risk mitigation effects 34 CR5: Standardized Approach – exposures by asset classes and risk weights 35 Counterparty Credit Risk (CCR) 35 CCRA: Qualitative disclosure related to CCR 35 CCR1: Analysis of CCR exposures by approach 36 CCR3: Standardized approach – CCR exposures by regulatory portfolio and risk weights 36 CCR5: Composition of collateral for CCR exposures 36 CCR6: CCR associated with credit derivatives exposures 37 CCR8: CCR associated with Exposures to central counterparties 37 Securitization Exposures 37 SECA: Qualitative disclosure requirements related to securitisation exposures 37 SEC1: Securitisation exposures in the banking book 38 SEC2: Securitisation exposures in the trading book 38 SEC3: Securitisation exposures in the banking book and associated regulatory capital requirements – 38 bank acting as originator or as sponsor SEC4: Securitisation exposures in the banking book and associated capital requirements – bank acting 38 as investor Market Risk 39 MRA: Qualitative disclosure requirements related to market risk 39 MR1: Market risk under standardized approach 41 MRB: Qualitative disclosures on market risk in the Internal Models Approach (IMA) 41 MR2: RWA flow statements of market risk exposures under an IMA 44 Exposures subject to market risk 44 MR3: IMA values for trading portfolios 44 MR4: Comparison of VaR estimates with gains/losses 45 Backtesting 45 Total Exposure associated with Derivatives 46 IRRBB 46 IRRBBA: IRRBB risk management objectives and policies 46 Framework and Treatment 46 Other Risks 48 Insurance products, pension plans and premium bonds risks 48 Social, Environmental and Climatic Risks 48 Model Risk 49 Regulatory or Compliance Risk 50 Reputational Risk 50 Country Risk 52 Business and Strategy Risk 52 Contagion Risk 52 Emerging Risks 53 Operational Risk 53 Crisis Management and Business Continuity 54 Independent Validation of Risk Models 55 Glossary of Acronyms 56 Glossary of Regulations 61

Risk and Capital Management—Pillar 3 Objective This document presents Itaú Unibanco Holding S.A. (Itaú Unibanco) information required by the Central Bank of Brazil (BACEN) through Resolution BCB nº 54 and subsequent amendments, which addresses the disclosure of information on risks and capital management, the comparison between accounting and prudential information, the liquidity and market risk indicators, the calculation of risk-weighted assets (RWA), the calculation of the Total Capital (“Patrimônio de Referência”—PR), and the compensation of management members. 1 The referred Resolution brought several amendments in the disclosure format of the Pillar 3 information, besides changes in the scope and frequency of the information disclosed. All these amendments, implemented by the Central Bank, aim the convergence of the Brazilian financial regulation to the recommendations of the Basel Committee, seeking to harmonize the information disclosed by financial institutions at an international level, and taking into account the structural conditions of the Brazilian economy. The disclosure policy of the Risk and Capital Management Report presents the guidelines and responsibilities of the areas involved in its preparation, as well as the description of the information that must be disclosed and the integrity endorsement and approval governance, as established by the article 56 of the Resolution nº. 4,557. Key indicators Itaú Unibanco’s risk and capital management focuses on maintaining the institution in line with the risk strategy approved by the Board of Directors. The key indicators based on the Prudential Consolidation, on June 30, 2022, are summarized below. 11.1% 12.6% 14.1% March 31 2022 11.1% March 31 2022 12.596 March 31 2022 13.99’ ln R$ million ln RS million R$ 133,651 R$ 151,245 R$ 168,956 March 31 2022 R 129 053 March 31 2022 R 145 402 March 31 2022 R 162 203 ln R$ m11tion R$ 1,201,628 March 31, 2022 RS 1,164,324 12.5% 0.5% -0.3% -0.1% -0.1% 0.1% ~ 11.1% r1er1 Net lnc~inthequarterand Risk•Weight,dAssets’ Pnidential andEqulty Ptrchase andSale eqt.ity AddltioralTierlC.pl al(AT1) nerl Mar-22 kitereston o...n Capital Adjustments i“lterest in XP lnc. Jun-22 Common Equity Tier 1(CET 1)—AddítíonalTier l (ATl) (1} Excluding the exchange rate variation for the period. 1 Compensation of management members data is reported annually. Itaú Unibanco 1

Risk and Capital Management—Pillar 3 Prudential Metrics and Risk Management Itaú Unibanco invests in robust and company-wide risk management processes to serve as a basis for its strategic decisions intended to ensure business sustainability. The key prudential metrics related to regulatory capital and information on the bank’s integrated risk management are presented below. KM1: Key metrics at consolidated level In order to ensure the soundness of Itaú Unibanco and the availability of capital to support business growth, Itaú Unibanco maintains capital levels above the minimum requirements, as demonstrated by the Common Equity Tier I, Additional Tier I Capital and Total CapitaI ratios. On June 30, 2022, the Total Capital (PR) reached R$ 168,956 million, R$ 151,245 million of Tier I and R$ 17,711 million of Tier II. R$ million 06/30/2022 03/31/2022 12/31/2021 09/30/2021 06/30/2021 Available capital (amounts) Common Equity Tier 1 (CET1) 133,651 129,053 130,716 123,547 124,964 Tier 1 151,245 145,402 149,912 141,409 141,674 Total capital 168,956 162,203 169,797 161,099 156,561 Excess of capital committed to ajusted permanent asseis Total capital detached Risk-weighted assets (amounts) Total risk-weighted asseis (RWA) 1,201,628 1,164,324 1,153,841 1,095,194 1,048,628 Risk-based capital ratios as a percentage of RWA Common Equity Tier 1 ratio (%) 11.1% 11.1% 11.3% 11.3% 11.9% Tier 1 ratio (%) 12.6% 12.5% 13.0% 12.9% 13.5% Total capital ratio (%) 14.1% 13.9% 14.7% 14.7% 14.9% Additional CET1 buffer requirements as a percentage of RWA Capital conservation butter requirement (%) (1) (‘l 2.5% 2.0% 2.0% 1.625% 1.625% 2 Countercyclical butter requirement (%) (2)( l Bank G-SIB and/or D-SIB additional requirements (%) 1.0% 1.0% 1.0% 1.0% 1.0% Total of bank CET1 specific buffer requirements (%) (3) (3l 3.5% 3.0% 3.0% 2.625% 2.625% CET1 available after meeting lhe bank’s minimum capital requirements (%) 2.6% 2.9% 3.5% 4.0% 4.2% Basel 111 leverage ratio Total Basel 111 leverage ratio exposure measure 2,102,773 2,015,946 2,018,692 1,969,517 1,883,388 Basel 111 leverage ratio (%) 7.2% 7.2% 7.4% 7.2% 7.5% Liquidity Coverage Ratio Total high-quality liquid asseis (HQLA) 279,847 293,573 307,280 315,791 324,440 Total net cash outflow 192,124 196,328 193,093 184,568 179,322 LCR (%) 145.7% 149.5% 159.1% 171.1% 180.9% Net Stable Funding Ratio Total available stable funding 1,070,719 1,021,581 1,016,989 978,802 949,811 Total required stable funding 894,427 852,481 839,830 811,430 774,165 NSFR(%) 119.7% 119.8% 121.1% 120.6% 122.7% 1) For purposes of calculating lhe Conservation capital buffer, BACEN Resolution 4,958 establishes, for defined periods, percentages to be applied to lhe RWA value with a gradual increase until April/22, when it reaches 2.5%. 2) The countercyclical capital butter is fixed by lhe Financial Stability Committee (Comef) based on discussions about lhe pace of credit expansion (BACEN Communication No. 38, 702/22), and currenlly is sei to zero. Should lhe requirement increase, lhe new percentage takes effect twelve months after lhe announcement. 3) The BACEN rules establish Capital Butters, lha! corresponds to lhe sum of lhe Conservation, Contracyclical and Systemic requirements, as defined in CMN Resolution 4,958. Itaú Unibanco 2

Risk and Capital Management—Pillar 3 The Basel Ratio reached 14.1%, as of June 30, 2022, an increase of 20 basis points compared to 13.9% as of March 31, 2022, due to the result for the period, partially offset by the increase of the credit Risk-weighted Assets (RWAcpad), prudential adjustments and acquisition of XP Inc. shares. Besides, Itaú Unibanco has a R$ 72,826 million capital excess in relation to its minimum required Total Capital. It corresponds to 6,1 pp above the minimum requirement (8%) and higher than the Capital Buffer requirement of 3.5% (R$ 42,057 million). Considering the Capital Buffers, the capital excess would be 2,6 pp. The fixed assets ratio shows the commitment percentage of adjusted Referential Equity with the adjusted permanent assets. Itaú Unibanco falls within the maximum limit of 50% of adjusted PR, established by BACEN. On June 30, 2022, fixed assets ratio reached 19.0%, showing a surplus of R$ 52,441 million. OVA – Bank risk management approach Scope and main characteristics of risk management To undertake and manage risks is one of the activities of Itaú Unibanco. For this reason, the institution must have clearly established risk management objectives. In this context, the risk appetite defines the nature and the level of risks acceptable for the institution, while the risk culture guides the attitudes required to manage them. Itaú Unibanco invests in robust risk management processes, that are the basis for its strategic decisions to ensure business sustainability and maximize shareholder value creation. These processes are in line with the guidelines of the Board of Directors and Executives who, through corporate bodies, define the institution’s global objectives, which are then translated into targets and thresholds for the business units that manage risks. Control and capital management units, in turn, support Itaú Unibanco’s management through the processes of analysis and monitoring of capital and risk. The principles that provide the risk management and the risk appetite foundations, as well as guidelines regarding the actions taken by Itaú Unibanco’s employees in their daily routines are as follows: • Sustainability and customer satisfaction: the vision of Itaú Unibanco is to be a leading bank in sustainable performance and customer satisfaction. For this reason, the institution is concerned about creating shared values for employees, customers, shareholders and society to ensure the longevity of the business. Itaú Unibanco is concerned about doing business that is good for customers and for the institution; • Risk culture: the institution’s risk culture goes beyond policies, procedures and processes. It strengths the individual and collective responsibility of all employees to manage and mitigate risks consciously, respecting the ethic way of doing business. The risk culture is described in the item “Risk Culture”; • Risk Pricing: Itaú Unibanco operates and assumes risks in business that it knows and understands, avoids the ones that are unknown or that do not provide competitive advantages, and carefully assesses risk-return ratios; • Diversification: the institution has low appetite for volatility in its results. Accordingly, it operates with a diversified base of customers, products and business, seeking risk diversification and giving priority to low-risk transactions; • Operational excellence: Itaú Unibanco intends to provide agility, as well as a robust and stable infrastructure, in order to offer high quality services; Itaú Unibanco 3

Risk and Capital Management—Pillar 3 • Ethics and respect for regulations: at Itaú Unibanco, ethics is non-negotiable. For this reason, the institution promotes an institutional environment of integrity, educating its employees to cultivate ethical relationships and businesses, as well as respecting the norms, and therefore looking after the institution’s reputation. Since August, 2017, the Resolution CMN 4,557 came into force, which established the structure of risk and capital management. The resolution highlights are the implementation of a continuous and integrated risk management framework; the requirements for the definition of the Risk Appetite Statement (RAS) and the stress test program; the establishment of a Risk Committee; the indication, before BACEN, of the Chief Risk Officer (CRO); and the CRO’s roles, responsibilities and independence requirements. Risk and Capital Governance The Board of Directors is the main body responsible for establishing the guidelines, policies and authority levels regarding risk and capital management. In turn, the Risk and Capital Management Committee (CGRC) provides support to the Board of Directors in the performance of their duties relating to risk and capital management. At the executive level, corporate bodies headed by Itaú Unibanco’s Chief Executive Officer (CEO) are established to manage risks and capital. Their decisions are overseen by the CGRC. Additionally, the Itaú Unibanco Holding has corporate bodies that perform delegated duties in the risk and capital management, under the responsibility of CRO (Chief Risk Officer). To support this structure, the Risk Area is structured with specialized departments. The objective is to provide independent and centralized management of the institution’s risks and capital, and to ensure the accordance with the established rules and procedures. Itaú Unibanco’s risk management organizational structure complies with Brazilian and international regulations in place and is aligned with the market’s best practices, including governance for identifying emerging risks, which are those with medium and long-term impact potentially material about the business. Responsibilities for risk management at Itaú Unibanco are structured according to the concept of three lines of defense, namely: • in the first line of defense, the business and corporate support areas manage risks they give rise to, by identifying, assessing, controlling and reporting such risks; • in the second line of defense, an independent unit provides central control, so as to ensure that Itaú Unibanco’s risk is managed according to the risk appetite and established policies and procedures. This centralized control provides the Board and executives with a global overview of Itaú Unibanco’s exposure, to ensure correct and timely corporate decisions; • in the third line of defense, internal audit provides an independent assessment of the institution’s activities, so that senior management can see that controls are adequate, risk management is effective and institutional standards and regulatory requirements are being complied with. Itaú Unibanco uses robust automated systems for full compliance with capital regulations, as well as for measuring risks in accordance with the regulatory determinations and models in place. It also monitors adherence to the qualitative and quantitative regulators’ minimum capital and risk management requirements. Itaú Unibanco 4

Risk and Capital Management—Pillar 3 Risk Appetite Itaú Unibanco has a risk appetite policy, which was established and approved by the Board of Directors and guides the institution’s business strategy. The bank’s risk appetite is grounded on the following declaration of the Board of Directors: “We are a universal bank, operating predominantly in Latin America. Supported by our risk culture, we operate based on rigorous ethical and regulatory compliance standards, seeking high and growing results, with low volatility, by means of the long-lasting relationship with clients, correctly pricing risks, well-distributed fund-raising and proper use of capital.” Based on this declaration, the bank established five dimensions, each of which comprising a set of metrics associated with the key risks involved, combining complementary measurements and seeking a comprehensive view of its exposure: • Capitalization: establishes that Itaú Unibanco should have sufficient capital to protect itself against a serious recession or stress events without the need to adjust its capital structure under adverse circumstances. It is monitored by following up the bank’s capital ratios, in usual or stress situations, and the institution’s debt issue ratings. • Liquidity: establishes that the institution’s liquidity should be able to support long stress periods. It is monitored by following up on liquidity ratios. • Composition of results: establishes that business will mainly focus on Latin America, where Itaú Unibanco will have a diversified range of customers and products, with low appetite for results volatility and high risk. This dimension includes business and profitability, as well as market and credit risks aspects. The metrics monitored by the bank seek to ensure, by means of exposure concentration limits such as, for example, industry sectors, quality of counterparties, countries and geographic regions and risk factors, a suitable composition of the bank’s portfolios, aiming at low volatility of results and business sustainability. • Operational risk: focuses on controlling operational risk events that may adversely impact the bank’s business strategy and operations. This control is carried out by monitoring key operational risk events and incurred losses. • Reputation: deals with risks that may impact brand value and the institution’s reputation before its customers, employees, regulators, investors and the general public. In this dimension, risks are monitored by following up on customers’ satisfaction or dissatisfaction, media exposure and observation of the institution’s conduct. The Board of Directors is responsible for approving risk appetite guidelines and limits, performing its activities with the support of the Risk and Capital Management Committee (CGRC) and the Chief Risk Officer (CRO). Metrics are regularly monitored and must comply with the limits defined. The monitoring is reported to the risk commissions and to the Board of Directors, guiding the use of preventive measures to ensure that exposures are within the limits provided and in line with the bank’s strategy. Risk Culture Aiming at strengthening its values and aligning the behavior of its employees with risk management guidelines, the institution adopts several initiatives to disseminate and strengthen a culture that values and encourages conscious risk taking, discussions and actions on the institution’s risks, and each and everyone’s responsibility for risk management. Besides the risk management policies, procedures and processes, the institution has as a central element of its Corporate Culture the message “Ethics is non-negotiable”. Behavioral guidelines, also described in this culture, Itaú Unibanco 5

Risk and Capital Management—Pillar 3 reinforce and strengthen the Conglomerate’s risk management behavior by emphasizing a behavior that helps people of all company levels to undertake and manage risks in a conscious way. By disseminating these principles, the institution fosters the understanding and the open discussion about risks, so that they are kept within the risk appetite levels established and each employee individually, regardless of their position, area or duties, may also assume responsibility for managing the risks of the business. Itaú Unibanco also makes some channels available for communication of operating failures, internal or external fraud, conflicts at the workplace, or cases that may result in inconveniences and/or losses for the institution or its customers. All employees or third parties are responsible for informing any problems immediately, as soon as they become aware of the situation. Stress Testing The stress test is a process of simulating extreme economic and market conditions on Itaú Unibanco’s results, liquidity and capital. The institution has been carrying out this test in order to assess its solvency in plausible scenarios of crisis, as well as to identify areas that are more susceptible to the impact of stress that may be the subject of risk mitigation. For the purposes of the test, the economic research area estimates macroeconomic variables for each stress scenario. The elaboration of stress scenarios considers the qualitative analysis of the Brazilian and the global conjuncture, historical and hypothetical elements, short and long term risks, among other aspects, as defined in CMN Resolution 4,557. In this process, the main potential risks to the economy are assessed based on the judgment of the bank’s team of economists, endorsed by the Chief Economist of Itaú Unibanco and approved by the Board of Directors. Projections for the macroeconomic variables (such as GDP, the basic interest rate and inflation) and for variables in the credit market (such as raisings, lending, rates of default, margins and charges) used are based on exogenous shocks or through use of models validated by an independent area. Then, the stress scenarios adopted are used to influence the budgeted result and balance sheet. In addition to the scenario analysis methodology, sensitivity analysis and the Reverse Stress Test are also used. Itaú Unibanco uses the simulations to manage its portfolio risks, considering Brazil (segregated into wholesale and retail) and External Units, from which the risk-weighted assets and the capital and liquidity ratios are derived. The stress test is also an integral part of the ICAAP (Internal Capital Adequacy Process), the main purpose of which is to assess whether, even in severely adverse situations, the institution would have adequate levels of capital and liquidity, without any impact on the development of its activities. This information enables potential offenders to the business to be identified and provides support for the strategic decisions of the Board of Directors, the budgeting and risk management process, as well as serving as an input for the institution’s risk appetite metrics. Recovery Plan In response to the latest international crises, the Central Bank issued the Resolution No. 4,502, which requires the development of a Recovery Plan for the financial institutions that are classified in the Segment 1, with a total exposure of more than 10% of Gross Domestic Product (GDP). This plan aims to reestablish adequate levels of capital and liquidity, above the regulatory requirements, through appropriate strategies in the event of severe stress shocks of a systemic or idiosyncratic nature. Accordingly, each institution would be able to preserve its financial feasibility and, at the same time, mitigate the impact on the National Financial System. Itaú Unibanco 6

Risk and Capital Management—Pillar 3 Itaú Unibanco has a Recovery Plan that contemplates the entire Conglomerate, including foreign subsidiaries, and contains the description of the following items: I. Critical functions rendered by Itaú Unibanco to the market, activities that, if abruptly interrupted, could impact the National Financial System (SFN) and the functioning of the real economy; II. Institution’s essential services: activities, operations or services which discontinuity could compromise the bank’s viability; III. Monthly monitoring program, establishing critical levels for a set of indicators, with a view to risk monitoring and eventual trigger for the execution of the Recovery Plan; IV. Stress scenarios, contemplating events that may threaten the business continuity and the viability of the institution, including reverse tests, which seek to identify remote risk scenarios, contributing to an increase of the management sensitivity; V. Recovery strategies in response to different stress scenarios, including the main risks and barriers, as well as the mitigators of the latter and the procedures for the operationalization of each strategy; VI. Communication plan with stakeholders, seeking its timely execution with the market, regulators and other stakeholders; VII. Governance mechanisms necessary for the coordination and execution of the Recovery Plan, such as the definition of the director responsible for the exercise at Itaú Unibanco. This plan is reviewed annually and is subjected to the approval of the Board of Directors. With this practice, Itaú Unibanco has been able to continuously demonstrate, that even in severe scenarios, with remote probability of occurrence, it has strategies capable of generating sufficient resources to ensure the sustainable maintenance of critical activities and essential services, without losses to customers, to the financial system and to other participants in the markets in which it operates. Itaú Unibanco ensures the exercise maintenance to guarantee that strategies remain up-to-date and viable in the face of organizational, competitive or systemic changes. Capital Adequacy Assessment For its capital adequacy assessment process, the annual Itaú Unibanco’s procedure is as follows: • Identification of material risks and assessment of the need for additional capital; • Preparation of the capital plan, both in normality and stress situations; • Internal assessment of capital adequacy; • Structuring of capital contingency and recovery plans; • Preparation of management and regulatory reports. Itaú Unibanco 7

Risk and Capital Management—Pillar 3 By adopting a prospective stance regarding capital management, Itaú Unibanco implemented its capital management structure and its ICAAP in order to comply with National Monetary Council (CMN) Resolution 4,557, BACEN Circular 3,846 and BACEN Circular Letter 3,907. The result of the last ICAAP, which includes stress tests – dated as of December 2021 – showed that, in addition to having enough capital to face all material risks, Itaú Unibanco has a significant buffer, thus ensuring the soundness of its equity position. Capital Adequacy Itaú Unibanco, through the ICAAP process, assesses the adequacy of its capital to face the incurred risks, composed by regulatory capital for credit, market and operational risks and by the necessary capital to face other risks. In order to ensure the soundness and the availability of Itaú Unibanco’s capital to support business growth, the Total Capital levels were maintained above the minimum requirements. Itaú Unibanco 8

Risk and Capital Management—Pillar 3 OV1 – Overview of risk-weighted assets (RWA) According to CMN Resolution 4,958 and subsequent amendments, for assessing the minimum capital requirements, the RWA must be calculated by adding the following risk exposures: RWA = RWACPAD + RWAMINT + RWAOPAD • RWACPAD = portion related to exposures to credit risk, calculated using standardized approach; • RWAMINT = portion related to the market risk capital requirement, made up of the maximum between the internal model and 80% of the standardized model, and regulated by BACEN Circulars 3,646 and 3,674; • RWAOPAD = portion related to the operational risk capital requirement, calculated using standardized approach. Minimum capital RWA requirements RS mllllon 06/30/2022 03/31/2022 06/30/2022 Credit Risk: standardised approach 1,085,024 1,045,152 86,802 Credit risk (excluding counterparty credit risk) 972,773 924,394 77,821 Counterparty credit risk (CCR) 41,515 44,278 3,321 Of which: standardised approach for counterparty credit risk (SA-CCR) 27,959 29,142 2,237 Of which: Current Exposure Method approach (CEM) Of which: other CCR 13,556 15,136 1,084 Credit valuation adjustment (CVA) 8,058 7,964 645 Equity investments in funds—look-through approach 5,338 4,931 427 Equity investments in funds—mandate-based approach 196 249 16 Equity investments in funds—fall-back approach 1,504 1,886 120 Securitisation exposures—standardised approach 3,271 2,892 262 Amounts below the thresholds for deductlon 52,369 58,558 4,190 Market risk 23,205 25,773 1,856 Of which: standardised approach 29,006 32,216 2,320 Ofwhich: internai models approach (IMA) 21,772 19,013 1,742 Operational risk 93,399 93,399 7,472 Total 1,201,628 1,164,324 96,130 The higher amount of RWA was mainly due to the increase in the credit risk (RWACPAD). Itaú Unibanco 9

Risk and Capital Management—Pillar 3 Links between financial statements and regulatory exposures LIA: Explanations of differences between accounting and regulatory exposure amounts The main difference between the accounting carrying value and the amounts considered for regulatory purposes is the non-consolidation of non-financial companies (especially Insurance, Pension Plan and Capitalization companies) in the regulatory consolidated, a difference that also impacts the elimination of related parties transactions. Within the regulatory scope, the procedures for assessing the need for prudent valuation adjustments (PVAs) arising from the pricing of financial instruments, as well as the description of the systems and controls used to ensure its reliability are described below. The pricing methodology for the financial instruments subject to Resolution No. 4,277, of October 31st, 2013, conducted by an independent area from the business areas, considers, in addition to benchmarks, the risks listed in the closeout uncertainty, market concentration, early termination, model risk, investing and funding costs, unearned credit spread and others. The fair value measurement at Itaú Unibanco follows the principles enclosed in the main regulatory bodies, such as CVM and BACEN. The institution follows the best practices in terms of pricing policies, procedures and methodologies and is committed to secure the pricing of financial instruments in its balance sheet with prices quoted and disclosed by the market, and in the impossibility of doing so, expends its best efforts to estimate which would be the fair price at which financial assets would be effectively traded, maximizing the use of relevant observable data and, under specific conditions, these instruments can be valued on a model basis. In all of these situations, the organization has control over its pricing methods and model risk management. The process of independent price verification (IPV) follows the guidelines included in Resolution No. 4,277, with daily verification of prices and market inputs, which is performed by a team independent from the pricing team. This process is also subject to an independent evaluation by the internal control, internal audit and external audit teams. The institution has a hybrid model for assessing the need for prudent valuation adjustments with two components. The first component is a timely assessment model that assesses new products, operations and risk factors traded and verifies the compliance and liability with any components of the existing prudent valuation adjustments. The second is a periodic assessment that aims to analyze the existing prudent valuation adjustments in relation to adequate pricing. The process and methodology are evaluated periodically and independently by internal controls and internal audit. In the line Other Differences of the table LI2, are reported the transactions subject to credit risk and counterparty credit risk, which are not accounted for in the balance sheet or in the off-balance sheet amounts. Itaú Unibanco 10

Risk and Capital Management—Pillar 3 LI1: Differences between accounting and regulatory scopes of consolidation and mapping of financial statement categories with regulatory risk categories R$ mllllon, ai Ih& &nd oi Ih& eerlod 0613012022 Carrying values of items: Carrying values Nol subj&ctto as reported in Canying values Subjectto capital under scope of Subjectto Subject to the Subject to the publlsh&d regulatory counterparty requirements or financial credit risk securitisation market risk credit risk subjectto consolidation framework framework framework statements framework deduction from capital Assets Current assets and Long-term receivables 2,258,532 2,012,426 1,613,189 344,929 12,941 220,718 36,600 Cash 33,839 33,729 33,729 4,975 lnterbank investments 237,053 235,370 64,810 170,560 15,210 Securities and derivative financial instruments 773,742 547,304 450,606 77,893 12,941 22,581 1,097 lnterbank accounts 168,976 168,975 153,631 15,344 lnterbranch accounts Loan, lease and other credit operations 813,701 803,844 795,464 66,733 8,380 Other receivables 227,013 219,339 111,084 96,476 111,219 11,779 Oeferred tax assets 59,239 47,525 11,714 Sundry 160,100 63,559 96,476 111,219 65 Other assets 4,208 3,865 3,865 Permanent assets 35,944 50,170 31,880 18,290 lnvestments 12,641 27,725 25,823 1,902 Real estai& 6,475 5,972 5,972 Goodwill and lntangible assets 16,828 16,473 85 16,388 Goodwill 2,196 2,196 lntangible assets 14,192 14,192 Other 85 85 Total assets 2,294,476 2,062,596 1,645,069 344,929 12,941 220,718 54,890 Llabilities Current and Long-term Liabilities 2,133,802 1,901,082 294,967 239,074 1,606,115 Deposits 828,693 836,630 54,658 836,630 Oeposits received under securities repurchase 262,566 262,566 252,484 12 10,082 agreements Funds from acceptances and issuance of securities 205,431 205,431 23,164 205,431 lnterbank accounts 81,036 81,036 81,036 lnterbranch accounts 14,168 14,171 159 14,171 Borrowings and onlending 120,012 120,012 19,858 120,012 Oerivative financial instruments 75,087 75,084 42,483 11,815 32,601 Technical provision for insurance, pension plan and 224,405 capitalization Provisions 16,906 16,538 16,538 Allowance for financial guarantees provided and loan 5,993 5,993 5,993 commitments Other liabilities 299,505 283,621 129,408 283,621 Deferred tax liabilities 5,636 5,636 Sundry 277,985 129,408 277,985 Total liabilities 2,133,802 1,901,082 294,967 239,074 1,606,115 Itaú Unibanco 11

Risk and Capital Management—Pillar 3 LI2: Main sources of differences between regulatory exposure amounts and carrying values in financial statements R$ m/11/on 06/30/2022 Carrying values of items: Subject to Subject to Subject to lhe Subject to lhe Total c ounterparty credit risk securitisation market risk credit risk framework framework framework framework Assei carrying value amount under scope of regulatory consolidation 2,007,706 1,645,069 344,929 12,941 220,718 Liabilities carrying value amount under regulatory scope of consolidation 294,967 294,967 239,074 Total net amount under regulatory scope of consolidation 1,712,739 1,645,069 49,962 12,941 (18,356) Off-balance sheet amounts 177,376 149,341 28,035 Differences in valuations Other differences 87,519 (11,761) 99,280 Exposure amounts considered for regulatory purposes 1,977,634 1,782,649 177,277 12,941 (18,356) PV1: Prudent valuation adjustments (PVA) ln R$ million 06/30/2022 Ofwhich: ln Of which: ln lnterest Equity FX Credit Commodities Total lhe trading the banking rates book book Closeout uncertainty, of which: 40 40 2 38 C/oseout cost 39 39 2 37 Concentration Early termination 77 78 155 2 153 Model risk 31 70 101 3 98 Operational risk lnvesting and funding costs Uneamed credit spreads Future administrative costs Other Total adjustment 108 188 296 7 289 Itaú Unibanco 12

Risk and Capital Management—Pillar 3 Institutions that comprise the Financial Statements of Itaú Unibanco Holding The lists below provide the institutions that comprise the financial statements and the Prudential Consolidation of Itaú Unibanco Holding S.A.. Country 111 lnstitutions that comprise the financial statements and the Prudential Consolidation ³⁄₄ Equity share on capital A 1 Hedge Orange Master Fundo de Investimento Multimercado Brazil 100.00% Aj Títulos Públicos Fundo de Investimento Renda Fixa Referenciado OI Brazil 100.00% Banco lnvestcred Unibanco S.A. Brazil 50.00% Banco ltaú (Suisse) S.A. Switze~and 100.00% Banco ltaú Argentina S.A. Argentina 100.00% Banco ltaú BBA S.A. Brazil 100.0 0% Banco ltaú Consignado S.A. Brazil 100.00% Banco ltaú lnternational United States 100.00% Banco ltaú Paraguay S.A. Paraguay 100.00% Banco ltaú Uruguay S/A Uruguay 100.00% Banco ltaú Veículos S.A. Brazil 10000% Banco ltauBank S.A. Brazil 100.0 0% Banco ltaucard S.A. Brazil 100.00% Cloudwalk Kick Ass I Fundo De Investimento Em Direitos Creditórios Brazil 95.05% Dibens Leasing S.A. -Arrendamento Mercantil Brazil 100.00% FIDC B2cycle NPL Brazil 100.00% FIDC Cloudw Akira 1 Brazil 96.98% FIDC Sumup Solo Brazil 94.98% FII Kinea Desenv. LO Brazil 100.00% Financeira ltaú CBD S.A. Crédito, Financiamento e Investimento Brazil 50.00% Fundo A 1 Hedge Orange Fundo de Investimento em Cotas de Fundos de Investimento Multimercado Brazil 100.00% Fundo De lnvest Dir Creditórios Nao Padron NPL li Brazil 100.00% Fundo de Investimento em Direitos Creditórios Nao-PadroniZados Barzel Brazil 100.00% Fundo de Investimento em Direitos Creditórios Rede Brazil 100.00% Fundo em Direitos Creditórios Cielo Emissores 1 Brazil 88.36% Fundo Fortaleza de Investimento Imobiliário Brazil 100.00% Fundo Goal Perto Ili Argentina 100.00% Fundo Kinea Ações Brazil 100.00% Hipercard Banco Múltiplo S.A. Brazil 100.00% lntrag Distribuidora de Títulos e Valores Mobiliários Ltda Brazil 10000% !resolve Companhia Securitizadora de Créditos Financeiros S.A. Brazil 100.00% ltaú (Panamá) S.A. Panama 55.66% ltaú Administradora de Consórcios Ltda. Brazil 100.00% ltaú Asset Management Colombia S.A. Sociedad Fiduciaria Colombia 55.64% ltaú Bank & Trust Bahamas Ltd. Bahamas 10000% ltaú Bank & Trust Cayman Ltd. Cayman lslands 100.00% ltaú Bank, Ltd. Cayman lslands 100.00% ltaú BBA Europe S.A. Portugal 100.00% ltaú BBA lnternational Pie. Brazil 100.00% ltaú BBA Tradtng S.A. Brazil 100.00% ltaú BBA USA Securities lnc. United States 100.00% ltaú Cia. Securitizadora de Créditos Financeiros Brazil 100.00% ltaú Comisionista de Bolsa Colombia S.A. Colombia 55.6 6% ltaú CorpBanca Chile 55.96% 1) The institutions operate in their respective countries of origin. Itaú Unibanco 13

Risk and Capital Management—Pillar 3 Country I1I lnstilutions lhal comprise lhe financial stalements and lhe Prudenlial Consolidation % Equity share on capital ltaú CorpBanca Colombia SA Colombia 55.66% ltaú CorpBanca New York Branch United States 55.96% ltaú Corredores de Bolsa Limitada Chile 55.96% ltaú Corretora de Valores S.A. Brazil 100.00% ltaú Distribuidora de Títulos e Valores Mobiliários S.A Brazil 100.00% ltaú EU Lux-ltaú Latin America Equity Fund Luxembourg 70.20% ltaú lnternational Securitíes lnc. United States 100.00% ltaú lnvest Casa de Bolsa SA Paraguay 100.00% ltaú Kinea Private Equity Multimercado Fundo de Investimento em Cotas de Fundos de Investimento Crédito Privado Brazil 100.00% ltaú OT Títulos Públicos Renda Fixa Referenciado OI Fundo de Investimento em Cotas de Fundos de Investimento Brazil 0.02% ltaú Securitíes Services Colombia S.A. Sociedad Fiduciaria Colombia 55.67% ltaú Unibanco Holding S.A. Brazil 100.00% ltaú Unibanco Holding S.A., Grand Cayman Branch Cayman lslands 100.00% ltaú Unibanco S.A. Brazil 100.00% ltaú Unibanco S.A., Grand Cayman Branch Cayman lslands 100.00% ltaú Unibanco SA , Miami Branch United States 100.00% ltaú Unibanco S.A., Nassau Branch Bahamas 100.00% ltaú Unibanco Veículos Administradora de Consórcios Ltda. Brazil 100.00% ltaú Valores S.A. Argentina 100.00% 1TB Holding Ltd. Cayman lslands 100.00% Kinea Ações Fundo de Investimento em Ações Brazil 100.00% Kinea CO-investimento Fundo de Investimento lmobiliario Brazil 99.90% Kinea I Private Equity FIP Multiestrategia Brazil 99.64% Kinea KP Fundo de Investimento Multimercado Crédito Privado Brazil 100.00% Kinea Ventures FIP Brazil 100.00% Licania Fund Limited Cayman lslands 100.00% Luizacred SA Sociedade de Crédito, Financiamento e Investimento Brazil 50.00% Microinvest S.A. Soe. de Crédito a Microempreendedor Brazil 100.00% OCA Dinero Electrónico SA Uruguay 100.00% OCASA Uruguay 100.00% Oiti Fundo de Investimento Multimercado Crédito Privado Investimento no Exterior Brazil 100.00% Redecard lnstituiçao de Pagamento S.A. Brazil 100.00% Redecard Sociedade de Crédito Direto S.A Brazil 100.00% RT ltaú DJ Títulos Públicos Fundo de Investimento Renda Fixa Referenciado OI Brazil 100.00% RT Scala Renda Fixa—Fundo de Investimento em Cotas de Fundos de Investimento Brazil 100.00% RT Voyager Renda Fixa Crédito Privado—Fundo de Investimento Brazil 100.00% Ta ruma Fundo Incentivado de Investimento em Debêntures de Infraestrutura Renda Fixa Crédito Privado Brazil 100.00% 1) The institutions operate in their respective countríes oi origin. Itaú Unibanco 14

Risk and Capital Management—Pillar 3 Institutions that comprise the Financial Statements of Itaú Unibanco Holding Country I1I lnstitutions that comprise only the Financial Statements ³⁄₄ Equity share on capital Aj li Títulos Públicos Fundo de Investimento Renda Fixa Referenciado OI Brazil 57.97% Albarus S.A. Paraguay 100.00% Ank Platform S.A. Argentina 100.00% BICSA Holdings, Ltd. Cayman lslands 100.00% Borsen Renda Fixa Crédito Privado—Fundo de Investimento Brazil 100.00% CGB li SPA Chile 100.00% CGB Ili SPA Chile 100.00% Cia. ltaú de Capitalizaçao Brazil 100.00% Estrel Serviços Administrativos S.A. Brazil 100.00% FC Recovery S.A.U. Argentina 100.00% FIC Promotora de Vendas Lida. Brazil 50.00% iCarros Lida. Brazil 100.00% IGA Participações S.A. Brazil 100.00% Investimentos Bemge S.A. Brazil 86.81% ltaú Administradora General de Fondos S.A. Chile 55.96% ltaú Asesorías Financieras Limitada Chile 55.96% ltaú Asia Limited Hong Kong 100.00% ltaú Assei Management Administradora de Fondos Patrimoniales de lnversión S.A. Paraguay 100.00% ltaú Assei Management S.A. Sociedad Gerente de Fondos Comunes de lnversión Argentina 100.00% ltaú Bahamas Directors Ltd. Bahamas 100.00% ltaú Bahamas Nominees Ltd. Bahamas 100.00% ltaú BBA lnternational (Cayman) Ltd. Cayman lslands 100.00% 21 Uruguay ltaú BBA México, S.A. de C.V. ( 100.00% ltaú Chile lnversiones, Servicios y Administracion S.A. Chile 100.00% ltaú Consultoria de Valores Mobiliários e Participações S.A. Brazil 100.00% ltaú Corredor de Seguros Colombia S.A. Colombia 100.00% ltaú Corredores de Seguros S.A. Chile 55.96% ltaú Corretora de Seguros S.A. Brazil 100.00% ltaú Gestão de Vendas Lida. Brazil 100.00% ltaú Holding Colombia S.A.S. Colombia 55.96% ltaú Institucional Renda Fixa Fundo de Investimento Brazil 100.00% ltaú lnternational Holding Limited United Kingdom 100.00% ltaú Rent Administraçao e Participações Lida. Brazil 100.00% ltaú Seguros Paraguay S.A. Paraguay 100.00% ltaú Seguros S.A. Brazil 100.00% ltaú Unibanco Assei Management Lida. Brazil 100.00% ltau Unibanco Comercializadora de Energia Lida. Brazil 100.00% ltaú USA Assei Management lnc. United States 100.00% ltaú Vida e Previdência S.A. Brazil 100.00% ltauseg Participações S.A. Brazil 100.00% ltauseg Saúde S.A. Brazil 100.00% 1 TB Holding Brasil Participações Lida. Brazil 100.00% IU Corretora de Seguros Lida. Brazil 100.00% IUPP S.A. Brazil 100.00% Karen lnternational Limited Bahamas 100.00% Kinea Investimentos Lida. Brazil 80.00% 1) The institutions operate in their respective countries of origin. 2) The company is transferring its location from Mexico to Uruguay. Awaiting local approvals. Itaú Unibanco 15

Risk and Capital Management—Pillar 3 lnstitutions that comprise only the Financial Statements Country 111 % Equity share on capital Maxipago Serviços de Internet Lida. Brazil 100.00% Mundostar S.A. Uruguay 100.00% Proserv—Promociones y Servicios, S.A. de C.V. Mexico 100.00% Provar Negócios de Varejo Lida. Brazil 100.00% Recaudaciones y Cobranzas Limitada Chile 55.96% Recovery do Brasil Consultoria S.A. Brazil 100.00% RJ Niteroi lcarai Lida. Brazil 100.00% RT Alm 5 Fundo de Investimento Renda Fixa Brazil 100.00% RT Alm Soberano 2 Fundo de Investimento Renda Fixa Brazil 100.00% RT Defiant Multimercado—Fundo de Investimento Brazil 100.00% RT Endeavour Renda Fixa Crédito Privado—Fundo de Investimento Brazil 100.00% RT Multigestor 4 Fundo de Investimento em Cotas de Fundos de Investimento Multimercado Brazil 100.00% RT Nation Renda Fixa—Fundo de Investimento Brazil 100.00% RT Valiant Renda Fixa—Fundo de Investimento Brazil 100.00% SAGA li SPA Chile 100.00% SAGA Ili SPA Chile 100.00% SP Amadeu Amaral Lida. Brazil 100.00% SP Antonio de Queiroz Lida Brazil 100.00% SP Augusta Lida Brazil 100.00% SP Av Juscelino Kubitschek Lida Brazil 100.00% SP Av Luís Carlos Berrini Lida Brazil 100.00% SP Av Morumbi Lida Brazil 100.00% SP Av. Sta. Catarina Lida. Brazil 100.00% SP Bairro Moema Lida. Brazil 100.00% SP Bairro Sumarezinho Lida Brazil 100.00% SP Bairro Vila Guilherme Lida. Brazil 100.00% SP Brooklin Rua Santo Amaro Lida Brazil 100.00% SP Brooklin St. Amaro Lida. Brazil 100.00% SP Butanta Lida Brazil 100.00% SP CEAGESP Lida Brazil 100.00% SP Vila Clementina Lida Brazil 100.00% SP Clelia Lida Brazil 100.00% SP I nterlagos Lida Brazil 100.00% SP Itaberaba Lida Brazil 100.00% SP ltaim Paulista Lida. Brazil 100.00% SP Maracatins Lida Brazil 100.00% SP Nova JK Lida Brazil 100.00% SP Rua Da Consolacao Lida Brazil 100.00% SP Santos Embare Lida. Brazil 100.00% SP Santos Jose Menino Lida. Brazil 100.00% SP Serra De Bragança Lida Brazil 100.00% SP Tatuape Lida Brazil 100.00% SP Vila Olímpia Araguari Lida. Brazil 100.00% Tulipa S.A. Brazil 100.00% Unión Capital AFAP S.A. Uruguay 100.00% Zup I.T. Soluções em lnformatica L TOA. Brazil 52.96% ZUP lnnovation Corp. United States 52.96% 1) The institutions operate in their respective countries of origin. Itaú Unibanco 16

Risk and Capital Management—Pillar 3 The institutions presented in the tables above represent the total scope of companies of Itaú Unibanco Holding. Non Consolidated Institutions 1’ 1 Country 121 131 Non consolidated lnstitutions % Equity share on capital BSF Holding S.A Brazil 49.00% CIPS.A Brazil 23.33% Compania Uruguaya de Medias de Procesamiento S.A. Uruguay 29.24% Conectcar Soluções de Mobilidade Eletrônica S.A. Brazil 50.00% Gestora de Inteligência de Crédito S.A Brazil 19.64% Kinea Private Equity Investimentos S.A. Brazil 79.99% Olfmpia Promoção e Serviços S.A. Brazil 50.00% Porto Seguro ltaú Unibanco Participações S.A. Brazil 42.93% Pravaler S.A. Brazil 52.27% Rias Redbanc S.A. Uruguay 25.00% Tecnologia Bancária S.A. Brazil 28.05% 1) Considers lhe associated institutions recognized by lhe equity method. 2) The institutions operate in their respective countries of origin. 3) Considers only direct participation. Material entities Total assets, stockholders’ equity, country and the activities of the material entities, including those subject to the risk weight for the purpose of capital requirements are as follows: R$ mllllon 06/30/2022 03/31/2022 lnstitutions Country Activity Total Assets Equity Total Assets Equity Cla. llaú de Capitalizaçao Brazil Premlum bonds 3,854 403 3,850 478 ltaú Consultoria de Valores Mobiliários e Participações S.A. Brazil Financial institution holding company 1,108 1,030 1,157 1,102 ltaú Corretora de Seguros S.A. Brazil lnsuranoe, pension plans and health brokers 1,559 540 1,312 423 ltaú Seguros S.A. Brazil lnsurance 6,515 1,310 6,554 1,751 ltaú Vida e Previdência S.A. Brazil Pension plan 220,896 3,579 218,178 3,676 llauseg Participaçoes S.A. Brazil Non financial institution holding company 7,606 7,559 11,072 10,569 1TB Holding Srasí1 Participações Lida. Brazil Financial institution holding company 33,600 32,625 24,821 24,326 Provar Negócios de Varejo Lida. Brazil Olher auxiliary activities for financial services 2,003 1,944 2,412 2,357 Itaú Unibanco 17

Risk and Capital Management—Pillar 3 Composition of Capital CCA: Main features of regulatory capital instruments The authorized regulatory capital instruments may be extinguished according to the criteria established in Resolution nº 4,955, such as non-compliance with the minimum regulatory ratios, decree of temporary special administration regime or intervention, application of public resources or upon the Central Bank of Brazil determination. Should any criteria for the extinction of subordinated instruments be triggered, the area responsible for Itaú Unibanco’s Capital management will activate the areas involved to execute the following action plan: • Treasury and products, through the payment agent of the subordinated instruments or straight through the central depository, will notify its holders and take actions to ensure that Itaú Unibanco’s trading desks cease to trade such instruments; • The operational and accounting areas will carry out the necessary procedures for the proper treatment of the extinction; and • The Investor Relations area will communicate to the market of the extinction of the subordinated instruments. The table CCA—Main features of regulatory capital instruments, is available at www.itau.com.br/investor-relations, section “Results and Reports”, “Regulatory Reports”, “Pillar 3”. Itaú Unibanco 18

Risk and Capital Management—Pillar 3 CC1—Composition of regulatory capital 06/30/2022 Balance Sheet Value (R$ Thousand) Reference Common Equity Tier 1: instruments and reserves 1 lnstruments Eligible for the Common Equity Tier 1 90,729,000 (k) 2 Revenue reserves 66,176,421 (1) 3 Other revenue and other reserve (6,162,562) (m) 5 Common share capital issued by subsidiaries and held by third parties (amount allowed in group CET1 capital) 7,802,574 O) 6 Common Equity Tier I before regulatory adjustments 158,545,433 Common Equity Tier 1: prudential adjustments 7 Prudential adjustments related to the pricing of financial instruments 296,305 8 Goodwill (net of related tax liability) 2,677,392 (e) 9 lntangible assets 14,192,220 (h) 1 (i) 10 Tax credits arising from income tax losses and social contribution tax loss carryfowards and those originating from this contribution 4,355,549 (b) related to determination periods ended until December 31, 1998 Adjustments related to lhe market value of derivative financial instruments used to hedge lhe cash fiows of protected items whose mark- 11 to-market adjustments are not recorded in lhe books. (62,248) 15 Actuarial asseis related to defined benefit pension funds 37,570 (d) 16 Shares or other instruments issued by lhe bank authorized to compose lhe Core Capital, acquired directly, indirectly or synthetically 71,276 (n) 17 Reciprocai cross-holdings in common equity Total value of adjustments related to net non-significant investments in lhe Common Equity Tier I of companies that are similar to non-18 consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and sponsored pension fund entities Total value of adjustments related to net significant investments in the Common Equity Tier I of companies that are similar to non-19 consolidated financial institutions, insurance companies, reinsurance companies, capitalization companies and sponsored pension fund entities, that exceeds 10% of the amount of lhe Common Equity Tier 1, disregarding specif,c adjustments 21 Total value of adjustments related to tax credits arising from temporary differences that depend on lhe generation of income or future taxable income for their realization, above the limit of 10% of the Common Equity Tier 1, disregarding specif,c deductions 22 Amount that exceeds 15% of lhe Common Equity Tier 1 3,326,190 23 Of which: arising from net investments in the Common Equity Tier I of companies that are similar to non-consolidated financial 1,425,397 institutions, insurance companies, reinsurance companies, capitalization companies and open ended pension entities 25 Of which: arising from tax credits resulting from temporary differences that depend on lhe generation of income or future taxable income 1,900,793 for their realization 26 National specif,c regulatory adjustments 26.a Deferred permanent asseis (g) 26_b lnvestment in dependence, financial institution abroad or non-financial entity that is pari of the conglomerate, with respect to which the Central Bank of Brazil does not have access to information, data and documents 26.d lncrease of unauthorized capital 26.e Excess of the amount adjusted of Common Equity Tier 1 26.f Deposrt to cover capital deficiency 26.g Amount of intangible assets established before Resolution No. 4,192 of 2013 comes into effect (i) 26.h Excess of resources invested on permanent assets 26.1 Total capital detached 26.j Other residual differences concerning the Common Equity Tier I calculation methodology for regulatory purposes 27 Other residual differences related to lhe calculation of lhe Common Equity Tier I for regulatory purposes 28 Total regulatory deductions from the Common Equity Tier 1 24,894,254 29 Common Equity Tier 1 133,651,180 Additional Tier I Capital: instruments 30 lnstruments eligible for lhe Additional Tier I Capital 17,310,328 31 Ofwhich: classified as equity under applicable accounting standards 32 Of which: classified as liabilities under applicable accounting standards 17,310,328 33 lnstruments authorized to compose the Additional Tier I Capital before Resolution No. 4,192 of 2013 comes into effect 34 Additional Tier 1 instruments issued by subsidiaries and held by third parties (amount allowed in group additional Tier 1 capital) 283,015 35 Of which: instruments issued by subsidiaries before Resolution No. 4,192 of 2013 comes into effect 36 Additional Tier I Capital before regulatory adjustments 17,593,343 Itaú Unibanco 19

Risk and Capital Management—Pillar 3 Additional Tier I Capital: regulatory adjustments Shares or other instruments issued by lhe bank authorized to compose lhe Additional Tier I Capital, acquired directly, indirectly or 37 synthetically 38 Reciprocai cross-holdings in additional Tier 1 instruments Total value of adjustments related to net non-significant investments in the Additional Tier I Capital of institutions authorized to operate by 39 the Central Bank oi Brazil or by a financial institution abroad outside the scope oi regulatory consolidation 40 Total value of adjustments related to net significant investments in the Additional Tier I Capital of institutions authorized to operate by the Central Bank oi Brazil or by a financial institution abroad outside lhe scope oi regulatory consolidation 41 National specif,c regulatory adjustments 41.b Non-controlling interest in Additional Tier I Capital 41.c Other residual differences concerning lhe Additional Tier I Capital calculation methodology for regulatory purposes 42 Regulatory adjustments applied to lhe Additional Tier I Capital dueto lhe insufficient Tier li Capital to cover deductions 43 Total regulatory deductions from lhe Additional Tier I Capital 44 Additional Tier I Capital (AT1) 17,593,343 45 Tier 1 151,244,523 Tier li: instruments 46 lnstruments eligible for Tier li 17,622,966 47 lnstruments that are authorized to compose Tier li before Resolution No. 4,192 of 2013 comes into effect 48 Tier 2 instruments issued by subsidiaries and held by third parties (amount allowed in group Tier 2) 88,631 49 Of which: instruments issued by subsidiaries before Resolution No. 4,192 of 2013 comes into effect 51 Tier li before regulatory adjustments 17,711,597 Tier li: regutatory adjustments 52 Shares or other instruments issued by lhe bank authorized to compose Tier li, acquired directly, indirectly or synthetically 53 Reciprocai cross-holdings in Tier 2 instruments Total value oi adjustments related to net non-signilicant investments in the Tier 11 and other TLAC liabilities oi institutions authorized to 54 operate by the Central Bank oi Brazil or by a financial institution abroad outside lhe scope oi regulatory consolidation 55 Total value of adjustments related to net significant investments in the Tier li and other TLAC liabihties of institutions authorized to operate by the Central Bank of Brazil ar by a financial institution abroad outsic::le lhe scope of regulatory consolidation 56 National specif,c regulatory adjustments 56.b Non-controlling interest in Tier li 56.c Other residual differences concerning Tier li calculation methodology for regulatory purposes 57 Total regulatory deductions from Tier li Capital 58 Tier li 17,711,597 59 Referential Equity (Tier 1+ Tier li) 168,956,120 60 Total risk-weighted asseis 1,201,628,000 BIS Ratios and Additional Capital Buffers 61 Common Equity Tier I Ratio 11.1% 62 Tier I Ratio 12.6% 63 BIS Ratio 14.1% 64 Additional Capital Buffers (% oi RWA) 3.5% 65 OI which: capital conservalion buffer requirement 2.5% 66 OI which: bank-specific countercyclical buffer requirement 67 OI which: capital buffer for institutions that are systemically important at global levei (G-SIB) 10% 68 Common Equity Tier 1 capital available after meeting lhe bank’s minimum capital requirements (% oi RWA) 2.6% Amounts below lhe limit for deduction (non-weighted by risk) T atai value, subject to risk weighting, of non-signiflcant investments in the Common Equity Tier I of institutions authorized to operate by the Central Bank oi Brazil, non-consolidated overseas financial institutions, companies that are similar to non-consolidated financial institutions, 72 insurance companies, reinsurance companies, capitalization companies and open ended pension entities, as wetl as non-significant 9,913,600 investments in the Additional Tier 1, Tier li and other TLAC liabilities oi institutions authorized to operate by the Central Bank oi Brazil or by a financial institution abroad outside lhe scope oi regulatory consolidation Total value, subject to risk weighting, oi significant investments in lhe Common Equity Tier I oi institutions authorized to operate by lhe 73 Central Bank oi Brazil, non-consolidated overseas financial institutions, companies that are similar to non-consolidated financial institutions, 8,591,179 (f) / (a) insurance companies, reinsurance companies, capitalization companies and sponsored pension fund entities 75 Tax credits arising from temporary differences, not deducted from lhe Common Equity Tier 1 13,062,665 (c) lnstruments authorized to compose the Referential Equity before Resolution No. 4,192 of 2013 comes into effect(applicable between October 1, 2013 and January 1, 2022) 82 lnstruments that are authorized to compose the Additional Tier I Capital before Resolution No. 4,192 of 2013 comes into effect 83 Amount excluded from lhe Addítional Tier I Capital dueto the line 82 limit 84 lnstruments that are authorized to compose Tier li before Resolution No. 4,192 oi 2013 comes into effect 85 Amount excluded from Tier 11 due to lhe line 84 limit Itaú Unibanco 20

Risk and Capital Management—Pillar 3 CC2: Reconciliation of regulatory capital to balance sheet R$ million, at the end of the period 06/30/2022 Balance Sheet as in Under regulatory Reference 121 published financial scope of statements consolidation Consolidated Balance Sheetl’l Assets Current assets and Long-term receivables 2,258,532 2,012,426 Cash 33,839 33,729 lnterbank investments 237,053 235,370 Securities and derivative financial instruments 773,742 547,304 lnterbank accounts 168,976 168,975 lnterbranch accounts Loan, lease and other credit operations 813,701 803,844 Other receivables 227,013 219,339 Deferred tax assets 59,239 (b) / (c) Sundry 160,100 (b) /(d) Other assets 4,208 3,865 Permanent assets 35,944 50,170 lnvestments 12,641 27,725 (a) / (e)/ (f) Real estale 6,475 5,972 Goodwill and lntangible assets 16,828 16,473 Goodwill 2,196 (e) lntangible assets 14,192 (h) / (i) other 85 Total assets 2,294,476 2,062,596 Liabilities Current and Long-term Liabilities 2,133,802 1,901,082 Deposits 828,693 836,630 Deposits received under securities repurchase agreements 262,566 262,566 Funds from acceptances and issuance of securities 205,431 205,431 lnterbank accounts 81,036 81,036 lnterbranch accounts 14,168 14,171 Borrowings and onlending 120,012 120,012 Oerivative financial instruments 75,087 75,084 Technical provision for insurance, pension plan and capitalization 224,405 Provisions 16,906 16,538 Allowance for financial guarantees provided and loan commitments 5,993 5,993 Other liabilities 299,505 283,621 Deferred tax liabilities 5,636 (b) / (c) Sundry 277,985 (d) Non-controlling interest in subsidiaries 10,035 10,843 (j) Stockholders’ equity 150,639 150,671 Capital 90,729 90,729 (k) Other Revenues and Other Reserves (6,487) (6,163) (m) Revenue reserves 66,468 66,176 (1) (Treasury shares) (71) (71) (n) Total liabilities and stockholders’ equity 2,294,476 2,062,596 1) Differences are mainly dueto non-consolidation oi non financial companies (highlighting the following companies: lnsurance, Pension Plan and Premium Bonds) within the Prudencial Conglomerate and also by the eliminations oi transactions with related parties. 2) Prudential information that is presented in the Template CC1 oi this document. Itaú Unibanco 21

Risk and Capital Management—Pillar 3 Macroprudential Indicators CCyB1: Geographical distribution of credit risk exposures considered in the calculation of the Countercyclical Capital Buffer The following table details the geographic distribution of credit risk exposures considered in the calculation of the Countercyclical Capital Buffer, according to Circular 3,769 of 29 October 2015: RS mlllion 06/30/2022 Exposure values and/or risk• weighted assets (RWA) used in the computation of the countercyclical capital buffer Countercyclical Bank-specific Countercyclical capital Geographical breakdown c ountercyclical capital 131 capital buffer rate Amount of credit risk exposure buffer amount to the non-banking private RWACPrNB buffer rate sector Brazil 1,675,760 745,687 Luxembourg 0.50% 2,103 1,623 No1Way 1.00% 330 190 Hong Kong 1.00% 11 11 Sum 111 1,678,204 747,511 Total (2) 2,002,336 961,017 1) Sum of RWACPrNBi portions related to credit risk exposures to the non-banking private sector in Brazil and jurisdictions with a percentage of the countercyclical bufferwith values greater than zero. 2) Total of RWA for non.bank private credit risk exposures to all jurisdictions in which the bank has exposure, including jurisdictions with no countercyclical buffer percentage apphed or with a countercyclical percentage equal to zero. 3) Calculated according to Circular 3. 769, employing lhe discretionary exclusion of jurisdiction. GSIB1: Disclosure of G-SIB indicators The GSIB1 table, disclosure of global systemically important bank (G-SIB) indicators, is available on the website www.itau.com.br/investor-relations, section “Reports”, “Pillar 3 and Global Systemically Important Banks”, within the period stipulated by BCB Resolution 54/20. Leverage Ratio The Leverage Ratio is defined as the ratio between Tier I Capital and Total Exposure, calculated according to BACEN Circular 3,748, which minimum requirement is of 3%. The ratio is intended to be a simple measure of non-risk-sensitive leverage, and so it does not take into account risk weights or risk mitigation. The following information is based on the methodology and standard format introduced by BACEN Circular 3,748. Itaú Unibanco 22

Risk and Capital Management—Pillar 3 LR1: Summary comparison of accounting assets vs leverage ratio exposure measure (RA) 06/30/2022 03/31/2022 R$ million Total consolidated assets as published financial statements 2,294,476 2,183,310 Adjustment from differences of consolidation (231,880) (213,519) Total assets of the individual balance sheet or of the regulatory consolidation, in the case of Leverage Ratio on a consolidated 2,062,596 1,969,791 basis Adjustments for derivative financial instruments 25,753 20,309 Adjustment for securities financing transactions (ie repas and similar secured lending) 15,946 15,240 Adjustment for off-balance sheet items (ie conversion to credit equivalent amounts of off-balance sheet exposures) 158,567 154,484 Other adjustments (160,089) (143,878) Total Exposure 2,102,773 2,0 15,946 LR2: Leverage ratio common disclosure R$ million 06/30/2022 03/31/2022 ltems shown in the Balance Sheet Balance sheet items except derivative financial instruments, securities received on loan and resales for settlement under 1,693,509 1,612,460 repurchase transactions Adjustments for equity items deducted in the calculation of Tier 1 (30,408) (26,517) Total exposure shown in the Balance Sheet 1,663,101 1,585,943 Transactions using Derivative Financial lnstruments Replacement value for derivatives transactions 49,700 51,480 Potential future gains from derivatives transactions 16,408 14,317 Adjustment for collateral in derivatives transactions Adjustment related to lhe deduction of lhe exposure because of lhe qualified central counterparty (QCCP) in derivative transactions on behalf of clients in which there is no contractual obligation to reimburse dueto bankruptcy or default of lhe (7,373) (6,948) entities responsible for lhe settlement and compensation of transactions Reference value for credit derivatives 19,431 14,750 Adjustment of reference value calculated for credit derivatives (4,851) (3,647) Total exposure for derivative financial instruments 73,315 69,952 Repurchase Transactions and Securities Lending (TVM) lnvestments in repurchase transactions and securities lending 170,560 166,492 Adjustment for repurchases for settlement and creditors of securities lending Amount of counterparty credit risk 15,946 15,239 Amount of counterparty credit risk in transactions as intermediary 21,284 23,836 Total exposure for repurchase transactions and securities lending 207,790 205,567 Off-balance sheet items Reference value of off-balance sheet transactions 495,285 484,565 Adjustment for application of FCC specific to off-balance sheet transactions (336,718) (330,081) Total off-balance sheet exposure 158,567 154,484 Capital and Total Exposure Tier 1 151,245 145,402 Total Exposure 2,102,773 2,015,946 Leverage Ratio Basel Ili Leverage Ratio 7.2% 7.2% Itaú Unibanco 23

Risk and Capital Management—Pillar 3 Liquidity Ratios LIQA: Liquidity Risk Management Information Framework and Treatment Liquidity risk is defined as the likelihood of the institution not being able to effectively honor its expected and unexpected obligations, current and future, including those from guarantees commitment, without affecting its daily operations or incurring in significant losses. In line with the fundraising strategy, Itaú Unibanco has diversified and stable sources of funding available, monitored through concentration and maturity indicators, in order to mitigate liquidity risks, in accordance with the institution’s risk appetite. The governance of the liquidity risk management is based on advisory boards, subordinated to the Board of Directors or the executive structure of Itaú Unibanco. Such boards establish the institution’s risk appetites, define the limits related to the liquidity control and monitor the liquidity indicators. The control of the liquidity risk is carried out by an area that is independent of the business areas, responsible for defining the composition of the reserve, estimating the cash flow and the exposure to liquidity risk in different time horizons and monitoring short and long term liquidity indicators (LCR and NSFR respectively). In addition, it proposes minimum limits to absorb losses in stress scenarios for each country where Itaú Unibanco operates and reports any non-compliance to the competent authorities. All activities are subject to verification by the independent validation, internal controls and audit departments. Additionally, and pursuant to the requirements of Resolution 4,557, BACEN Circular 3,749 and Circular 3,869, the Liquidity Risk Statement (DRL—LCR) and the Long Term Liquidity Statement (DLP—NSFR) are monthly sent to BACEN. Finally, the following items are periodically prepared and submitted to senior management for monitoring and decision support: • Stress of liquidity indicators based on macroeconomic scenarios, simulation of reverse stress based on risk appetite, and projection of the main liquidity indicators to support decisions; • Contingency and recovery plans for crisis situations, with actions that provide for a gradation according to the level of criticality determined by the easiness of implementation, taking into account the characteristics of the local market in which it operates, seeking a rapid restoration of liquidity indicators; • Reports and graphs that describe risk positions; • Concentration indicators of funding providers and time. The document that details the liquidity risk control institutional policy is on the Investor Relations website https://www.itau.com.br/investor-relations,section “Itaú Unibanco”, under “Corporate Governance”, “Rules and Policies, Reports”. Itaú Unibanco 24

Risk and Capital Management—Pillar 3 LIQ1: Liquidity Coverage Ratio (LCR) 11) 11) 06/30/2022 03/31/2022 Total unweighted Total weighted Total unweighted Total weighted value (ln value (ln value (ln value (ln thousand RS) 121 R$) 131 R$) 121 thousand RS) 131 thousand thousand High Quality Liquidity Asseis (HQLA) Total High Quality Liquid Asseis (HQLA) 279,847,008 293,572,797 4 Cash Outflows l I Retnil deposits and deposits from small business customers, of which: 472,031,223 44,065,150 460,060,510 44,218,070 Stable deposns 238,461,491 11,923,075 237,326,736 11,866,337 Less stable deposrts 234,469,732 33,042,084 231,733,774 32,351,742 Unsecured wholesale funding, of which: 315,591,183 136,062,825 324,602,905 141,612,539 Operational deposrts (all counterparties) and deposns in networks of cooperative banks 12,693,370 3,128,981 14,059,236 3,419,739 Non-operational deposrts (all counterparties) 301,765,560 131 ,801,591 308,190,848 135,839,979 Unsecured debt 1,132,253 1,132,253 2,352,821 2,352,821 Secured wholesale funding 19,908,554 21,315,346 Additional requiremenls, of which: 302,011,369 34,835,759 301,842,854 37,078,709 Oulflows related to derivative exposures and other collateral requirements 28,508,611 15,386,571 30,477,236 17,454,220 Oulflows related to loss of fund1ng on debl products 407,705 407,705 640,255 640,255 Credit and liquidity facilities 273,095,053 19,041,483 270,725,363 18,984,234 Other contractual funding obligations 85,871,019 85,871,019 83,297,016 83,297,016 Other contingent funding obligations 150,451,756 22,775,290 144,332,333 21,956,800 Total Cash Outtlows 344,418,605 349,478,489 Cash lnflows 141 Secured lending (eg reverse repas) 143,283,283 2,223,624 150,903,339 2,209,271 lnflows from fully performing exposures 41,175,405 25,371,947 39,430,666 24,981,746 Other cash inflows 141,360,529 124,699,052 141,912,604 125,959,791 Total Cash lnflows 325,819,217 152,294,624 332,246,609 153,150,808 Total Adjusted Total Adjusted Value 15l ‘51 Value Total HQLA 279,847,008 293,572,797 Total net cash outflows 192,123,981 196,327,681 Liquidity Coverage Ratio (%) 145.7% 149.5% 1) Corresponds to 62 daily average observations at 2Q22 and 62 daily at 1 Q22 2) Total balance off lhe cash inflows or outflows 3) After application of weighting factors 4) Potential cash outflows (Outflows e) and inflows (inflows e) 5) Amount calculated after applying weighting factors and limits sei by BACEN Circular 3,749 Itaú Unibanco has High Quality Liquidity Assets (HQLA) that amounted to R$ 279.8 billion on average for the quarter, mainly composed of Sovereign Securities, Central Bank Reserves and Cash. Net Cash Outflows amounted to R$ 192.1 billion on average for the quarter, which are mostly comprised of Retail Funding, Wholesale, Additional Requirements, Contractual and Contingent Obligations, offset by Cash inflows from loans and other Cash inflows. The table shows that the average LCR in the quarter is 145.7%, above the limit of 100% and therefore the institution has high quality liquidity resources comfortably available to support the losses in the standardized stress scenario for the LCR. Itaú Unibanco 25

Risk and Capital Management—Pillar 3 LIQ2: Net Stable Funding Ratio (NSFR) Value per residual effectlve maturity term (RS thousand) Greater than or equal Welghted Value 111 Lower than six Greater than or equal 06/30/2022 No Maturity months111 to six months, and to 1 year111 (ln thousand lower than 1 year111 R$)121 Avallable Stable Fundlng (ASF) Capital 196,532,190 196,532,190 Reference Equity, gross of regulatory deductions 161,598,896 161 ,598,896 Other capital instruments not included in line 2 34,933,294 34,933,294 Retall Fundlng: 208,686,738 292,844,116 2,050,166 1,278,782 466,817,718 StabJe Funding 122,632,529 123,649,650 38,187 20,667 234,025,015 Less Slable Funding 86,054,210 169,194,466 2,011,979 1,258,115 232,792,703 Wholesale Fundlng: 73,764,411 591,730,847 89,850,474 139,481,926 355,212,320 Operational deposits and deposits of member cooperatives 9,592,932 4,796,466 Other Wholesale Funding 64,171,479 591,730,847 89,850,474 139,481,926 350,415,854 Opertions ln which the institution acts exclusively as intermedlary, not undertaklng any rights or obligations, even if contingent 104,774,121 12,038,643 782,074 Other llabillties, ln whlch: 109,367,534 132,044,830 787,946 51,762,407 52,156,379 Deriva tives whose replacement values are lowerthan zero 25,175,154 Other liability or equ,ty elements not included above 109,367,534 106,869,677 787,946 51,762,407 52,156,379 Total Available Stable Fundlng (ASF) 1,070,718,608 (RSF)131 Requlred Stabk! Funding Total NSFR high quality liquid assets (HQLA) 14,479,206 Operational deposits held at other financial institutions Performlng loans and securltles (financial lnstltutlons, corporates and central banks) 2,204,771 435,954,171 124,293,914 529,121,704 646,802,674 Performing loans to financial inst,tutions secured by Levei 1 HOLA 26,649,101 46,721 2,731,631 Performing loans to financial institutions secured by non-Level 1 HQLA and unsecured performing /oans to 2,087,776 23,730,502 6,172,240 29,274,960 36,373,912 financial instirutions Performing loans to non-financial corporate clients. loans to retail and smalf busíness customers, and foans to 116,995 348,963,975 91,993,625 241,957,621 362,387,072 sovereigns, central banks, of which: With a risk weight of less than or equal to 35%, approach for credit risk, according to Circular 3,644. 4,778,178 3,105,815 Performing residential morlgages, of which: 7,971,936 7,506,086 119,395,939 103,791,750 Which are in accordance to Circular 3,644, 2013. art. 22 80,307,999 69,690,999 Securities that are not in default and do not qualify as HOLA. incfuding exchange-traded equities 28,438,658 18,621,963 138,446,463 141,518,309 Operations in wMch the institution acts exclusively as intermediary, not undertaking any rights or 116,329,276 11,012,683 889,689 obligations, even if contingent Other assets, in which: 84,021,808 181,706,918 8,216,111 90,075,763 210,243,173 Transactions with gold and commodities, including those with expect.ed physical settlement Assets posted as initial margin forderivatives contracts and participation in mutual guarantee funds of 14,496,421 12,321,957 clearinghouses or provlders of cfearing and settlement services which acts as central counterparty. Derivatives whose rep/acement va/ues are higher than or equa/ to zero 28,182,425 3,153,834 3,153,833 Deriva tives whose rep/acement values are /ess than zero, gross of the deduct,on of any colfateral provided as 1,434,749 1,434,749 a result of deposit of variation margin Ali other assets not included in the above categories 84,021,808 153,524,493 8,216,111 70,990,760 193,332,631 Off.balance sheet transactk>ns 599,101,090 8,271,073 22,902,078 Total Requlred Stable Funding (RSF) 894,427,129 NSFR (o/o) 119.7% 1) Corresponds to lhe lotai amount of Available Stable Funding (ASF) or Required Stable funding (RSF). 2) Corresponds to lhe amount after application of weighting tactOf’S 3) Corresponds to lhe Available Stable Funding (ASF) or Required Stable Funding (RSF) Total Adjusted Value (l) R$ thousand 06/30/2022 03/31/2022 Total Available Stable Funding (ASF) 1,070,718,608 1,021,581,310 Total Required Stable Funding (RSF) 894,427,129 852,480,700 NSFR(³⁄₄) 119.7% 119.8% 1) Corresponds to the amount calculated after application of the weighting factors and limits set forth in BACEN Circular 3,869. Itaú Unibanco has an Available Stable Funding (ASF) amounted to R$ 1,070.7 billion in the 2nd quarter, mainly composed of Capital, Retail Funding and Wholesale. In addition, the Required Stable Funding (RSF) amounted to R$ 894.4 billion in the 2nd quarter, which is mostly composed of loans and financing granted to wholesale, retail, central economies and central bank operations. Itaú Unibanco 26

Risk and Capital Management—Pillar 3 The table shows that the NSFR at the end of the quarter is 119.7%, above the limit of 100%, and therefore the institution has Available Stable Funding to support the Required Stable Funding comfortably in the long-term, according to the metric. Credit Risk CRA: Qualitative information on credit risk management Itaú Unibanco defines credit risk as the risk of loss associated with: failure by a borrower, issuer or counterparty to fulfill their respective financial obligations as defined in the contracts; value loss of credit agreements resulting from deterioration of the borrower’s, issuer’s or counterparty’s credit rating; reduction of profits or income; benefits granted upon subsequent renegotiations; or debt recovery costs. The management of credit risk is intended to preserve the quality of the loan portfolio at levels compatible with the institution’s risk appetite for each market segment in which Itaú Unibanco operates. The governance of credit risk is managed through corporate bodies, which report to the Board of Directors or to the Itaú Unibanco executive structure. Such corporate bodies act primarily by assessing the competitive market conditions, setting the credit limits for the institution, reviewing control practices and policies, and approving these actions at the respective authority levels. The risk communication and reporting process, including disclosure of institutional and supplementary policies on credit risk management, are also function of this structure. Itaú Unibanco manages the credit risk to which it is exposed during the entire credit cycle, from before approval, during the monitoring process and up to the collection or recovery phase, with the periodic monitoring of troubled assets, which are defined as: • Overdue Transactions for more than 90 days; • Restructured Operations; • Counterparties that present inability to pay, whether by legal measures, judicial reorganization, bankruptcy, loss, among others; • Significant deterioration in credit quality, which can be identified by deterioration in internal rating metrics, guarantees honored, among others. Additionally, if it is identified that a CNPJ may contaminate the counterparties, they may be marked as Troubled Assets. The monitoring contains information on significant exposures, including recovery history and prospects, as well as restructuring information. These analyzes are generated monthly for executives and quarterly for the Board of Directors through the Risk and Capital Management Committee (CGRC). There is a credit risk management and control structure, centralized and independent of the business units which defines operational limits, risk mitigation mechanisms and processes, and instruments to measure, monitor and control the credit risk inherent to all products, portfolio concentrations and impacts to potential changes in the economic environment. Such structure is subjected to internal and external auditing processes. The credit’s portfolio, policies and strategies are continuously monitored so as to ensure compliance with the rules and laws in effect in each country. The key assignments of the business units are (i) monitoring of the portfolios under their responsibility, (ii) granting of credit, taking into account current approval levels, market conditions, the macroeconomic prospects and changes in markets and products, and (iii) credit risk management aimed at making the business sustainable. Itaú Unibanco 27

Risk and Capital Management—Pillar 3 Itaú Unibanco’s credit policy is based on internal factors, such as: client rating criteria, performance and evolution of the portfolio, default levels, return rates and allocated economic capital, among others; and also take into account external factors such as: interest rates, market default indicators, inflation and changes in consumption, among others. With respect to individuals, small and medium companies, retail public, the credit ratings are assigned based on statistical application (in the early stages of relationship with a customer) and behavior score (used for customers with whom Itaú Unibanco already has a relationship) models. For wholesale public, the classification is based on information such as the counterparty’s economic and financial situation, its cash-generating capacity, and the business group to which it belongs, the current and prospective situation of the economic sector in which it operates. Credit proposals are analyzed on a case-by-case basis through the approval governance. The concentrations are monitored continuously for economic sectors and largest debtors, allowing preventive measures to be taken to avoid the violation of the established limits. Itaú Unibanco also strictly controls credit exposure to clients and counterparties, acting to reverse occasional limit breaches. In this sense, contractual covenants may be used, such as the right to demand early payment or require additional collateral. To measure credit risk, Itaú Unibanco takes into account the probability of default by the borrower, issuer or counterparty, the estimated amount of exposure in the event of default, past losses from default and concentration of borrowers. Quantifying these risk components is part of the lending process, portfolio management and definition of limits. The models used by Itaú Unibanco are independently validated, to ensure that the databases used in constructing the models are complete and accurate, and that the method of estimating parameters is adequate. Itaú Unibanco also has a specific structure and processes aimed at ensuring that other aspects of credit risk, such as country risk, are managed and controlled, described in the item “Other Risks”. In compliance with CMN Resolution 4,557, the document “Public Access Report—Credit Risk,” which describes the guidelines established in the institutional ruling on credit risk control, can be viewed on the website www.itau.com.br/investor-relations, section “Itaú Unibanco”, under “Corporate Governance”, “Rules and Policies”, “Reports”. Itaú Unibanco 28

Risk and Capital Management—Pillar 3 CR1: Credit Quality of Asset RS million 06/30/2022 Gross carrying values of Allowances, Unearned Revenues and ECL Defaulted exposures (a) Non-defaulted accounting provision Net values (a+b-c) (1) exposures (b) (e) Loans 61,913 921,691 149,908 833,695 Debt Securities 4,893 451,775 7,019 449,649 in which: Sovereigns 231,099 2,811 228,288 in which: Other Debts 4,893 220,676 4,208 221,361 Off—balance sheet exposures 496,269 745 495,525 Total 66,806 1,869,735 157,672 1,778,869 1) Pursuant to Resolution 54, as of 01/01/2022, defaulted exposures operations correspond to those characterized as problematic assets, a concept defined in Resolution 4,557. CR2: Changes in Stock of defaulted loans and debts securities Total RS million 1) Defaulted loans and debt securities at end ofthe previous reporting period (03/31/2022)< 62,978 Loans and debl securities that have defaulted since the las! reporting period 8,607 Amount returned to non-defaulted status (582) Amount written off (8,437) Other changes 4,240 1 Defaulted loans and debt securities at end of the reporting period (06/30/2022) < > 66,806 1) Pursuant to Resolution 54, as of 01/01/2022, defaulted exposures operations correspond to those characterized as problematic assets, a concept defined in Resolution 4,557. Itaú Unibanco 29

Risk and Capital Management—Pillar 3 CRB: Additional disclosure related to the credit quality of assets The tables below contain additional disclosure related to the credit quality exposures reported in the table CR1. Where is informed breakdown of exposures by geographical area, industry and defaulted exposures. In addition, the total exposures by residual maturity by delay range, the total of restructured exposures and the percentage of the ten and one hundred largest exposures are reported. Exposure by industry Total Exposure Total defaulted loans and debt securities RS million 06/30/2022 RS million 06/30/2022 Portfolio Portfolio Total Exposure (Net Total Exposure Oefaulted Expected Credit Exposures 111 values} (Gross values) Loss Companies 1,049,211 1,089,716 Companies 22,670 5,897 Public sector 301,287 304,686 Public sector Energy 1,217 1,219 Energy Petrochemical and Chemical 4,191 4,232 Petrochemical and Chemical Sundry 295,879 299,235 Sundry Private sector 747,924 785,030 Private sector 22,670 5,897 Sugar and Alcohol 9,184 9,600 Sugar and Alcohol 286 176 Agribusiness and Fertilizers 33,378 34,277 Agribusiness anel Fertilizers 262 117 Food and Beverage 31,953 33,571 Food and Beverage 985 404 Banks and other Financial lnstilutions 91,199 92,000 Banks anel other Financial lnstitutions 35 13 Capital Assets 11,844 12,320 Capital Assets 197 55 Pulp and Paper 5,856 5,945 Pulp and Paper 26 Electronic and IT 17,295 18,241 Electronic and IT 668 192 Packaging 5,830 5,989 Packaging 275 (38) Energy and Sewage 49,429 50,602 Energy and Sewage 212 86 Education 6,917 7,358 Education 265 76 Pharmaceuticals anel Cosmetics 19,891 20,606 Pharmaceuticals and COsmetics 467 165 Real Estate Agents 51,024 54,023 Real Estale Agents 1,177 624 Entertainment and Tourism 12,958 15,341 Entertainment and Tourism 1,417 475 Wood and Fumiture 8,282 9,056 Wood and Furniture 449 153 Construction Material 12,633 13,470 Construction Material 304 105 Steel and Metallurgy 15,072 15,755 Steel and Metallurgy 426 147 Media 1,488 1,522 Media 34 9 Mining 7,662 7,896 Mining 59 24 lnfrastructure Work 13,063 14,350 lnfrastructure Work 673 243 Oi! anel Gas 14,246 15,030 Oil anel Gas 269 112 Petrochemical and Chemical 16,308 16,881 Petrochemical and Chemical 263 77 HealthCare 12,679 13,206 Health Care 169 46 lnsurance and Reinsurance anel Pension Plans 275 282 lnsurance and Reinsurance anel Pension Plans Telecommunications 13,463 13,950 Teleoommunications 94 41 Clothing and Footwear 8,033 8,675 Clothing and Footwear 516 61 Trading 3,702 3,865 Trading 88 34 Transportation 40,253 43,851 Transportation 1,013 423 Oomestic Applianoes 5,592 5,727 Domestic Appliances 82 20 Vehicles and Autoparts 28,236 29,609 Vehicles and Autoparts 872 292 Third Sector 4,187 4,393 Third Sector 6 2 Publishing anel Printing 3,684 4,059 Publishing and Printing 220 73 Commerce—Sundry 48,579 52,387 Commerce—Sundry 2,296 843 lndustry—Sundry 15,755 15,876 lndustry- Sundry 61 16 Sundry Services 65,664 69,897 Sundry Services 3,380 1,521 Sundry 62,310 65,420 Sundry 5,124 (696) Individuais 729,658 846,825 Individuais 44,136 16,399 Total 1,778,869 1,936,541 Total 66,806 22,296 1) Puí$uant to Resolution 54, as of 01/01’2022, defaulted exposures operations co1Tespond to those characterized as problematic asseis, a concepe: defined in Resolution 4,557. Itaú Unibanco 30

Risk and Capital Management—Pillar 3 Exposure by remaining maturity -’-R’-‘S’-‘m=ill”-‘io”-n’-0_6_13_0_12_0_2_2 _R_S_m_ill_io_n 0_6_/3_0_/2_0_2_2 values)111 Remaining maturities of transactions (Gross values)< 11 Remaining maturities of transactions (Net up to 6 months 6 to 12 months 1 to 5 years a bove 5 yea rs Total up to 6 months 6 to 12 months 1 to 5 years above 5 years Total 415,307 121,831 475,327 358,603 1,371,068 448,597 125,485 537,489 416,945 1,528,516 1) Do not consider the amount of credits to be released. Overdue exposures R$ million 06/30/2022 Gross portfolio Overdue amounts <11 Less than 30 days 8,576 31 to 90 days 14,787 91 to 180 days 14,521 181 to 365 days 15,474 above 365 days 2,110 Total 55,468 1) According to Resolution 54, the table follows the sarne scope as table CRl. Itaú Unibanco 31

Risk and Capital Management—Pillar 3 Exposure by geographical area in Brazil and by country Total Exposure Total defaulted loans and debt securities R$ million 06/30/2022 R$ million 06/30/2022 Portfolio Portfolio Total Exposure (Net Total Exposure Defaulted Expected Credit values) (Gross values) Exposures 121 Loss Southeast 850,277 932,053 Southeast 44,504 13,002 South 134,134 151,506 South 6,623 2,333 North 24,331 31,295 North 1,877 725 Northeast 110,717 133,230 Northeast 7,873 3,565 Midwest 61,144 71,341 Midwest 3,895 1,444 National territory (1) 228,288 231,064 National territory (1) Brazil 1,408,891 1,550,489 Brazil 64,772 21,069 Argentina 8,452 8,806 Argentina 15 13 Chile 178,752 183,155 Chile 1,193 640 Colombia 40,797 50,215 Colombia 546 355 United States 26,190 26,711 United States Paraguay 17,777 17,992 Paraguay 139 107 United Kingdom 21,822 22,070 United Kingdom Swiss 3,500 3,500 Swiss Uruguay 30,397 30,796 Uruguay 141 112 Other 42,291 42,807 Other Foreign 369,978 386,052 Foreign 2,034 1,227 Total 1,778,869 1,936,541 Total 66,806 22,296 1) Considers only Brazilian goverment bonds. 2) Pursuant to Resolution 54, as of 01/01/2022, defaulted exposures operations correspond to those characterized as problematic asseis, a concept defined in Resolution 4,557. Largest debtors exposures R$ million 06/30/2022 Loans, Debt Securities and Off-balance sheet exposures (CR1) 111 Exposure % of portfolio 1 O largest debtors 311,179 18.0% 100 largest debtors 467,141 26.0% 1) According to Resolution 54, lhe table follows lhe sarne scope as table CR1, in which lhe exposure value considers sovereign debt securities. Itaú Unibanco 32

Risk and Capital Management—Pillar 3 Restructured exposures 06/30/2022 R$ million <11 Overdue Others 2 Restructured Exposures ( > 23,5 77 105 1) Pursuant to Resolution 54, as of 01/01/2022, defaulted exposures operations correspond to those characterized as problematic assets, a concept defined in Resolution 4,557. 2) BCB Resolution No. 4,557 in its article 24, paragraph 1, item Ili, defines that every restructured operation will be characterized as a problematic asset. CRC: Qualitative disclosure related to Credit Risk Mitigation techniques Itaú Unibanco uses guarantees to increase its recovery capacity in operations subject to credit risk. The guarantees used can be financial, credit derivatives, fiduciary, real, legal structures with mitigation power and offsetting agreements. For these guarantees to be considered as credit risk mitigating instruments, it is necessary that they comply with the requirements and determinations of the that regulate them, whether internal or external, and that they are legally enforceable (effective), enforceable and regularly evaluated. The information regarding the possible concentration associated with the mitigation of credit risk considers these different mitigating instruments, segregating by type and by provider. For reasons of confidentiality, the institution determines the non-disclosure of information beyond the classification of the type of guarantor, but ensuring adherence to the general requirements. • Fiduciary Guarantees and credit derivatives: a third party assumes the responsibility for fulfilling the obligation contracted by the debtor, which falls on the general equity of that third party. Avals, sureties and CDS are examples of these guarantees. Fiduciary guarantees are segregated into the following providers: Legal Entities; Multilateral Development Entities (EMD); Financial Institutions, Sovereigns, National Treasury or Central Bank. Itaú Unibanco also uses credit derivatives to mitigate the credit risk of its securities portfolios. These instruments are priced based on models that use the fair price of market variables, such as credit spreads, recovery rates, correlations and interest rates. They are also segregated into: Legal Entities; Multilateral Development Entities (EMD); Financial Institutions and Sovereigns. • Real and Financial Guarantees: the borrower itself or a third party detaches one or more financial assets and/or one or more goods and/or one or more receivables, in such a way as to guarantee repayment to the creditor in the event of default. These guarantees are segregated by type: financial collateral, bilateral contracts, and assets. • Clearing and Settlement of Obligations Agreement and legal structures with mitigating power: the clearing agreement aims to reduce the risk of credit exposure of one party to the other, resulting from transactions entered into between them, so that, in case of maturity, after offsetting, the net amount owed by the debtor to the creditor is identified. It is commonly used in derivative transactions, but it can also cover other types of financial transactions. In legal structures with mitigation power and compensation agreements, mitigation is based on methodologies established and approved by the business units responsible for credit risk management and by the centralized credit risk control area. Itaú Unibanco 33

Risk and Capital Management—Pillar 3 Such methodologies consider factors related to the legal enforceability of the guarantees, the costs necessary for such and the expected value in the execution, taking into account the volatility and liquidity of the market. To control the mitigating instruments, there is periodic monitoring that monitors the level of compliance with the use of each instrument when compared to internal measurement policies, even including corrective action plans when there is noncompliance, analyzing concentration, types, providers, formalization. The parameters used are: HE (Haircut of execution) which evaluates the probability of success in executing the guarantee, HV (Volatility Haircut) represents the liquidity of the collateral being offered, and LMM (Maximum Mitigation Limit) which is the mitigation ceiling for real guarantees. CR3: Credit Risk mitigation techniques—overview(1) 06/30/2022 RS million Exposures Exposures Exposures Unsecured Secured secured by secured by secured by Exposures Exposures financial collateral credit derivatives guarantees Loans 761,629 80,147 9,142 71 ,006 Debt securities 440,089 786 786 in which: Sovereigns 147,418 3,302 1,379 1,923 in which: Other Oebts 364,200 5,310 5,310 Total 1,713,336 89,545 16,617 72,929 Of which defaulted 1 2 23,101 621 103 518 > 1) The mitigating instruments contemplated ln this table are those foreseen in BACEN Circular 3,809. 2) Pursuant to Resolution 54, as of 01/01/2022, defau1ted exposures operations correspond to those characterized as problematic asseis, a concept defined in Resolution 4,557. Increase in credit concession observed mainly in the retail line, while in relation to debt securities the main variation comes from exposures with Central Governments and respective Central Banks. CR4: Standardized Approach – Credit Risk exposure and credit risk mitigation effects R$ mllllon 06/30/2022 Exposures before CCF and CRM Exposures post-CCF and CRM RWA and RWA density On- balance sheet Off- balance On- balance Off- balance Off- balance Asset classes RWA(e) sheet amount amount(a) sheet amount (b} sheet amount (c) sheet amount (d) (el(c+d)J Sovereigns and their central banks 503,401 503,401 16,606 3% Non-central government public sector entities 3,379 144 3,379 74 3,222 93% Multilateral development banks 801 801 Banks and other Financial lnstitutk>ns authorized by Brazil Central Bank 129,806 8,474 129,806 4,189 49,088 37% Corporates 438,512 134,813 438,511 75,188 456,495 89% Regulatory retail portfolios 338,717 337,426 338,717 66,150 283,530 70% Secured by residential property 117,680 3,506 117,680 3,506 43,711 36% Secured by commercial real estale 315 514 315 514 414 50% Equity stake 24,316 24,316 23,382 96% Other assets 95,235 2,561 95,235 1,099 96,325 100% Total 1,652,162 487,438 1,652,161 1S0,720 972,773 S4% Itaú Unibanco 34

Risk and Capital Management—Pillar 3 CR5: Standardized Approach – exposures by asset classes and risk weights ftSmllllofl Risk weight (FPR) OS/30/2022 Total credit exposures Asset classes Oo/e 10³⁄₄ 20% 35•;. 50³⁄₄ 75o/. 85³⁄₄ 100% OtheB amount (post CCF and post-CRM) Sovereigns and their central banks 475,350 2,436 20,437 3,731 1,447 503,401 Non-central govemment public sector entities 45 67 1,012 2,328 3,453 Multilateral development banks 801 801 Banks and other Financial lnstitutions authorized by Brazil Central 2,576 57,438 2,324 69,705 1,935 17 133,995 Bank Corporates 10,243 12,387 269,806 220,534 729 513,699 Regutatory retaíl portfolios 7,361 54,171 341,224 2,111 404,867 Secured by residential property 112,678 8,410 97 121,186 Secured by commercial real estate 829 829 Equity stake 69 5,993 18,254 24,316 Olher assets 11 96,323 96,334 Total 496,388 59,875 115,002 166,075 341,224 278,811 343,105 4,401 1,802,881 The increase in total exposure in tables CR4 and CR5 occurred mainly in the retail, corporate and central government lines. Counterparty Credit Risk (CCR) CCRA: Qualitative disclosure related to CCR Counterparty credit risk is the possibility of noncompliance with obligations related to the settlement of transactions that involve the trading of financial assets with a bilateral risk. It encompasses derivative financial instruments, settlement pending transactions, securities lending and repurchase transactions. Itaú Unibanco has well-defined rules for calculating its managerial and regulatory exposure to this risk, and the models developed are used both for the governance of consumption of limits and management of counterparties sub-limits, as well as for the allocation of capital, respectively. The managerial volatility of the potential credit risk (PCR) of derivatives (interpreted as the amount of potential financial exposure that an operation can reach until its maturity) and the volatility of repurchase agreements and foreign exchange transactions are monitored periodically to maintain the exposure at levels considered acceptable by the institution’s management. The risk may be mitigated by the use of margin call, initial margin or other mitigating instrument. Currently, Itaú Unibanco does not have impact in the amount of collateral that the bank would be required to provide given a credit rating downgrade. The regulatory exposures of counterparty credit risk are presented as follows. Itaú Unibanco 35

Risk and Capital Management—Pillar 3 CCR1: Analysis of CCR exposures by approach mlllion 06/30/2022 R$ Replacement Potential future Multiplier applied to EAO the calculation of post mitigation RWA cost exposure EAO SA-CCR Approach 18,689 7,294 1.4 36,376 27,338 CEM Approach Simple Approach for CCR mitigation (for SFTs and asset loans} Comprehensive Approach for CCR mitigation (for SFTs and asset loans) 458,872 10,886 Total 38,224 CCR3: Standardised approach – CCR exposures by regulatory portfolio and risk weights Rlsk welght (FPR) 06/30/2022 RS mlllion Counterparties 0•1. 10°/o 20% 50% 75°/o 85°/, 100º/4 150º/4 Others Total Sovereigns 146,091 3 146,094 Non-—central govemment pubhc sector ent1ties 123 6 129 Multilateral development banks 1,000 1,000 Banks and other Financial lnstitullons aulhortzed by Brazil Central 76,038 1,266 15,676 105 93,085 Bank Corporates 222,366 16,147 15,471 253,984 Regulato,y retail portfolios Other Counterparties 135 200 621 956 Total 445,630 1,269 15,876 16,270 16,203 495,248 In the CCR1 and CCR3 tables there was a reduction in the exposure of repo operations, mainly in Multilateral Development Banks and Corporates, partially offset by the increase in exposure with Sovereigns. CCR5: Composition of collateral for CCR exposures RS million 06/30/2022 Collateral used in SFTs and asset Collateral used in derivative transactions loans Fair value of collateral received Fair value of posted collateral Fair value of Fair value of , collateral received posted collateral Segregated Unsegregated Segregated Unsegregated Cash—domestic currency 5,692 164,387 205,862 Cash—other currencies 255 2,848 6,173 39,745 Domestic sovereign debt 3,821 243,529 164,493 Government agency debt 8,506 1,524 5,132 Corporate bonds 35,103 20,431 386 Equity securities 44 Other collateral 1,498 Total 5,692 49,183 2,848 436,088 415,618 Itaú Unibanco 36

Risk and Capital Management—Pillar 3 CCR6: CCR associated with credit derivatives exposures ln RS mllllon 06/30/2022 Protection bought Protection sold Notionals Single-name credit default swaps 4,319 12,495 lndex credit default swaps 340 Total retum swaps 6,936 Total notionals 4,659 19,431 Fair values 145 (436) Positive fair value (assei) 184 28 Negative fair value (liability) (39) (464) CCR8: CCR associated with Exposures to central counterparties R$ million 06/30/2022 EAD (post-CRM) RWA Exposures to qualifying CCPs (QCCPs total) 3,291 Exposures for trades ai QCCPs (excluding initial margin and default fund contributions); of which 19,383 622 (i) over-the-counter (OTC) derivatives (ii) Exchange-traded derivatives 19,339 621 (iii) Securities financing transactions 44 (iv) Netting seis where cross-product netting has been approved Segregated initial margin Non-segregated initial margin 5,714 2,644 Pre-funded default fund contributions 77 25 Exposures to non-QCCPs (total) Exposures for trades at non-QCCPs (excluding initial margin and default fund contributions); of which (i) over-the-counter (OTC) derivatives (ii) Exchange-traded derivatives (iii) Securities financing transactions (iv) Netting seis where cross-product netting has been approved Segregated initial margin Non-segregated initial margin Pre-funded default fund contributions Increase in Exposures for trades at QCCPs, especially in the Exchange-traded derivatives line. Securitisation Exposures SECA: Qualitative disclosure requirements related to securitisation exposures Currently, Itaú Unibanco coordinates and distributes issues of securitized securities in the capital market with or without a firm placement guarantee. In case of exercising the firm guarantee, the bank will assume the risk as an investor in the operation. Itaú Unibanco does not act as a sponsoring counterpart of any specific purpose company with the objective of operating in the securitisation market, nor does it manage entities that acquire securities issued or originated by their own. Itaú Unibanco 37

Risk and Capital Management—Pillar 3 In relation to accounting, it should be noted that (i) assets representing third-party securitisations are accounted for as well as other assets owned by the Bank, according to the brazilian accounting standards; and (ii) securitisation credits originating from Itaú Unibanco’s own portfolio remain accounted for in cases of credit assignment with co-obligation. In 2022, Itaú Unibanco did not carry out the sale of credit assets without substantial risk retention and did not assign exposures with substantial risk retention, which have been honored, repurchased or written off as loss. SEC1: Securitisation exposures in the banking book RS million 06/30/2022 Bank acts as originator Bank acts as sponsor Banks acts as investor Traditional Synthetic Subtotal Traditional Synthetic Subtotal Traditional Synthetic Subtotal Retail (total)—of which 6,313 6,313 residential mortgage credit card 2,553 2,553 other retail exposures 3,760 3,760 re- securilisation Wholesale (total)—of which 1,404 1,404 loans to corporates 1,404 1,404 commercial mortgage lease and receivables other wholesale re- securitisation SEC2: Securitisation exposures in the trading book In Itaú Unibanco’s current securitization portfolio, there are no exposures to be reported in table SEC2. SEC3: Securitisation exposures in the banking book and associated regulatory capital requirements – bank acting as originator or as sponsor In Itaú Unibanco’s current securitization portfolio, there are no exposures to be reported in table SEC3. SEC4: Securitisation exposures in the banking book and associated capital requirements—bank acting as investor R $ million 06/30/2022 Exposure values (by rlsk weight bands) Exposure values (by RWA {by regulatory Capital Requlrements regulatory approach) approach) 20%< FPR 60% :S FPR 100o/e:5 FPR Standardlzed Standardlzed Standardiz&d :520% < 50% < 100% < 1.250% 1260º/• approach 1260o/o approach 1250°/4 approach 1260%, Total exposures 6,907 496 313 7,716 3,258 13 261 Trnditional securitisation 6,907 498 313 7,718 3,258 13 281 O f which securitisation 6,907 496 313 7,716 3,258 13 261 Of which retail undertyllg 5,503 496 313 6,312 2,907 13 233 Of which wholesale 1,404 1,404 351 28 O f which re- securitisation Synthetic securitlsation Of which securitisation Of whích reta11 underlying O f which wholesale Of which re• securitisation Itaú Unibanco 38

Risk and Capital Management—Pillar 3 Market Risk MRA: Qualitative disclosure requirements related to market risk Market risk is the possibility of losses resulting from fluctuations in the market values of positions held by a financial institution, including the risk of operations subject to variations in foreign exchange rates, interest rates, equity and commodity prices, as set forth by CMN. Price Indexes are also treated as a risk factor group. The institutional policy for market risk is in compliance with Resolution 4,557 and establishes the management structure and market risk control, which has the function of: • Provide visibility and comfort for all senior management levels that market risks assumed must be in line with Itaú Unibanco risk-return objectives; • Provide a disciplined and well informed dialogue on the overall market risk profile and its evolution over time; • Increase transparency as to how the business works to optimize results; • Provide early warning mechanisms to facilitate effective risk management, without obstructing the business objectives; and • Monitoring and avoiding the concentration of risks. Market risk is controlled by an area independent of the business units, which is responsible for the daily activities: (i) measuring and assessing risk, (ii) monitoring stress scenarios, limits and alerts, (iii) applying, analyzing and stress testing scenarios, (iv) reporting risk to the individuals responsible in the business units, in compliance with Itaú Unibanco´s governance, (v) monitoring the measures needed to adjust positions and/or risk levels to make them viable, and (vi) supporting the secure launch of new financial products. The market risk management framework categorizes transactions as part of either the Trading Book or the Baking Book, in accordance with general criteria established by CMN Resolution 4,557 and BACEN Circular 3,354. Trading Book is composed of all trades with financial and commodity instruments (including derivatives) undertaken with the intention of trading. Banking Book is predominantly characterized by portfolios originated from the banking business and operations related to balance sheet management, are intended to be either held to maturity, or sold in the medium and in the long term. The market risk management is based on the following key metrics: • Value at Risk (VaR): a statistical metric that quantifies the maximum potential economic loss expected in normal market conditions, considering a defined holding period and confidence interval; • Losses in Stress Scenarios (Stress Testing): a simulation technique to evaluate the impact, in the assets, liabilities and derivatives of the portfolio, of various risk factors in extreme market situations (based on prospective and historic scenarios); • Stop Loss: metrics that trigger a management review of positions, if the accumulated losses in a given period reach specified levels; • Concentration: cumulative exposure of certain financial instrument or risk factor calculated at market value (“MtM—Mark to Market”); and Itaú Unibanco 39

Risk and Capital Management—Pillar 3 • Stressed VaR: statistical metric derived from VaR calculation, aimed at capturing the biggest risk in simulations of the current trading portfolio, taking into consideration the observable returns in historical scenarios of extreme volatility. In addition to the risk metrics described above, sensitivity and loss control measures are also analyzed. They include: • Gap Analysis: accumulated exposure of the cash flows by risk factor, which are marked-to-market and positioned by settlement dates; • Sensitivity (DV01 – Delta Variation Risk): impact on the market value of cash flows when a 1 basis point change is applied to current interest rates or on the index rates; and • Sensitivities to Various Risk Factors (Greeks): partial derivatives of a portfolio of options on the prices of the underlying assets, implied volatilities, interest rates and time. In an attempt to fit the transactions into the defined limits, Itaú Unibanco hedges its client transactions and proprietary positions, including investments overseas. Derivatives are the most commonly used instruments for carrying out these hedging activities, and can be characterized as either accounting or economic hedge, both of which are governed by institutional regulations at Itaú Unibanco. The structure of limits and alerts is in alignment with the board of directors’ guidelines, being reviewed and approved on an annual basis. This structure extends to specific limits and is aimed at improving the process of risk monitoring and understanding as well as preventing risk concentration. Limits and alerts are calibrated based on projections of future balance sheets, stockholders’ equity, liquidity, complexity and market volatility, as well as the Itaú Unibanco’s risk appetite. The consumption of market risk limits is monitored and disclosed daily through exposure and sensitivity maps. The market risk area analyzes and controls the adherence of these exposures to limits and alerts and reports them timely to the Treasury desks and other structures foreseen in the governance. Itaú Unibanco uses proprietary systems to measure the consolidated market risk. The processing of these systems takes place in an access-controlled environment, being highly available, which has data safekeeping and recovery processes, and counts on an infrastructure to ensure the continuity of business in contingency (disaster recovery) situations. Itaú Unibanco 40

Risk and Capital Management—Pillar 3 MR1: Market risk under standardized approach R$ million 06/30/2022 Risk factors RWA lnterest Rates 24,884 Fixed rate denominated in reais (RWAJuR,) 8,498 Foreign exchange linked interest rate 2) 10,395 (RWA JUR Price índex linked interest rate (RWA JUR3) 5,991 lnterest rate linked interest rate (RWAJUR4) Stock prices (RWAAcs> 1,071 Exchange rates (RWACAM) 1,062 Commodity prices (RWAcoM> 1,989 Total 29,006 In the comparison with March, we observed a general decrease in the exposure to market risk in the standardized model (RWAMPAD). MRB: Qualitative disclosures on market risk in the Internal Models Approach (IMA) In the internal models approach, the stressed VaR and VaR models are used. These models are applied to operations in the Trading Book and Banking Book. For the Trading Book, the risk factors considered are: interest rates, inflation rates, exchange rates, stocks and commodities. For the Banking Book, exchange rates and commodities are considered. The VaR and stressed VaR models are used in the companies of the Prudential Conglomerate that are presented in the following table: Itaú Unibanco 41

Risk and Capital Management—Pillar 3 lnstitution Model considered for Market Risk A 1 Hedge Orange Master Fundo de Investimento Multi mercado VaR and Stressed VaR Aj Títulos Públicos Fundo de Investimento Renda Fixa Referenciado DI VaR and Stressed VaR Banco lnvestcred Unibanco S.A. VaR and Stressed VaR Banco ltaú Argentina S.A. VaR and Stressed VaR Banco ltaú BBA S.A. VaR and Stressed VaR Banco ltaú Consignado S.A. VaR and Stressed VaR Banco ltaú Veículos S.A. VaR and Stressed VaR Banco ltauBank S.A. VaR and Stressed VaR Banco ltaucard S.A. VaR and Stressed VaR Cloudwalk Kick Ass I Fundo De Investimento Em Direitos Creditôrios VaR and Stressed VaR Dibens Leasing S.A.—Arrendamento Mercantil VaR and Stressed VaR FIDC B2cycle NPL VaR and Stressed VaR FIDC Cloudw Akira 1 VaR and Stressed VaR FIDC Sumup Solo VaR and Stressed VaR FII Kinea Desenv. LO VaR and Stressed VaR Financeira ltaú CBD S.A. Crédito, Financiamento e Investimento VaR and Stressed VaR Fundo A 1 Hedge Orange Fundo de Investimento em Cotas de Fundos de Investimento Multimercado VaR and Stressed VaR Fundo De lnvest Dir Creditórios Não Padron NPL li VaR and Stressed VaR Fundo de Investimento em Direitos Creditórios Não-Padronizados Barzel VaR and Stressed VaR Fundo de Investimento em Direitos Creditórios Rede VaR and Stressed VaR Fundo em Direitos Creditórios Cielo Emissores 1 VaR and Stressed VaR Fundo Fortaleza de Investimento Imobiliário VaR and Stressed VaR Fundo Goal Perto Ili VaR and Stressed VaR Fundo Kinea Ações VaR and Stressed VaR Hipercard Banco Múltiplo S.A. VaR and Stressed VaR lntrag Distribuidora de Títulos e Valores Mobiliários Ltda. VaR and Stressed VaR !resolve Companhia Securitizadora de Créditos Financeiros S.A. VaR and Stressed VaR ltaú Administradora de Consórcios Ltda. VaR and Stressed VaR ltaú Bank & Trust Bahamas Ltd. VaR and Stressed VaR ltaú Bank & Trust Cayman Ltd. VaR and Stressed VaR ltaú Bank, Ltd. VaR and Stressed VaR ltaú BBA Trading S.A. VaR and Stressed VaR ltaú BBA USA Securities lnc. VaR and Stressed VaR ltaú Cia. Securitizadora de Créditos Financeiros VaR and Stressed VaR ltaú Corretora de Valores S.A. VaR and Stressed VaR ltaú Distribuidora de Titulos e Valores Mobiliários S.A. VaR and Stressed VaR ltaú Kinea Private Equity Multimercado Fundo de Investimento em Cotas de Fundos de Investimento Crédito Privado VaR and Stressed VaR ltaú OT Títulos Públicos Renda Fixa Referenciado DI Fundo de Investimento em Cotas de Fundos de Investimento VaR and Stressed VaR ltaú Unibanco Holding S.A. VaR and Stressed VaR ltaú Unibanco Holding S.A., Grand Cayman Branch VaR and Stressed VaR ltaú Unibanco S.A. VaR and Stressed VaR ltaú Unibanco S.A., Grand Cayman Branch VaR and Stressed VaR ltaú Unibanco S.A., Nassau Branch VaR and Stressed VaR ltaú Unibanco Veículos Administradora de Consôrcios Ltda. VaR and Stressed VaR ltaú Valores S.A. VaR and Stressed VaR 1TB Holding Ltd. VaR and Stressed VaR Kinea Ações Fundo de Investimento em Ações VaR and Stressed VaR Kinea CO-investimento Fundo de Investimento lmobiliario VaR and Stressed VaR Kinea I Private Equity FIP Multiestrategia VaR and Stressed VaR Kinea KP Fundo de Investimento Multimercado Crédito Privado VaR and Stressed VaR Kinea Ventures FIP VaR and Stressed VaR Licania Fund Limited VaR and Stressed VaR Luizacred S.A. Sociedade de Crédito, Financiamento e Investimento VaR and Stressed VaR Microinvest S.A. Soe. de Crédito a Microempreendedor VaR and Stressed VaR Oiti Fundo de Investimento Multimercado Crédito Privado Investimento no Exterior VaR and Stressed VaR Redecard Instituição de Pagamento S.A. VaR and Stressed VaR Rede Sociedade de Crédito Direto S.A. VaR and Stressed VaR RT ltaú DJ Títulos Públicos Fundo de Investimento Renda Fixa Referenciado OI VaR and Stressed VaR RT Scala Renda Fixa—Fundo de Investimento em Cotas de Fundos de Investimento VaR and Stressed VaR RT Voyager Renda Fixa Crédito Privado—Fundo de Investimento VaR and Stressed VaR Tarumã Fundo Incentivado de Investimento em Oebêntures de Infraestrutura Renda Fixa Crédito Privado VaR and Stressed VaR Itaú Unibanco 42

Risk and Capital Management—Pillar 3 Itaú Unibanco, for regulatory purposes, uses the historical simulation methodology to calculate the VaR and Stressed VaR. This methodology uses the returns observed in the past to calculate the gains and losses of a portfolio over time, with a 99% confidence interval and a holding period of at least 10 days. On June 30, 2022, VaR represented 44% of the capital requirement, while the stressed VaR represented 56%. The same methodology is used for management purposes, that is, there are no differences between the managerial and regulatory models. In relation to the VaR model, the historical returns are daily updated. Itaú Unibanco uses in its VaR model both the unweighted approach, in which historical data have the same weight, and the weighted by the volatility of returns. For the calculation of volatilities, the Exponentially Weighted Moving Average method is used. The Historical VaR methodology with 10-day maintenance periods assumes that the expected distribution for possible losses and gains for the portfolio can be estimated from the historical behavior of the returns of the market risk factors to which this portfolio is exposed. The returns observed in the past are applied to current operations, generating a distribution of probability of losses and simulated gains that are used to estimate the Historical VaR, according to the 99% confidence level and using a historical period of 1,000 days. Losses and gains from linear operations are calculated by multiplying mark-to-market by returns, while non-linear operations are recalculated using historical returns. The returns used in simulating the movements of risk factors are relative. Regarding the Stressed VaR model, the calculation is performed for a time horizon of 10 working days, considering the 99% confidence level and simple returns in the historical period of one year. The historical stress period is periodically calculated for the period since 2004 and can be revised whenever deemed necessary. This can occur when the composition of Itaú Unibanco’s portfolios changes significantly, when changes are observed in the results of the simulation of historical returns or when a new market crisis occurs. Losses and gains from linear operations are calculated by multiplying mark to market by returns, while non-linear operations are recalculated using historical returns. In addition to the use of VaR, Itaú Unibanco carries out daily risk analysis in extreme scenarios through a diversified framework of stress tests, in order to capture potential significant losses in extreme market situations. The scenarios are based on historical, prospective crises and predetermined shocks in risk factors. One factor that has a great influence on the results of the tests, for example, is the correlation between the assets and the respective risk factors, and this effect is simulated in several ways in the various scenarios tested. In order to identify its greatest risks and assist in the decision-making of treasury and senior management, the results of stress tests are assessed by risk factors, as well as on a consolidated basis. The effectiveness of the VaR model is proven by backtesting techniques, by comparing hypothetical and actual daily losses and gains, with the estimated daily VaR, according to BACEN Circular 3,646. The number of exceptions to the established VaR limits must be compatible, within an acceptable statistical margin, with three different confidence intervals (99%, 97.5% and 95%), in three different historical windows (250, 500 and 750 working days). This includes nine different samples, therefore ensuring the statistical quality of the historical VaR hypothesis. Itaú Unibanco has a set of processes, which are periodically executed by the internal control teams, whose objective is to independently replicate the metrics that influence market risk capital by internal models. In addition to the results of the periodic processes, Itaú Unibanco assesses the process of measuring time horizons by risk factors and the estimate of the stress period for calculating the stressed VaR. The validation of the internal model includes several topics considered essential for the critical analysis of the model, such as, the evaluation of the model’s limitations, the adequacy of the parameters used in the volatility estimate and the comprehensiveness and reliability of the input data. Itaú Unibanco 43

Risk and Capital Management—Pillar 3 MR2: RWA flow statements of market risk exposures under an IMA Exposures subject to market risk The following table presents the exposures subject to market risk in the internal models approach, for calculating the capital requirement. R$ milllon VaR Stressed VaR Other Total RW~ lt:II RW~ lt:II—03/31/2022 6,785 5,752 6,476 19,013 Movement in risk leveis (830) 2,877 2,047 Updates/changes to lhe internai model Methodology and regulation Acquisitions and disposals Foreign exchange movements 1,789 1,205 2,994 Other (2,282) (2,282) RW~IIH—06/30/2022 7,744 9,834 4,194 21,772 The increase in RWAMINT from the previous quarter was mainly due to changes in exchange rates and the increased risk levels of the positions held by Itaú Unibanco. MR3: IMA values for trading portfolios The following table presents the VaR and stressed VaR values determined by the internal market risk models. 06/30/2022 R$ million VaR (10 days, 99%) Maximum value 367 Average value 195 Minimum value 80 Quarter end 225 Stressed VaR (10 days, 99%) Maximum value 387 Average value 259 Minimum value 135 Quarter end 345 VaR and stressed VaR increased from the previous quarter due to increased exposure and volatility in interest rates and currencies. Itaú Unibanco 44

Risk and Capital Management—Pillar 3 MR4: Comparison of VaR estimates with gains/losses Backtesting The effectiveness of the VaR model is validated by backtesting techniques, comparing daily hypothetical and actual results with the estimated daily VaR. The daily VaR is calculated over a one-day maintenance horizon, according to the 99% confidence level and using a historical period of 1,000 days. The percentage of capital requirement associated with this model is 100%. The backtesting analysis presented below considers the ranges suggested by the Basel Committee on Banking Supervision (BCBS). The ranges are divided into: • Green (0 to 4 exceptions): backtesting results that do not suggest any problem with the quality or accuracy of the adopted models; • Yellow (5 to 9 exceptions): intermediate range group, which indicates an early warning monitoring and may indicate the need to review the model; and • Red (10 or more exceptions): need for improvement actions. The following chart shows the comparison between VaR and actual and hypothetical results: VaR, actual and hypothetical P&L comparison 100 -100 X -150 Jul-21 Aug-21 Sep-21 Oct-21 Nov-21 Dec-21 Jan-22 Feb-22 Mar-22 Apr-22 Jun-22 —Hypothetical P&l—Actual P&l—VaR x Exceptions for hypothetical lesses O Exceptions for actual los ses The exceptions in relation to the hypothetical results occurred on 10/19/2021 and 10/21/2021, in the amounts of R$ 37,7 and R$ 7,9 million, respectively. These excesses were caused by the increased level of local interest market volatility. In relation to the actual results, the exceptions also ocurred on 10/19/2021 and 10/21/2021, in the amounts of R$ 23,2 and R$ 3,5 million, respectively. These excesses were caused by the increased level of local interest market volatility. The actual results do not include fees, brokerage fees and commissions. There are no profit reserves. Itaú Unibanco 45

Risk and Capital Management—Pillar 3 Total Exposure associated with Derivatives The main purpose of the derivative positions is to manage risks in the Trading Book and in the Banking Book in the corresponding risk factors. Derivatives: Trading and Banking RS mlllion 06/3012022 Wlth Central Counterparty Wlthout Central Counterparty Onshore Offshore Onsho re Offshore Risk Factors Long Short Long Short Long Short Long Short lnterest Rates 120,992 (218,220) 17,498 (10,632) 73,349 (91,437) 69,844 (96,599) Foreign Exchange 276,294 (250,604) 136,691 (141,199) 25,146 (48,202) 274,554 (261,231) Equities 6,327 (5,735) 557 (4,047) 99 (641) Commodíties 583 (1,447) (7) 1,397 (508) IRRBBA: IRRBB risk management objectives and policies BACEN’s (Central Bank of Brazil) Circular 3,876, published in January 2018, states on methodologies and procedures for evaluation of the capital adequacy, held to cover interest rates risk from instruments held in the banking book. For the purposes of this Circular, are defined: • â^†EVE (Delta Economic Value of Equity) is defined as the difference between the present value of the sum of repricing flows of instruments subject to IRRBB in a base scenario, and the present value of the sum of repricing flows of the same instruments in an interest-rate shocked scenario; • â^†NII (Delta Net Interest Income) is defined as the difference between the result of financial intermediation of instruments subject to IRRBB in a base scenario, and the result of financial intermediation of the same instruments in an interest-rate shocked scenario. The sensibility analysis introduced here are just a static evaluation of the portfolio interest rate exposure, and, therefore, don´t consider the dynamic management of the treasury desk and risk control areas, which hold the responsibility for measures to mitigate risk under an adverse situation, minimizing significant losses. Moreover, it is highlighted, though, the results presented do not translate into accountable or economic results for certain, because this analysis has, only, an interest rate risk disclosure purpose and to demonstrate the principle protection actions, considering the instruments fair value, apart from any accounting practices adopted by Itaú Unibanco. The institution uses an internal model to measure â^†EVE and â^†NII. â^†EVE results do not represent immediate impact in the stockholders’ equity. Meanwhile, â^†NII results indicate potential volatility in the projected interest rates results. In compliance with the circular 3,876, the following demonstrates qualitative and quantitative details of risk management for IRRBB in Itaú Unibanco. Framework and Treatment Interest rate risk in the banking book refers to the potential risk of impact on capital sufficiency and/or on the results of financial intermediation due to adverse movements in interest rates, taking into account the principal flows of instruments held in the banking book. The main point of assets and liabilities management is to maximize the risk-return ratio of positions held in the banking book, taking into account the economic value of these assets/liabilities and the impact on actual and future bank’s results. Itaú Unibanco 46

Risk and Capital Management—Pillar 3 The interest rate risk managing on transactions held in the banking book occurs within the governance and hierarchy of decision-making bodies and under a limits structure and alerts approved specifically for these purpose, which is sensitive due to different levels and classes of market risk. The management structure of IRRBB has it owns risk policies and controls intended to ensure adherence to the bank’s risk appetite. The IRRBB framework has granular management limits for several other risk metrics and consolidated limits for â^†EVE and â^†NII results, besides the limits associated with stress tests. The asset and liability management unit is responsible for managing timing mismatches between asset and liability flows, and minimizes interest rate risk by through strategies as economic hedge and accounting hedge. All the models associated with IRRBB have a robust independent validation process and are approved by a CTAM (Technical Model Assessment Commission). In addition, all the models and processes are assessed by internal audit. The interest rate risk framework in the banking book uses management measurements that are calculated daily for limit control. The â^†EVE and â^†NII metrics are calculated according to the risk appetite limits and the other risk metrics in terms of management risk limits. In the process of managing interest rate risk of the banking book, transactions subject to automatic options are calculated according to internal market models which split the products, as far as possible, into linear and non-linear payoffs. The linear payoffs are treated similarly to any other instruments without options, and for non-linear payoffs an additional value is computed and added on the â^†EVE and â^†NII metrics. In general terms, transactions subject to behavioral options are classified as deposits with no contractual maturity date defined or products subject to early repayment. Non-maturity deposits are classified according to their nature and stability to guarantee compliance with regulatory limits. A survival analysis model treats the products subject to prepayment, using the historical dataset to calibrate its parameters. The instruments flows with homogeneous characteristics are adjusted by specific models to reflect, in the most appropriate way, the repricing flows of the instruments. The banking book consists of asset and liability transactions originating in different commercial channels (retail and wholesale) of Itaú Unibanco. The market risk exposures inherent in the banking book consists of various risk factors, which are primary components of the market in price formation. IRRBB also includes hedging transactions intended to minimize risks deriving from strong fluctuations of market risk factors and their accounting asymmetries. Market risk generated from structural mismatches is managed by a variety of financial instruments, such as exchange-traded and over-the-counter derivatives. In some cases, operations using derivative financial instruments can be classified as accounting hedges, depending on their risk and cash flow characteristics. In these cases, the supporting documentation is analyzed to enable the effectiveness of the hedge and other changes in the accounting process to be continuously monitored. The accounting and administrative procedures for hedging are defined in BACEN Circular 3,082. The IRRBB model includes a series of premises: • â^†EVE and â^†NII are measured on the basis of the cash flows of the banking book instruments, broken down into their risk factors to isolate the effect of the interest rate and the spread components; • For non-maturity deposits, the models are classified according to their nature and stability and distributed over time considering the regulatory limits; Itaú Unibanco 47

Risk and Capital Management—Pillar 3 • The institution uses survival analysis models to handle credit transactions subject to prepayment, and empirical models for transactions subject to early redemption. Other Risks Insurance products, pension plans and premium bonds risks Products that compose portfolios of insurance companies of Itaú Unibanco are related to life and elementary insurance, as well as pension plans and premium bonds. The main risks inherent in these products are described below and their definitions are given in their respective chapters. • Underwriting Risk: possibility of losses arising from insurance products, pension plans and premium bonds that go against institution’s expectations, directly or indirectly associated with technical and actuarial bases used for calculating premiums, contributions and technical provisions; • Market Risk; • Credit Risk; • Operational risk; • Liquidity risk. In line with domestic and international best practices, Itaú Unibanco has a risk management structure which ensures that risks resulting from insurance, pension and special savings products are properly assessed and reported to the relevant forums. The process of risk management for insurance, pensions and premium bond plans is independent and focus on the special nature of each risk. The aim of Itaú Unibanco is to ensure that assets serving as collateral for long-term products, with guaranteed minimum returns, are managed according to the characteristics of the liabilities, so that they are actuarially balanced and solvent over the long term. Social, Environmental and Climatic Risks They are the possibility of losses due to exposure to social, environmental and/or climatic events related to the activities developed by the ITAÚ UNIBANCO HOLDING. Social and environmental factors are considered relevant to the business of ITAÚ UNIBANCO HOLDING, since they may affect the creation of shared value in the short, medium and long term. The Policy of Social, Environmental and Climatic Risks (Risks SAC Policy) establishes the guidelines and underlying principles for social, environmental and climatic risks management, addressing the most significant risks for the Institution’s operation through specific procedures. Actions to mitigate the Social, Environmental and Climatic Risks are taken based on the mapping of processes, risks and controls, monitoring of new standards related to the theme and record of occurrence in internal systems. In addition Itaú Unibanco 48

Risk and Capital Management—Pillar 3 to the identification, the phases of prioritization, response to risk, mitigation, monitoring and reporting of assessed risks supplement the management of this risk at ITAÚ UNIBANCO HOLDING. In the management of Social, Environmental and Climatic Risks, business areas manage the risk in its daily activities, following the Risks SAC Policy guidelines, specific processes, with the support of specialized assessment from dedicated technical teams located in Corporate Compliance, Credit Risk and Modeling, and Institutional Legal teams, that act on an integrated way in the management of all dimensions of the Social, Environmental and Climatic Risks related to the conglomerate’s activities. As an example of specific guidelines for the management of these risks, ITAÚ UNIBANCO HOLDING has specific governance for granting and renewing credit in senior approval levels for clients in certain economic sectors, classified as Sensitive Sectors (Mining, Steel & Metallurgy, Oil & Gas, Textiles, Paper & Pulp, Chemicals & Petrochemicals, Meatpacking, Crop Protection and Fertilizers, Wood, Energy, Rural Producers and Real Estate), for which there is an individualized analysis of Social, Environmental and Climate Risks. ITAÚ UNIBANCO HOLDING also counts with specific procedures for the Institution’s operation (stockholders’ equity, branch infrastructure and technology), suppliers, credit, investments and key controls. Credit Risk and Modeling, Internal Controls and Compliance areas, in turn, support and ensure the governance of the business areas’ activities. The Internal Audit, acts on an independent manner, assessing risk management, controls and governance. Governance also counts on the Social, Environmental and Climatic Risks Committee, whose main responsibility is to assess and deliberate about institutional and strategic matters, as well as to resolve on products, operations, and services, among others involving the Social, Environmental and Climatic Risks. Climate Risk includes: (i) physical risks, arising from changes in weather patterns, such as increased rainfall and temperature and extreme weather events, and (ii) transition risks, resulting from changes in the economy as a result of climate actions, such as carbon pricing, climate regulation, market risks and reputational risks. Considering its relevance, climate risk has become one of the main priorities for ITAÚ UNIBANCO HOLDING, which supports the Task Force on Climate-related Financial Disclosures (TCFD) and it is committed to its implementation of its recommendations. With this purpose, ITAÚ UNIBANCO HOLDING is strengthening the governance and strategy related to Climate Risk and developing tools and methodologies to assess and manage these risks. ITAÚ UNIBANCO HOLDING measures the sensitivity of the credit portfolio to climate risks by applying the Climate Risk Sensitivity Assessment Tool, developed by Febraban. The tool combines relevance and proportionality criteria to identify the sectors and clients within the portfolio that are more sensitive to climate risks, considering physical and transition risks. The sectors with the highest probability of suffering financial impacts from climate change, following the TCFD guidelines are: energy, transport, materials and construction, agriculture, food and forestry products. Model Risk The model risk arises from the incorrect development or maintenance of models, such as mistaken assumptions, and inappropriate use or application of the model. The use of models can lead to decisions that are more accurate and therefore it is a major practice in the institution. The models have supported strategic decisions in several contexts, such as credit approval, pricing, volatility curve estimation, calculation of capital, among others. Due to the increasing use of models, driven by the application of new technologies and the expansion of data use, Itaú Unibanco has improved its governance in relation to its development, implantation, use and monitoring, through the definition of guidelines, policies and procedures aimed at assuring the quality and mitigation of the associated risks. Itaú Unibanco 49

Risk and Capital Management—Pillar 3 The performance of the areas responsible for models is evaluated by the Operational Risk and Internal Audit teams to ensure adherence to such policies. The opportunities for improvement found during these assessments are duly addressed with action plans, which are followed up by the 3 lines of defense and by senior management until their conclusion. Regulatory or Compliance Risk Regulatory or Compliance risk is the risk of sanctions, financial losses or reputational damage arising from the lack of compliance with legal and regulatory provisions, local and international market standards, internal policies, commitments with regulators, voluntary commitments, in addition to self-regulation codes and codes of conduct adhered by Itaú Unibanco. This risk is managed through a structured process aimed at identifying changes in the regulatory environment, analyzing their impacts on the departments of the institution and monitoring the actions directed at adherence to the regulatory requirements and other commitments mentioned above. This structured process includes the following actions: (i) to understand the changes in the regulatory environment; (ii) to monitor regulatory trends; (iii) to care for the relationship between the institution and the regulator, self-regulatory bodies and the representation entity; (iv) to monitor action plans on regulatory or self-regulatory compliance; (v) to coordinate a program to comply with significant norms, such as Integrity and Ethics; and (vi) to report regulatory issues in Operational and Compliance Risk forums, according to the structure of committees established in internal policies. Reputational Risk Itaú Unibanco understands reputational risk as the risk arising from internal practices and/or external factors that may generate a negative perception of Itaú Unibanco by customers, employees, shareholders, investors, regulatory bodies, government, suppliers, the press and the society in general. It can impact the bank’s reputation, the value of its brand and/or result in financial losses. Besides, this can affect the maintenance of existing business relationships, access to sources of fundraising, the attraction of new business and talent to compose the company’s staff or even the license to operate. The institution believes that its reputation is extremely important for achieving its long-term goals, which is why it seeks the alignment of the speech, the action and the ethical and transparent practice, essential to raise the confidence of Itaú Unibanco’s stakeholders. Itaú Unibanco’s reputation depends on its strategy (vision, culture and skills) and derives from direct or indirect experience of the relationship between Itaú Unibanco and its stakeholders. Since the reputational risk directly or indirectly permeates all operations and processes of the institution, Itaú Unibanco’s governance is structured in a way to ensure that potential risks are identified, analyzed and managed still in the initial phases of its operations and analysis of new products, including the use of new technologies. The treatment given to reputational risk is structured by means of many processes and internal initiatives, which, in turn, are supported by internal policies, and their main purpose is to provide mechanisms for the monitoring, management, control and mitigation of the main reputational risks. Among them are (i) risk appetite statement; (ii) process for the prevention and fight against unlawful acts; (iii) crisis management process and business continuity; (iv) processes and guidelines of the governmental and institutional relations; (v) corporate communication process; (vi) brand management process; (vii) ombudsman offices initiatives and commitment to customer satisfaction; and (vii) ethics guidelines and prevention of corruption. Itaú Unibanco 50

Risk and Capital Management—Pillar 3 Financial institutions play a key role in preventing and fighting illegal acts, in particular money laundering, terrorist financing and fraud, in which the challenge is to identify and suppress increasingly sophisticated operations that seek to conceal the origin, location, disposition, ownership and movement of goods and money derived, directly or indirectly, from illegal activities. Itaú Unibanco has introduced a corporate policy in order to prevent its involvement in illegal acts and to protect its reputation and image towards employees, clients, strategic partners, suppliers, service providers, regulators and society, through a governance structure based on transparency, strict compliance with rules and regulations, including BACEN Circular 3,978/20 among others, and cooperation with police and judicial authorities. It also seeks a continuously alignment with local and international best practices for preventing and fighting against illegal acts, through investing and training eligible employees. In compliance with the guidelines of this corporate policy, Itaú Unibanco established a program to prevent and fight against illegal acts based on the following pillars: • Policies and Procedures; • Client Identification Process; • Know Your Customer (KYC) Process; • Know Your Partner (KYP) Process; • Know Your Supplier (KYS) Process; • Know Your Employee (KYE) Process; • Assessment of New Products and Services; • Compliance with Sanctions; • Monitoring, Selection and Analysis of Suspicious Operations or Situations; • Reporting Suspicious Transactions to the Regulatory Bodies; and • Training. This program applies to the entire institution, including subsidiaries and affiliates in Brazil and abroad. The preventing and combating unlawful acts governance is carried out by the Board of Directors, Audit Committee, Operational Risk Committee, Risk and Capital Management Commitee and Anti-Money Laundering Committees. The document that presents the guidelines established in the corporate program to prevent and combat unlawful acts may be seen on the www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Policies, Corporate Policy for Prevention and Fight Against Illegal Acts. In addition, Itaú Unibanco has been developing various data analysis models to improve customer risk classification, transaction monitoring and KYC methodology to provide greater accuracy in its analysis and to decrease false-positives. Itaú Unibanco has also been innovating its modeling solutions using new methods based on machine learning techniques to identify potentially suspicious activities. Moreover, Itaú Unibanco is committed to protecting corporate information and ensuring client and general public privacy in any transactions. To this end, it has a Corporate Information Security Policy and Cyber Secutity and has a monitoring Itaú Unibanco 51

Risk and Capital Management—Pillar 3 process and a control structure that covers technology, business areas and international units, adhering to principal regulatory bodies and external audits, and best market practices and certifications. The Corporate Information Security and Cyber Security Policy can be viewed on the website www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Policies, Corporate Policy on Information Security and Cyber Security. Country Risk The country risk is the risk of losses related to non-compliance with obligations in connection with borrowers, issuers, counterparties or guarantors, as a result of political-economic and social events or actions taken by the government of the country. Itaú Unibanco has a specific structure for the management and control of country risk, consisting of corporate bodies and dedicated teams, with responsibilities defined in policies. The institution has a structured and consistent procedure, including: (i) establishment of country ratings; (ii) determination of limits for countries; (iii) monitoring the use of limits. Business and Strategy Risk Business and strategy risk is the risk of a negative impact on the results or capital as a consequence of a faulty strategic planning, the making of adverse strategic decisions, the inability of Itaú Unibanco to implement the proper strategic plans and/or changes in its business environment. Itaú Unibanco has implemented many mechanisms that ensure that both the business and the strategic decision-making processes follow proper governance standards, have the active participation of executives and the Board of Directors, are based on market, macroeconomic and risk information and are aimed at optimizing the risk-return ratio. Decision-making and the definition of business and strategy guidelines, count on the full engagement of the Board of Directors, primarily through the Strategy Committee, and of the executives, through the Executive Committee. In order to handle risk adequately, Itaú Unibanco has governance and processes to involve the Risk Area in business and strategy decisions, so as to ensure that risk is managed and decisions are sustainable in the long term. They are: (i) qualifications and incentives of board members and executives; (ii) budget process; (iii) product assessment; (iv) evaluation and prospecting of proprietary mergers and acquisitions; and (v) a risk appetite framework which, for example, restricts the concentration of credit and exposure to specific and material risks. Contagion Risk Contagion Risk is the possibility of losses occurring for entities that are part of the Prudential Conglomerate as a result of financial support to unconsolidated entities, in a stressful situation, in the absence or in addition to the obligations provided for in the contract. Itaú Unibanco has a structure for risk management and control, a dedicated team and a policy that defines roles and responsibilities. This structure covers (i) the identification of entities in relation to the potential generation of contagion risk, (ii) the assessment of risks in relationships, (iii) the monitoring, control and mitigation of contagion risk, (iv) the assessment of impact on capital and liquidity and (v) reports. It is part of the scope of contagion risk governance: Related Party audiences, mainly composed of controllers ((individuals and legal entities), entities related to them and controlled and related entities (as defined in Res. 4,693 / 18), foundations, investments in non-consolidated entities, suppliers of critical products and services, assigness, buyers Itaú Unibanco 52

Risk and Capital Management—Pillar 3 and sellers of relevant assets, third parties with products distributed by Itaú Unibanco and third parties to whom Itaú Unibanco distributes products, besides all the analysis of the international Units. Emerging Risks They are those with a potentially material impact on the business in the medium and long terms, but for which there are not enough elements yet for their complete assessment and mitigation due to the number of factors and impacts not yet totally known, such as technological alternatives in replacement of traditional banking services and the demographic transition of clients in contrast to technological innovations. Their causes can be originated by external events and result in the emergence of new risks or in the intensification of risks already monitored by ITAÚ UNIBANCO HOLDING CONSOLIDATED. The identification and monitoring of Emerging Risks are ensured by ITAÚ UNIBANCO HOLDING CONSOLIDATED’s governance, allowing these risks to be incorporated into risk management processes too. Operational Risk Operational risk is defined as the possibility of losses arising from failure, deficiency or inadequacy of internal process, people or systems or from external events that affect the achievement of strategic, tactical or operational objectives. It includes legal risk associated with inadequacy or deficiency in contracts signed by the institution, as well as penalties due to noncompliance with laws and punitive damages to third parties arising from the activities undertaken by the institution. Itaú Unibanco internally classifies its risk events in: • Internal fraud; • External fraud; • Labor claims and deficient security in the workplace; • Inadequate practices related to clients, products and services; • Damages to own physical assets or assets in use by Itaú Unibanco; • Interruption of Itaú Unibanco’s activities; • Failures in information technology (IT) systems, processes or infrastructure; • Failures in the performance, compliance with deadlines and management of activities at Itaú Unibanco. Operational risk management includes conduct risk, which is subject to mitigating procedures to assess product design and incentive models. The inspection area is responsible for fraud prevention. Irrespective of their origin, specific cases may be handled by risk committees and integrity and ethics committees. Itaú Unibanco has a governance process that is structured through forums and corporate bodies composed of senior management, which report to the Board of Directors, with well-defined roles and responsibilities in order to segregate the business and management and control activities, ensuring independence between the areas and, consequently, well-balanced decisions with respect to risks. Itaú Unibanco 53

Risk and Capital Management—Pillar 3 This is reflected in the risk management process carried out on a decentralized basis under the responsibility of the business areas and by a centralized control carried out by the internal control, compliance and operational risk department, by means of methodologies, training courses, certification and monitoring of the control environment in an independent way. The managers of the executive areas use corporate methods constructed and made available by the Operational Risk and Corporate Compliance and Money Laundering Prevention Areas. Among the methodologies and tools used are the self-evaluation and the map of the institution’s prioritized risks, the approval of processes, products, the monitoring of key risk indicators and the database of operational losses, guaranteeing a single conceptual basis for managing processes, risks, projects and new products and services. Within the governance of the risk management process, regularly, the consolidated reports on risk monitoring, controls, action plans and operational losses are presented to the business area executives. In line with CMN Resolution 4,557, the document “Public Report – Integrated Management of Operational Risk /Internal Controls/Compliance”, summarized version of the institutional operational risk management policy can be found on the website www.itau.com.br/investor-relations, section Itaú Unibanco, under Corporate Governance, Rules and Policies, Reports. Crisis Management and Business Continuity Itaú Unibanco’s Business Continuity Program’s purpose is to protect its employees, ensure the continuity of the critical functions of its business lines and sustain both the stability of the markets in which it operates and the confidence of its customers and strategic partners in its provision of services and products. It establishes the Business Continuity Plan (BCP), which consists of modular procedures that are available for use in the event of incidents. The descriptions/characteristics of the existing plans are: • Disaster Recovery: it aims to ensure the availability and integrity of Information Technology resources and communication in the event of a failure in the primary Data Center to maintain the processing of critical systems; • Workplace Contingency: alternative facilities to perform the activities in the event the administrative buildings become unavailable; • Operational Contingency: alternatives to carry out critical processes whether they are systemic, procedural or emergency responses. In order to keep the continuity solutions aligned with the business requirements (processes, minimum resources, legal requirements, etc) the Program applies the following tools to assess the institution: • Business Impact Analysis (BIA): evaluates the criticality and resumption requirement of the processes that support the delivery of products and services. • Threats and Vulnerabilities Analysis (AVA): identification of threats near to Itaú Unibanco’s buildings. Considering the dependence that some processes have on third-party services, the Business Continuity Program conducts an assessment of the risk of unavailability of services provided with a view to resilience to threats of interruption. Itaú Unibanco 54

Risk and Capital Management—Pillar 3 The institution has a Crisis Management Program, which is aimed at managing business interruption events, natural disasters, impacts of an environmental, social, and infrastructure/operational (including information technology) or of any other nature that jeopardize the image and reputation and/or viability of Itaú Unibanco’s processes with its employees, clients, strategic partners and regulators, with timely and integrated responses. The Program establishes a frequent flow of acculturation with the company’s senior management, as well as a constant analysis of high-impact scenarios and events to establish response plans in line with current threats. To assess efficiency and identify points for improvement in crisis response plans, tests are carried out at least once a year. Independent Validation of Risk Models Itaú Unibanco validates the processes and risk models independently. This is done by a department which is separate from the business and risk control areas, to ensure that its assessments are independent. The validation method, defined in an internal policy, meets regulatory requirements such as those of BACEN Circulars 3,646 and 3,674, 3.876 and Resolutions 2,682 and 4,557. The validation stages include: • Verification of mathematical and theoretical development of the models; • Qualitative and quantitative analysis of the models, including the variables, construction of an independent calculator and the use of appropriate technical; • When applicable, comparison with alternative models and international benchmarks; • Historical Backtesting of the model; • Assessment of the adequacy of the implementation of the models in the systems used. Additionally, the validation area assesses the stress testing program. The performance of the independent validation area and the validation of the processes and models are assessed by Internal Audit and reported to the specific senior management committees. Action plans are prepared to address opportunities identified during the independent validation process, and are monitored by the 3 lines of defense and by senior management until the conclusion. Itaú Unibanco 55

Risk and Capital Management—Pillar 3 Glossary of Acronyms A • ASF – Available Stable Funding • AT1 – Additional Tier 1 Capital • AVA – Avaliação de Vulnerabilidade e Ameaças(Threats and Vulnerabilities Analysis) B • BACEN—Banco Central do Brasil (Central Bank of Brazil) • BCB—Banco Central do Brasil (Central Bank of Brazil) • BCP – Business Continuity Plan • BCBS—Basel Committee on Banking Supervision • BIA – Business Impact Analysis • BIS – Bank for International Settlements C • CCF – Credit Conversion Factor • CCP – Non-Qualified Central Counterparty • CCR – Counterparty Credit Risk • CDP – Carbon Disclosure Project • CEM—Current Exposure Method • CEO—Chief Executive Officer • CET 1—Common Equity Tier I • CGRC—Comitê de Gestão de Risco e Capital (Risk and Capital Management Committee) • CMN—Conselho Monetário Nacional (National Monetary Council) • Comef—Comitê de Estabilidade Financeira (Financial Stability Committee) • CRI – Real State Receivables Certificate Itaú Unibanco 56

Risk and Capital Management—Pillar 3 • CRM – Credit Risk Mitigation • CRO—Chief Risk Officer • CTAM – Comissão Técnica de Avaliação de Modelos (Technical Model Assessment Commission) • CVA—Credit Valuation Adjustment • CVM—Comissão de Valores Mobiliários (Brazilian Securities and Exchange Commission) D • DLP—Long- Term Liquidity Statement • DRL—Liquidity Risk Statement • D-SIB—Domestic Systemically Important Banks • DV—Delta Variation E • EAD – Exposure at Default • ECL – Expected Credit Losses • EMD – Entidades Multilaterais de Desenvolvimento (Multilateral Development Entities) • EP – Equator Principles • EVE – Economic Value of Equity F • FCC—Credit Conversion Credit • FEBRABAN—Brazilian Federation of Banks • FIDC—Credit Rights Investment Funds • FPR—Fator de Ponderação de Risco (Weighting Factor) G • GAP—Gap Analysis • GDP—Gross Domestic Product • GHG – Greenhouse Gas Protocol Itaú Unibanco 57

Risk and Capital Management—Pillar 3 • Greeks – Sensitivities to Various Risk Factors • G-SIB – Global Systemically Important Banks H • HE – Haircut of Execution • HQLA – High Quality Liquid Assets • HV – Volatility Haircut I • ICAAP – Internal Capital Adequacy Assessment Process • IMA – Internal Models Approach • IPV – Independent Price Verification • IRRBB – Interest Rate Risk in the Banking Book • IT – Information Technology K • KYC – Know your Customer • KYP – Know your Partner • KYS – Know your Supplier • KYE – Know your Employee L • LCR – Liquidity Coverage Ratio • LMM—Limite de Mitigação Máxima (Maximum Mitigation Limit) M • MtM— Mark to Market Itaú Unibanco 58

Risk and Capital Management—Pillar 3 N • NII – Net Interest Income • NSFR – Net Stable Funding Ratio O • OTC – Over-the-Counter P • PR – Patrimônio de Referência (Total Capital) • PRI – Principles for Responsible Investments • PCR – Potential Credit Risk • PVA – Prudent Valuation Adjustments Q • QCCP – Qualified Central Counterparties R • RA – Leverage Ratio • RAS—Risk Appetite Statement • RSF – Required Stable Funding • RWA—Risk Weighted Assets • RWACPAD—Portion relating to exposures to credit risk • RWACPrNB—amount of risk-weighted assets corresponding to credit risk exposures to the non-banking private sector, calculated for jurisdictions whose ACCPi is different from zero • RWAMINT—Portion relating to exposures to market risk, using internal approach • RWAMPAD—Portion relating to exposures to market risk, calculated using standard approach • RWAOPAD—Portion relating to the calculation of operational risk capital requirements Itaú Unibanco 59

Risk and Capital Management—Pillar 3 S • SA – Joint-Stock Company • SAC—Social, Ambiental e Climático (Social, Environmental and Climatic) • SA-CCR – Standardised Approach to Counterparty Credit Risk • SFN – Sistema Financeiro Nacional (National Financial System) • SFT – Securities Financing Transactions T • TCFD – Task Force on Climate-Related Financial Disclosures • TLAC – Total Loss-Absorbing Capacity • TVM—Títulos de valores mobiliários (Securities) V • VaR—Value at Risk Itaú Unibanco 60

Risk and Capital Management—Pillar 3 Glossary of Regulations • BACEN Circular No. 3,354, of June 27th, 2007 • BACEN Circular No. 3,644, of March 4th, 2013 • BACEN Circular No. 3,646, of March 04th, 2013 • BACEN Circular No. 3,674, of October 31st, 2013 • BACEN Circular No. 3,748, of February 26th, 2015 • BACEN Circular No. 3,749, of March 05th, 2015 • BACEN Circular No. 3,751 of March 19th, 2015 • BACEN Circular No. 3,769, of October 29th, 2015 • BACEN Circular No. 3,809, of August 25th, 2016 • BACEN Circular No. 3,846, of September 13rd, 2017 • BACEN Circular No. 3,869, of December 19th, 2017 • BACEN Circular Letter No. 3,907 of September 10th, 2018 • BACEN Circular Letter No. 3,876 of January 31st, 2018 • BACEN Circular Letter No. 3,082 of January 30th, 2012 • BACEN Circular Letter No. 3,978 of January 23rd, 2020 • BACEN Communication No. 38.702, of May 26th, 2022 • BCB Resolution No. 54, of December 16th, 2020 • CMN Resolution No. 2,682, of December 22nd, 1999 • CMN Resolution No. 4,955, of October 21st, 2021 • CMN Resolution No. 4,958, of October 21st, 2021 • CMN Resolution No. 4,327, of April 25th, 2014 • CMN Resolution No. 4,502, of June 30th, 2016 Itaú Unibanco 61

Risk and Capital Management—Pillar 3 • CMN Resolution No. 4,557, of February 23rd, 2017 • CMN Resolution No. 4,589, of June 29th, 2017 • CMN Resolution No. 4,693, of October 29th, 2018 Itaú Unibanco 62