Banco Santander Brasil (BSBR) Risk Factors

The Brazilian government's measures to fight inflation, mainly through the Brazilian Central Bank, have had significant effects on the Brazilian economy and our business, and could continue to do so. Tight monetary policies with high compulsory reserve requirements may restrict Brazil's growth and the availability of credit, reduce our loan volumes and increase our loan loss provisions. Conversely, interest rate decreases may trigger increases in inflation and, consequently, growth volatility and the need for sudden and significant interest rate increases, which could negatively affect our spreads. As a result of inflationary pressures that have arisen in Brazil in early 2021 and which grew in intensity on a global scale throughout 2022, the Brazilian Central Bank began to tighten its monetary policy and began to increase the SELIC rate in mid-March 2021, ultimately reaching 9.25% at the end of 2021. This cycle continued into 2022, with the SELIC rate reaching a high of 13.75% in August 2022, at which point the Brazilian Central Bank resolved to keep it at that level. The SELIC rate remained at 13.75% for nearly a year, as inflation remained closer to the upper level of the Brazilian Central Bank's targeted level pursuant to applicable law (3.25% for 2023 and 3.0% onward). In August 2023 as inflation subsided, the Brazilian Central Bank started reducing the SELIC rate, with the SELIC rate reaching 11.75% as of December 31, 2023. As of the date of this annual report, the SELIC rate is at 11.25% per annum. Our income, expenses, assets and liabilities are impacted by interest rates levels and volatility. Therefore, our results of operations and financial condition are affected by inflation, interest rate fluctuations and monetary policies. Changes in these variables may materially and adversely affect the growth of the Brazilian economy, our loan portfolios, our cost of funding and our income from credit operations. We estimate that, in 2023 a 1.0% increase in the base interest rate would have resulted in a decrease, respectively, in our net interest income of R$733 million within the following 12-month period. Any changes in interest rates may negatively impact our business, financial condition and results of operations. In addition, increases in base interest rates may adversely affect us by reducing the demand for our credit and investment products, increasing funding costs, and increasing the risk of default by our customers in the short run. Inflation adversely affects our personnel and other administrative expenses that are directly or indirectly tied to inflation indexes, such as the IPCA, and the IGP-M. For example, considering the amounts in 2023, each additional percentage point change in the IPCA rate would impact our personnel and other administrative expenses by approximately R$99 million and R$83 million, respectively. Inflation for the years ended December 31, 2021, 2022 and 2023, as measured by the IPCA, was 10.06%, 5.79% and 4.6%, respectively. Increased inflation in the year ended December 31, 2022 resulted mainly from temporary supply shocks affecting the prices of foodstuffs. These inflationary pressures persisted in 2023 and early 2024, and have also been compounded by additional pressures, including events that hit electricity generation and led to an increase in energy prices, disruption in supply chains, the depreciation of the real, the ongoing war between Ukraine and Russia, conflict in the Middle East and the continued COVID-19 pandemic (particularly in China), among others. As a result, inflation in mid-2022 peaked at multiple-year highs of 12.1% in Brazil (as measured by the IPCA in April 2022), which led the Brazilian government to introduce tax cuts on selected items. This helped to ease pressures on prices and led to the accumulated IPCA for the year ended December 31, 2022 being 5.79%. Some of the tax exemptions put in place in 2022 were reversed in 2023, thus adding to the inflationary pressures affecting the Brazilian economy in 2023. However, the delayed effects of tight monetary policy, favorable climatic conditions and a stronger real in 2023 than in 2022 helped reduce inflation in the second half of 2023, which led the IPCA to end 2023 at 4.6%, which was below the level recorded in 2022, but still above the 3.25% targeted level set by the Brazilian Central Bank pursuant to applicable law. Inflation, government measures to curb inflation, and speculation related to possible measures regarding inflation may significantly contribute to uncertainty regarding the Brazilian economy and weaken investors' confidence in Brazil. Any such developments may have a material adverse effect on us.

Risks associated with climate change are gaining increasing social, regulatory, economic and political relevance, both in Brazil and globally. New regulations related to climate change may affect our operations and business strategy, leading us to incorporate financial costs resulting from the following risk drivers: - Transitional risks associated with the move to a low-carbon economy, both at idiosyncratic and systemic levels, such as through policy, regulatory and technological changes and business and consumer preferences, which could increase our expenses and impact our strategies. We expect that financial services providers may undergo significant developments in terms of stakeholder, policy, legal and regulatory expectations relating to our lending activities and the value of our financial assets as regards the ESG impact of our activities. As a result, we expect that we will face greater scrutiny with respect to our business and the customers we transact with. Our operational decision-making in certain industries or projects associated with causing or exacerbating climate change may be affected as we seek to adapt our practices to avoid reputational and client relationship harm, both of which may in turn impact customer demand for our products, returns on certain business activities and the value of certain assets and trading positions resulting in impairment changes. Recent developments which may have an effect on our operations and/or those of our customers include European Union Regulation 2023/1115 on deforestation-free products, which may have a significant impact on Brazilian agribusiness, and the proposal under discussion in the Brazilian Congress to regulate the carbon credit market (Bill of Law No. 2148/2021) which may lead to an increase in operating costs for customers. - Physical risks related to discrete events, such as flooding and wildfires, and extreme weather impacts and longer-term shifts in climate patterns, such as extreme heat, sea level rise and more frequent and prolonged drought, which could result in financial losses that could impair asset values and the creditworthiness of our customers. For example, Brazil suffered extreme weather events in 2023, which is believed to be due to the El Niño weather phenomenon. Such events could disrupt our operations or those of our customers or third parties on which we rely and do business with, including through direct damage to assets and indirect impacts from supply chain disruption and market volatility. If we fail to adequately embed risks arising from climate change into our risk and operational frameworks to appropriately measure, manage and disclose the various financial and operational risks that may result from climate change, or if we fail to adapt our strategy and business model to a changing regulatory and market environment, we may face significant adverse impacts on our business growth rates, competitiveness, profitability, capital requirements, cost of funding and financial condition. These primary drivers could materialize, among others, in the following financial risks: - Credit risks: Physical climate change could lower corporate revenues, increase operating costs and lead to increased credit exposure. Severe weather could also affect collateral value. Additionally, companies with business models not aligned with the transition to a low-carbon economy may face a higher risk of reduced corporate earnings and business disruption due to new regulations or market shifts. - Market risks: Market changes in the most carbon-intensive sectors could affect energy and commodity prices, corporate bonds, equities and certain derivatives contracts. Increasing frequency of severe weather events could affect macroeconomic conditions, weakening fundamental factors such as economic growth, employment and inflation, and lead to higher volatility. - Liquidity risks: Companies could face liquidity risks derived from cash outflows to improve their reputation in the market or solve climate-related problems. Extreme weather events could also affect the value of our high-quality liquid assets or cause sovereign debt to rise limiting our access to capital markets. - Operational risks: Severe weather events could damage assets and directly impact business continuity of both of our customers' and our operations. Climate-related financial risks could also cause operational risk losses from litigation if, for example, we are perceived to misrepresent sustainability-related practices, achievements, metrics goals or targets. - Regulatory compliance risks: Increased regulatory compliance risk may result from the increasing focus, pace, breadth and depth of regulatory expectations requiring implementation in short timeframes across multiple jurisdictions and from changes in public policy, laws and regulations in connection with climate change and related environmental sustainability matters. - Reputational risks: Our reputation and client relationships may be damaged as a result of our practices, disclosures and decisions related to climate change and social and environmental issues, or to the practices or involvement of our clients, vendors or suppliers in certain industries or projects being associated with causing or exacerbating climate change. Furthermore, parties who may suffer losses from the effects of climate change may seek compensation from those they hold responsible such as state entities, regulators, investors and lenders. We could face conduct risks derived from misrepresentations in our sustainability-related disclosures, including our practices, achievements, metrics, goals and targets or the sustainability characteristics of our products or of our customers, investors or other stakeholders (greenwashing). - Strategic risks: Our strategy could be affected if we fail to achieve our net zero or other targets, including those related to the activities that we finance and those concerning our own operations. As a financial institution, we are already subject to certain regulatory ESG requirements as detailed under "Item 4. Information on the Company-B. Business Overview-Regulation and Supervision-Other Applicable Laws and Regulations-ESG Requirements Applicable to Financial Institutions." These requirements may increase going forward as a result of the increasing importance of ESG matters. This and other changes in regulations in Brazil and international markets may expose us to increased compliance costs and limit our ability to pursue certain business opportunities and provide certain products and services, each of which could adversely affect our business, financial condition and results of operations. As climate risk is interconnected with all key risk types, we have developed and continue to enhance processes to embed climate risk considerations into our risk management strategies; however, because the timing and severity of climate change may not be predictable, our risk management strategies may not be effective in mitigating climate risk exposure. We periodically disclose information such as emissions and other climate-related performance data, statistics, metrics and/or targets. If we lack robust and high quality climate-related procedures, controls and data, we may not be able to disclose reliable climate-related information. In addition, because the climate-related information is based on current expectations and future estimates about our and third-parties' operations and businesses and addresses matters that are uncertain to varying degrees, we may not be able to meet our estimates, targets or commitments or we may not be able to achieve them within the timelines we announce. Actual or perceived shortcomings with respect to these emissions and other climate-related initiatives and reporting could result in litigation or regulatory enforcement and impact our ability to hire and retain employees, increase our customer base, and attract and retain certain types of investors. Any of the conditions described above could have a material adverse effect on our business, financial condition and results of operations.

The Brazilian currency has experienced frequent and substantial variations in relation to the U.S. dollar and other foreign currencies. The Brazilian government has used various exchange rate policies, including sudden devaluations, periodic mini-devaluations (during which the frequency of adjustments has ranged from daily to monthly), exchange controls, dual exchange rate markets and a floating exchange rate system. Although long-term depreciation of the real is generally linked to the rate of inflation in Brazil, depreciation of the real occurring over shorter periods of time has resulted in significant variations in the exchange rate among the real, the U.S. dollar and other currencies. As a result of fluctuations in commodity prices, international developments and periods of progress and setbacks on the domestic front-such as during the presidential impeachment process in 2016, or the approval of the national pension system reform in 2019-the real has weakened over the last few years. As of December 31, 2021, the exchange rate was R$5.5805 per U.S.$1.00. In 2022, there was significant volatility in the R$/U.S.$ exchange rate, which fluctuated within a wide band that ranged from R$4.6175 to R$5.7042 per U.S.$1.00 as a result of ongoing economic and political uncertainty both globally and within Brazil. As of December 31, 2022 the exchange rate was R$5.2177 per U.S.$1.00. In 2023, the volatility in the R$/U.S.$ exchange rate persisted as it ranged from R$4.7202 to R$5.4459 per U.S.$1.00 as a result of geopolitical issues, increases in interest rate and economic uncertainties abroad combined with uncertainty regarding Brazil's fiscal and budgetary position. The exchange rate was R$4.8413 per U.S.$1.00 on December 31, 2023. There can be no assurance that the real will not substantially depreciate or appreciate further against the U.S. dollar. In the year ended December 31, 2023, a variation of 1.0% in the exchange rate of reais to U.S. dollars would have resulted in a variation of income on our net foreign exchange position denominated in U.S. dollars of R$0.63 million. Past episodes of depreciation of the real relative to the U.S. dollar created additional inflationary pressures in Brazil, which led to increases in interest rates and limited Brazilian companies' access to foreign financial markets and prompted the adoption of recessionary policies by the Brazilian government. Depreciation of the real may also, in the context of an economic slowdown, lead to decreased consumer spending, deflationary pressures and reduced growth of the Brazilian economy as a whole, and thereby harm our asset base, financial condition and results of operations. Additionally, depreciation of the real could make our foreign-currency-linked obligations and funding more expensive, negatively affect the market price of our securities portfolios, and have similar consequences for our borrowers. Conversely, appreciation of the real relative to the U.S. dollar and other foreign currencies could lead to a deterioration of the Brazilian balance of payments, as well as hinder export-driven growth. Depending on the circumstances, either a depreciation or appreciation of the real could materially and adversely affect the growth of the Brazilian economy and our business, financial condition and results of operations.

We operate in a number of credit- and financial services-related sectors through entities under our control. For certain purposes related to regulation and supervision, the Brazilian Central Bank treats us and our subsidiaries and affiliates as a single financial institution. While we believe that our consolidated capital base provides financial strength and flexibility to our subsidiaries and affiliates, their individual activities could indirectly put our capital base at risk. Any investigation or intervention by the Brazilian Central Bank, particularly in the activities carried out by any of our subsidiaries and affiliates, could have a material adverse impact on our other subsidiaries and affiliates and, ultimately, on us. If we or any of our financial subsidiaries become insolvent, the Brazilian Central Bank may carry out an intervention or liquidation process on a consolidated basis rather than conduct such procedures for each individual entity. In the event of an intervention or a liquidation process on a consolidated basis, our creditors would have claims to our assets and the assets of our consolidated financial subsidiaries. In this case, claims of creditors of the same nature held against us and our consolidated financial subsidiaries would rank equally in respect of payment. If the Brazilian Central Bank carries out a liquidation or intervention process with respect to us or any of our financial subsidiaries on an individual basis, our creditors would not have a direct claim on the assets of such financial subsidiaries, and the creditors of such financial subsidiaries would have priority in relation to our creditors in connection with such financial subsidiaries' assets. The Brazilian Central Bank also has the authority to carry out other corporate reorganizations or transfers of control under an intervention or liquidation process.

Our By-Laws provide that we, our shareholders, our directors and officers and the members of our fiscal council shall submit to arbitration any and all disputes or controversies that may arise among ourselves relating to, or originating from, the application, validity, effectiveness, interpretation, violations and effects of violations of the provisions of Brazilian Corporate Law, our By-Laws, the rules and regulations of the CMN, the Brazilian Central Bank and the CVM, as well as other rules and regulations applicable to the Brazilian capital markets and the rules and regulations of the Arbitration Regulation of the Market Arbitration Chamber. However, in specific situations, including whenever precautionary motions are needed for protection of rights, the dispute or controversy may have to be brought to a Brazilian court. If proceedings are brought in the courts of Brazil seeking to enforce our obligations in respect of the units or ADRs, we will not be required to discharge our obligations in a currency other than reais. Under Brazilian exchange control limitations and according to Brazilian laws, an obligation in Brazil to pay amounts denominated in a currency other than reais may be satisfied in Brazilian currency only at the exchange rate, as determined by the Brazilian Central Bank or competent court, in effect on the date the judgment is obtained, and such amounts are then adjusted to reflect exchange rate variations through the effective payment date. The then-prevailing exchange rate may not afford non-Brazilian investors with full compensation for any claim arising out of or related to our obligations under the units or ADRs.

The Brazilian government regularly enacts reforms to the tax and other assessment regimes to which we and our customers are subject. Such reforms include changes in tax rates and, occasionally, enactment of temporary levies, the proceeds of which are earmarked for designated governmental purposes. The effects of these changes and any other changes that result from enactment of additional tax reforms cannot be quantified and there can be no assurance that any such reforms would not have an adverse effect upon our business. Furthermore, such changes may produce uncertainty in the financial system, increasing the cost of borrowing and contributing to the increase in our nonperforming credit portfolio. Changes in tax policy, including the creation of new taxes, may occur with relative frequency and such changes could have an adverse effect on our financial position or operating results. For example, the IOF rates have been frequently adjusted (both upwards and downwards) in recent years. Currently, the daily IOF tax rates applicable to local loans are approximately (i) 0.0082% for individuals and (ii) 0.0041% for legal entities. We cannot estimate the impact that a change in tax laws or tax policy could have on our operations. For example, the IOF tax is a tool used by the Brazilian government to regulate economic activity, which does not directly impact our results of operations, though changes in the IOF tax can impact our business volumes generally. In the fourth quarter of 2023, the Brazilian Congress enacted Constitutional Amendment No 132/2023, which is intended to pave the way for a significant reform of the Brazilian tax system. For these reforms to take effect, the Brazilian Congress will also need to approve a number of complementary laws to enact the changes to Brazil's tax system made possible by this constitutional amendment. These changes include the replacement of five taxes currently levied in Brazil: (i) the Social Integration Program (Programa de Integração Social), or "PIS"; (ii) the Social Security Financing Contribution (Contribuição para o Financiamento da Seguridade Social), or "COFINS"; and (iii) Tax on Industrialized Products (Imposto sobre Produtos Industrializados), or "IPI – federal taxes"; (iv) Circulation of Goods and Services Tax (Imposto sobre Circulação de Mercadorias e Serviços), or "ICMS – state tax"; and (v) Tax on Services (Imposto Sobre Serviços), or "ISS – municipal tax." These taxes will be replaced by two value-added taxes: ICMS and ISS will be merged into a Tax on Goods and Services (Imposto Sobre Bens e Serviços), or "IBS," managed by states and municipalities, and the Federal Government will be in charge of a Contribution on Goods and Services (Contribuição sobre Bens e Serviços), or "CBS," which will merge the PIS, the COFINS, and the IPI. Tax reforms or any change in laws and regulations affecting taxes or tax incentives may directly or indirectly adversely affect our business and results of operations. The effects of these changes, if enacted, and any other changes that could result from the enactment of additional tax reforms, cannot be quantified.

Like other financial institutions, in conducting our banking operations, we receive, manage, hold, transmit, maintain and store confidential personal information of our customers and counterparties, including, but not limited to, personally identifiable information and personal financial information. The sharing, use, disclosure and protection of this information are governed by various Brazilian and foreign laws and regulations. Although we have procedures and controls in place to safeguard personal and other confidential or sensitive information in our possession, unauthorized access or disclosures could subject us to legal actions and administrative sanctions, as well as damages and reputational harm that could materially and adversely affect our operating results, financial condition and prospects. Furthermore, our business is exposed to risk from employees' potential noncompliance with policies, misconduct, negligence or fraud, which could result in regulatory sanctions and serious reputational and financial harm. We also face the risk that the design of our controls and procedures prove to be inadequate or are circumvented such that the data we hold is incomplete, not recoverable or not securely stored. Moreover, it is not always possible to deter or prevent employee misconduct, and the precautions we take to detect and prevent this activity may not always be effective. In addition, we may be required to report events related to information security issues, events where customer information may be compromised, unauthorized access to our systems and other security breaches, to the relevant regulatory authorities. Any material disruption or slowdown of our systems could cause information, including data related to customer requests, to be lost or delivered to our customers with delays or errors, which could adversely affect our reputation, reduce demand for our services and products and could materially and adversely affect us. If we cannot maintain effective and secure electronic data and information, management and processing systems or if we fail to maintain complete physical and electronic records, this could result in disruptions to our operations, claims from customers, regulators, employees and other parties, violations of applicable privacy and other laws, regulatory sanctions and serious reputational and financial harm to us. Moreover, during the heights of the COVID-19 pandemic, we permitted or required a majority of our employees to work remotely, which led to increased vulnerability of our systems and the risk of cyber-attacks. Though the majority of our employees are now working in person at our offices, work-from-home policies may lead to continued vulnerability to the extent certain of our employees elect to work away from our premises and access our networks remotely. This trend, combined with our customers' increased reliance on digital banking products and other digital services, including mobile payment products, has increased the risk of data breaches and other security incidents. Furthermore, any failure or disruption of our operational processes or systems, data breaches and other security incidents with respect to our or our third-party vendors' systems could adversely affect our business or reputation, and create significant legal, regulatory or financial exposure. We prioritize early identification, monitoring and mitigation of risks (including those resulting from our interactions with third parties) in our goal to provide a resilient and secure operational environment. In this regard, although (i) we have policies, procedures and controls in place designed to safeguard proprietary, sensitive and confidential information, including personal information, (ii) we take protective technical measures and monitor and develop our systems and networks to protect our technology infrastructure, data and information from misappropriation or corruption, and (iii) we work with our clients, vendors, service providers, counterparties and other third parties to develop secure data and information processing, collection, authentication, management, usage, storage and transmission capabilities and to ensure the eventual destruction of proprietary, sensitive and confidential information, including personal information, we, our third-party vendors or other third parties with which we do business have been and may continue to be subject to cyberattacks and other cybersecurity incidents. The implementation of our cybersecurity policies, procedures, controls and technical measures is designed to reduce the risk of such cybersecurity incidents but does not guarantee full protection against potential threats or cyberattacks or a risk-free environment. This is especially applicable in the current global environment, with the war in Ukraine and the conflict in the Middle East resulting in an increased risk of cyberattacks, and other disruptions in response to, or retaliation for, the sanctions and costs imposed on Russia and certain other countries directly or indirectly involved in these wars. While we generally perform cybersecurity due diligence on our key vendors, because we do not control our vendors and our ability to monitor their cybersecurity is limited, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share with them. Due to applicable laws and regulations or contractual obligations, we may be held responsible for security breaches, cyberattacks or other similar incidents attributed to our vendors as they relate to the information we share with them. We have seen in recent years the information technology systems and networks of companies and organizations being increasingly targeted, and the techniques used to obtain unauthorized, improper or illegal access to such information technology systems and networks have become increasingly complex and sophisticated, including through the use of AI. Furthermore, such techniques change frequently and are often not recognized or detected until after they have been launched and can originate from a wide variety of sources, including organized crime, hackers, activists, terrorists, nation-states, nation-state supported actors and others, any of which may see their effectiveness enhanced by the use of AI. As attempted attacks continue to evolve in scope and sophistication, we may incur significant costs in order to modify or enhance our protective measures against such attacks, or to investigate or remediate any vulnerability or resulting breach, or in communicating cyberattacks or other security incidents to our customers, affected individuals or regulators, as applicable. If we cannot maintain effective and secure proprietary, confidential, sensitive and personal data, or if we or our third-party vendors fall victim to successful cyberattacks, penetrations, compromises, breaches or circumventions of our information technology systems or networks or experience other security incidents in the future, we may incur substantial costs and suffer other negative consequences, such as disruption to our operations, misappropriation of personal, proprietary, confidential or sensitive information, remediation costs (including liabilities for stolen assets or information and repairs of system damage, among others), increased cybersecurity protection costs, lost revenues arising from the unauthorized use of personal, proprietary, confidential or sensitive information or the failure to retain or attract our customers following an operational or security incident, litigation and legal risks (including claims from customers, employees or other third parties, regulatory action, reporting obligations, investigation, fines and penalties), increased insurance premiums, reputational damage affecting our customers' and our investors' confidence, as well as damages to our competitiveness, stock price and long-term shareholder value. In addition, our remediation efforts may not be successful, and we may not have adequate insurance to cover these losses. While we maintain insurance coverage, we cannot assure you that such coverage will be adequate or otherwise protect us from liabilities or damages with respect to claims alleging compromises of proprietary, confidential, sensitive or personal data or otherwise relating to data privacy and cybersecurity matters. In addition, we cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or at all, or that our insurers will not deny coverage to any future claim. Moreover, even when a failure of or interruption in our or our third-party vendors' systems or facilities is resolved in a timely manner or an attempted cyberattack, data breach or security incident is successfully avoided or thwarted, substantial resources and management attention are expended in doing so, and to successfully avoid or resolve any such incidents, we may be required to take actions that could adversely affect customer satisfaction or retention, as well as harm our reputation. Any of the cyberattacks, data breaches, data losses and other security incidents described above could have a material adverse effect on our business, financial condition and results of operations. For additional information, see also "-We are subject to increasing scrutiny and regulation from data protection laws, including penalties in the event of noncompliance with the terms and conditions of certain new European and Brazilian regulations" and "-Failure to adequately protect ourselves against risks relating to cybersecurity could materially and adversely affect us. We are also subject to increasing scrutiny and regulation governing cybersecurity risks."

As a direct participant of the PIX, we may face operational issues, as well as difficulties in adapting to the requirements established by the PIX payment scheme regulations and by the other applicable rules, mainly related to the minimum level of service to be provided on a recurring basis to customers, as well as recent new security and fraud prevention requirements set forth by the Brazilian Central Bank. The Brazilian Central Bank has also enacted a new rule implemented in July 2022 setting a limited amount of R$1,000 for PIX transactions carried out between 8:00 p.m. (or, at the user's discretion, between 10:00 p.m.) and 6:00 a.m. As a result, we may be the target of administrative sanctions and/or judicial claims, either by the Brazilian Central Bank itself or as a result of complaints brought by our customers if we fail to adequately comply with this rule. Furthermore, as a consequence of potential administrative sanctions or judicial claims, we may face difficulties in retaining customers in relation to Santander SX, our solution for our customers to access PIX, which may have a material adverse effect on our financial results, as well as our reputation. In addition, the Brazilian Central Bank may issue new and stricter rules applicable to PIX participants, including new operational capacity requirements. The imposition by the Brazilian Central Bank of new requirements may adversely affect our operations. For more information related to the PIX and the SPI, see "Item 4. Information on the Company-B. Business Overview-Regulation and Supervision-Other Applicable Laws and Regulations-Brazilian Payment and Settlement System."

Our business is highly dependent on the ability of our information technology systems to accurately process a large number of transactions across numerous and diverse markets and products in a timely manner, and on our ability to rely on our digital technologies, computer and email services, software, and networks, as well as on the secure processing, storage and transmission of confidential data and other information in our computer systems and networks. The proper functioning of our financial control, risk management, accounting, customer service and other data processing systems is critical to our business and our ability to compete effectively. We do not operate all of our redundant systems on a real-time basis and cannot assure that our business activities would not be materially disrupted if there were a partial or complete failure of any of these primary information technology systems or communication networks. Such failures could be caused by, among other things, major natural catastrophes, software bugs, computer virus attacks, conversion errors due to system upgrading, security breaches caused by unauthorized access to information or systems, or intentional malfunctions or loss or corruption of data, software, hardware or other computer equipment. We have experienced interruptions in our information technology systems in the past and we cannot assure that we will not suffer any such interruptions in the future, or that we will be able to identify and rectify these within a window of time that prevents any disruption. Any such events or failures could disrupt our business and impair our ability to provide our services and products effectively to our customers, which could adversely affect our reputation as well as our business, results of operations and financial condition. Our ability to remain competitive and achieve further growth will depend in part on our ability to upgrade our information technology systems and increase our capacity on a timely and cost-effective basis. We must continually make significant investments and improvements in our information technology infrastructure in order to remain competitive. We cannot assure that in the future we will be able to maintain the level of capital expenditures necessary to support the improvement or upgrading of our information technology infrastructure. Any substantial failure to improve or upgrade our information technology infrastructure and management systems in an effective, timely and cost-effective manner, including in response to new or modified cybersecurity and data privacy laws, rules, regulations and standards, could have a material adverse effect on us.

We are exposed to counterparty risk in addition to credit risks associated with lending activities. Counterparty risk may arise from, for example, investing in securities of third parties, entering into derivative contracts under which counterparties have obligations to make payments to us, or executing securities, futures, currency or commodity trades from proprietary trading activities that fail to settle at the required time due to non-delivery by the counterparty or systems failure by clearing agents, clearinghouses or other financial intermediaries. We routinely transact with counterparties in the financial services industry, including brokers and dealers, commercial banks, investment banks, mutual funds, hedge funds and other institutional customers, as well as counterparties in various other industries. Defaults by, and even rumors or questions about the solvency of, certain of our counterparties, including financial institutions and the financial services industry generally, have led to market-wide liquidity problems and losses or defaults by other counterparties. Many of the routine transactions we enter into expose us to significant credit risk in the event of default by one of our significant counterparties. We or certain of our counterparties may incur losses or defaults for a wide variety of reasons, including defaults by certain of our counterparties, by business with which our counterparties transact, rumors or questions about the solvency of our counterparties or significant market participants, as well as evidence or rumors of fraud or improper accounting practices among certain of our counterparties or significant market participants, including both financial and nonfinancial institutions. If any of these problems were to materialize, as they have in past among large Brazilian corporations, the otherwise routine transactions that we have entered into with our counterparties could have a material adverse effect on our business, financial condition and results of operations. If these risks give rise to losses, this could materially and adversely affect us. Our loan portfolio does not have any specific concentration exceeding 10% of our total loans. As of December 31, 2023, 1.0% of our loan portfolio is allocated to our largest debtor and 5.4% to our next 10 largest debtors. However, we cannot assure this will continue to be the case or that we will not incur significant losses from counterparty defaults despite the concentration levels described above. If these counterparty risks give or continue to give rise to losses, our business, financial condition and results of operations could materially and adversely be affected.