Indicators

2-6 a) Report the sector(s) in which it is active.

We operate in the commercial, credit, financing and investment, mortgage, development, leasing, and foreign exchange sectors, serving diverse customer segments, including individuals, businesses, farmers, and public entities.

2-6 b) Describe its value chain, including:

2-6 b) i) the organization’s activities, products, services, and markets served;

We operate in the commercial, credit, financing and investment, mortgage, development, leasing, and foreign exchange sectors, serving diverse customer segments, including individuals, businesses, farmers, and public entities.

Through our subsidiaries and affiliates, we also operate in other important areas, notably securities brokerage, management of consorcios (pre-purchase financing pools), payment methods, insurance, and pension plans.

We also serve as an instrument for implementing the economic and financial policy of the State of Rio Grande do Sul, in alignment with the State Government’s plans and programs.

2-6 b) ii) the organization’s supply chain;

In the course of our operations, we establish business relations with various types of organizations, including service providers, technology vendors, specialized consulting firms, partner financial institutions, and other entities that support the execution of our operations and strategic initiatives. These relationships are formalized contracts and are monitored according to technical, legal, and compliance criteria.

2-6 b) iii) the entities downstream from the organization and their activities.

We serve different customer segments, including individuals, businesses, farmers, and public entities.

2-6 c) Report other relevant business relationships.

Banrisul currently has no joint ventures or corporate alliances, but has significant institutional partnerships such as the Impacta RS Program (SICT, Coalizão pelo Impacto, Regenera RS, and Finep) and partnerships with Badesul, BRDE, and BNDES.

2-6 d) Describe significant changes in 2-6 a), 2-6 b), and 2-6 c) compared to the previous reporting period.

There were no significant changes.

2-21 a) Report the ratio of the annual total compensation for the organization’s highest-paid individual to the median annual total compensation for all employees (excluding the highest-paid individual).

The ratio between the highest total annual compensation and the average annual compensation of the Company’s other employees was 11.09.

2-21 b) Report the ratio of the percentage increase in annual total compensation for the organization’s highest-paid individual to the median percentage increase in annual total compensation for all employees (excluding the highest-paid individual).

There was a 2.5% decrease in the highest salary between 2024 and 2025. In contrast, among the other employees who worked the entire year, the average salary increased by 4.2%.

2-21 c) Report contextual information necessary to understand the data and how the data has been compiled.

The individual with the highest annual salary at the company is the CEO. For analysis purposes, we calculated the ratio of the CEO’s compensation to the average annual salary of other employees who worked all 12 months of the year, excluding those who joined or left the company during that period. For each individual, both fixed and variable compensation received throughout 2025 were considered.

2-29 a) Describe its approach to engaging with stakeholders, including:

2-29 a) i) the categories of stakeholders it engages with, and how they are identified;

Banrisul’s main target audiences include:

• Customers and users of financial services.
• Employees and managers.
• Shareholders and investors.
• Suppliers and business partners.
• Regulatory bodies and government entities.
• Communities and society at large.
• Media and opinion leaders.

2-29 a) ii) the purpose of the stakeholder engagement;

Relationships with stakeholders are essential to our operations and to management practices aligned with the expectations of society and the market. We are in constant dialogue with diverse stakeholders in order to understand their needs, strengthen relationships of trust, and incorporate their inputs into our decision-making processes.

2-29 a) iii) how the organization seeks to ensure meaningful engagement with stakeholders.

This engagement takes place through institutional channels and relationship-building initiatives that help identify perceptions, expectations, and opportunities for improvement. Interaction with stakeholders also contributes to the development of products and services, the strengthening of governance, and the advancement of sustainability initiatives.

Dialogue takes place through diverse means, including customer service channels, institutional meetings, satisfaction surveys (NPS), relationship programs, digital platforms, and events. Communication with the press is handled by the Press Office, which is responsible for institutional positions and communication strategies. For investor relations, we have specific channels, such as “Contact IR” and a dedicated email address, ensuring transparent and prompt response to requests for corporate and financial information.

2-11 a) Report whether the chair of the highest governance body is also a senior executive in the organization.

2-11 b) If the chair is also a senior executive, explain their function within the organization’s management, the reasons for this arrangement, and how conflicts of interest are prevented and mitigated.

The Chair of the Board of Directors is not a senior executive at Banrisul.

2-30 a) Report the percentage of total employees covered by collective bargaining agreements.

2-30 b) For employees not covered by collective bargaining agreements, report whether the organization determines their working conditions and terms of employment based on collective bargaining agreements that cover its other employees or based on collective bargaining agreements from other organizations.

100% of the employees are covered by the collective bargaining agreement.

2-17 a) Report measures taken to advance the collective knowledge, skills, and experience of the highest governance body on sustainable development.

Members of Senior Management regularly participate in training and refresher programs on topics relevant to the management of the Institution, including corporate and financial market legislation, disclosure of corporate information, internal controls, ethics and integrity, as well as aspects related to the Anti-Corruption Law and regulatory standards applicable to the financial system.

2-16 a) Describe whether and how critical concerns are communicated to the highest governance body.

We have a Whistleblower Channel to receive reports from employees, management, customers, suppliers, and other stakeholders regarding irregularities, such as fraud, corruption, harassment, or non-compliance with the Code of Ethics and Conduct.

2-16 b) Report the total number and the nature of critical concerns that were communicated to the highest governance body during the reporting period.

Banrisul considers the number and nature of these critical concerns to be confidential, since the data is restricted and generally sensitive to the institution.

2-27 a) Report the total number of significant instances of non-compliance with laws and regulations during the reporting period, and a breakdown of this total by:

2-27 a) i) instances for which fines were incurred;

2-27 a) ii) instances for which non-monetary sanctions were incurred;

In 2025, no significant instances of non-compliance with laws and regulations were recorded.

2-27 b) Report the total number and the monetary value of fines for instances of noncompliance with laws and regulations that were paid during the reporting period, and a breakdown of this total by:

2-27 b) ii) fines for instances of non-compliance with laws and regulations that occurred in the current reporting period;

2-27 b) ii) fines for instances of non-compliance with laws and regulations that occurred in previous reporting periods;

^¹ Despite the 11.2% decrease in the number of cases between 2024 and 2025, average fine amount increased, primarily due to enforcement actions by the Ministry of Labor, which resulted in fines imposed on branches with fewer apprentices than required by law (the Apprenticeship Law). Despite this variation, the total monetary value of the fines remains insignificant in the context of the Institution’s financial statements.

2-27 c) Describe the significant instances of non-compliance; 

Significant cases are those whose impact materially affect the Institution’s results, image, or reputation.

2-27 d) Describe how it has determined significant instances of non-compliance.

Significant cases of non-compliance are determined based on impact assessment criteria that classify events as “high” or “severe” across the financial, reputational, regulatory, technological, third-party relations, social, environmental, and climate-related dimensions, as well as fines and legal actions. A case is considered significant when any of these dimensions reaches the aforementioned levels. The assessment uses quantitative (such as financial figures) and qualitative (such as media exposure and regulatory intervention) parameters to ensure consistency and comparability of the classifications. The criteria used are:

1. Financial Impact: Cases are considered significant when they result in financial impacts substantial enough to affect the institution’s financial performance or operational stability.

2. Reputational Impact: A case is considered significant when it results in significant negative exposure in the media, on social media, or among shareholders and investors, compromising the institution’s image.

3. Regulatory Impact: Events that require immediate response to regulatory authorities, or that result in direct intervention by regulatory bodies, are classified as significant.

4. Third-Party Impact: Incidents involving suppliers or service providers are considered significant when they substantially compromise the continuity, quality, or safety of essential processes.

5. Social, Environmental, and Climate Impact: Cases are classified as significant when they generate significant effects—or compromise fundamental processes—related to social, environmental, or climate aspects.

6. Technological Impact: Events that result in significant customer losses, operational instability, risks to business continuity, or damage to trust in technological systems are considered significant.7. Impact of Fines and Legal Actions: Fines or legal actions are classified as significant when they pose material risks to the Institution’s reputation, operational continuity, or financial security.

2-15 a) Describe the processes for the highest governance body to ensure that conflicts of interest are prevented and mitigated.

We have adopted formal mechanisms to prevent, identify, and address conflicts of interest, ensuring that our corporate decisions are taken based on criteria of integrity, transparency, and alignment with institutional interests. These mechanisms are primarily set forth in our Code of Ethics and Conduct and in our internal governance policies, which guide the actions of management, employees, and other representatives of the Institution.

2-15 b) Report whether conflicts of interest are disclosed to stakeholders, including, at a minimum, conflicts of interest relating to:

2-15 b) i) cross-board membership;

Information on cross-shareholdings among Banrisul Group companies is available in item 7.6 of the 2025 Reference Form.

2-15 b) ii) cross-shareholding with suppliers and other stakeholders;

There are no cross-shareholdings with suppliers or other unrelated parties.

2-15 b) iii) existence of controlling shareholders;

The sole controlling shareholder is the State.

2-15 b) iv) related parties, their relationships, transactions, and outstanding balances.

Related parties, their relationships, transactions, and outstanding balances are disclosed in the 2025 IFRS Financial Statements, in accordance with IAS 24 and CMN Resolution No.4,818/20, covering transactions conducted on an arm’s-length basis, with the elimination of intercompany balances within the Group in the consolidated financial statements and the disclosure of material transactions with the State of Rio Grande do Sul and its entities.

2-13 a) Describe how the highest governance body delegates responsibility for managing the organization’s impacts on the economy, environment, and people, including:

a) i) whether it has appointed any senior executives with responsibility for the management of impacts;

The implementation of the Social, Environmental, and Climate Responsibility Policy (PRSAC) is led by the Chief Risk Officer (CRO).

2-13 a) ii) whether it has delegated responsibility for the management of impacts to other employees;

The Executive Superintendent of Corporate Risks is formally designated as responsible for managing social, environmental, and climate risks and impacts.

2-13 b) Describe the process and frequency for senior executives or other employees to report back to the highest governance body on the management of the organization’s impacts on the economy, environment, and people.

SAC risk management is exercised through structured reporting, including the Social, Environmental, and Climate Risk and Responsibility Report submitted to the Board. This matter is also reported monthly to the Social, Environmental, and Climate Responsibility Committee and quarterly to the Board of Directors.

2-24 a) Describe how it embeds each of its policy commitments for responsible business conduct throughout its activities and business relationships, including:

2-24 a) i) how it allocates responsibility to implement the commitments across different levels within the organization;

The Executive Board is responsible for executing the strategies and guidelines approved by the Board of Directors, ensuring the efficient management of resources, implementing corporate policies, and conducting operations in accordance with regulatory standards and established strategic guidelines.

The implementation of the Code of Ethics and Conduct is monitored by the Ethics Committee.

2-24 a) ii) how it integrates the commitments into organizational strategies, operational policies, and operational procedures;

This topic is managed through the Integrity Program, which brings together policies, procedures, and control mechanisms aimed at preventing, identifying, and addressing conduct inconsistent with institutional principles.

2-24 a) iii) how it implements its commitments with and through its business relationships;

Business relationships with partners and suppliers are formalized through contracting and monitoring processes that take into account technical, legal, and compliance criteria.

Our contracting and evaluation processes are designed to ensure compliance with legal requirements, labor practices, and respect for human rights, thereby helping to reduce social and environmental risks across our supply chain.

2-24 a) iv) training that the organization provides on implementing the commitments.

As part of our efforts to strengthen our culture of integrity, we provide mandatory training on ethics and prevention of corruption for all employees. In 2025, we also held workshops on prevention of harassment for senior management and middle management, with plans to expand this initiative in 2026.

2-7 a) Report the total number of employees, and a breakdown of this total by gender and by region.

2-7 b) Report the total number of:

2-7 b) i) permanent employees, and a breakdown by gender and by region;

2-7 b) ii) temporary employees, and a breakdown by gender and by region;

2-7 b) iii) non-guaranteed hours employees, and a breakdown by gender and by region;

2-7 b) iv) full-time employees, and a breakdown by gender and by region;

2-7 b) v) part-time employees, and a breakdown by gender and by region.

¹ There are no temporary, non-guaranteed-hour, or part-time employees.

¹ There are no temporary, non-guaranteed-hour, or part-time employees.

2-7 c) Describe the methodologies and assumptions used to compile the data, including whether the numbers are reported:

2-7 c) i)  in head count, full-time equivalent (FTE), or using another methodology;

2-7 c) ii) at the end of the reporting period, as an average across the reporting period, or using another methodology.

The data was generated using reports from the company’s own HR systems, based on year-end totals.

2-7 d) Report contextual information necessary to understand the data reported under 2-7 a) and 2-7 b).

All permanent employees reported are considered full-time.

2-7 e) Describe significant fluctuations in the number of employees during the reporting period and between reporting periods.

There were no significant changes.

2-2 a) List all its entities included in its sustainability reporting.

With regard to the organizational scope, this report includes consolidated information about Banrisul – Banco do Estado do Rio Grande do Sul S.A. and the group comprising the following subsidiaries and affiliates: Banrisul Armazéns Gerais S.A.; Banrisul S.A. Corretora de Valores Mobiliários e Câmbio; Banrisul S.A. Administradora de Consórcios; Banrisul Soluções em Pagamentos S.A.; and Banrisul Seguridade Participações S.A.        

2-2 b) If the organization has audited consolidated financial statements or financial information filed on public record, specify the differences between the list of entities included in its financial reporting and the list included in its sustainability reporting.

The Sustainability Report includes consolidated information about Banrisul and the group, all of which is included in the report as well as in the financial statements.

2-2 c) If the organization consists of multiple entities, explain the approach used for consolidating the information, including:

2-2 c) i) whether the approach involves adjustments to information for minority interests;

The approach used does not involve adjustments to information related to minority interests.   

2-2 c) ii) how the approach takes into account mergers, acquisitions, and disposal of entities or parts of entities;

There were no mergers, divestments, or acquisitions.      

2-2 c) iii) whether and how the approach differs across the disclosures in this Standard and across material topics.

The approach used is consistent throughout this Standard and the material topics.

2-18 a) Describe the processes for evaluating the performance of the highest governance body in overseeing the management of the organization’s impacts on the economy, environment, and people.

The performance evaluation of members of the Board of Directors, the Executive Board, and the statutory committees includes self-appraisal and an analysis of results against previously established targets. This framework strengthens the oversight, transparency, and accountability mechanisms by promoting alignment between strategy and management and contributing to the quality of the decision-making process.

2-18 b) Report whether the evaluations are independent or not, and the frequency of the evaluations.

Performance evaluations are conducted annually, anonymously, individually, and confidentially.

2-18 c) Describe actions taken in response to the evaluations, including changes to the composition of the highest governance body and organizational practices.

All responses to the evaluation questionnaires are compiled into a report, and submitted to the Eligibility and Compensation Committee for preliminary review, and subsequently presented to the Board of Directors, which may suggest improvements in the execution of its duties.

2-5 a) Describe its policy and practice for seeking external assurance, including whether and how the highest governance body and senior executives are involved.

To bolster the credibility and reliability of the information disclosed, the report was submitted to a limited external and independent assurance review by the audit firm Deloitte Touche Tohmatsu Auditores Independentes Ltda. The document is approved by the Executive Board and by the Social, Environmental, and Climate Responsibility Committee, and subsequently submitted to the Board of Directors for review.

2-5 b) If the organization’s sustainability reporting has been externally assured:

2-5 b) i) provide a link or reference to the external assurance report(s) or assurance statement(s);

The assurance report is attached to the 2025 Sustainability Report.

2-5 b) ii) describe what has been assured and on what basis, including the assurance standards used, the level of assurance obtained, and any limitations of the assurance process;

The assurance report is attached to the 2025 Sustainability Report.

2-5 b) iii) describe the relationship between the organization and the assurance provider.

The relationship between the organization and the party responsible for external assurance also extends to the audit of the Financial Statements, with this being an independent external entity.

2-9 a) Describe its governance structure, including committees of the highest governance body.

The governance structure includes decision-making, executive, oversight, and technical advisory bodies, with a clear separation between strategic and operational functions. The Shareholders Meeting is the highest governance body, responsible for major corporate decisions. Reporting to it is the Board of Directors, which is responsible for defining strategic guidelines and overseeing management, while the Executive Board runs the operations and implements the strategies and policies approved.

Notable among the oversight and advisory bodies are the Fiscal Council and the statutory committees, which assist the Board of Directors on issues such as auditing, risk management, eligibility, compensation, as well as social, environmental, and climate responsibility.

2-9 b) List the committees of the highest governance body that are responsible for decision-making on and overseeing the management of the organization’s impacts on the economy, environment, and people.

To assist in its duties, the Board has four permanent statutory advisory committees: the Audit Committee, the Risk Committee, the Eligibility and Compensation Committee, and the Social, Environmental, and Climate Responsibility Committee.

2-9 c) Describe the composition of the highest governance body and its committees by:

2-9 c) i) executive and non-executive members;

2-9 c) ii) independence;

2-9 c) iii) tenure of members on the governance body;

2-9 c) iv) number of other significant positions and commitments held by each member, and the nature of the commitments;

2-9 c) v) gender.

2-9 c) vi) under-represented social groups;

The composition of the highest governance body and its committees is described in items 7.1 and 7.2 of the Bank’s Reference Form.

2-9 c) vii) competencies relevant to the impacts of the organization;

The Nomination and Succession Policy guides the eligibility process for governance positions, ensuring that the selection process considers technical criteria, professional experience, and alignment with the Company’s strategic objectives.

2-9 c) viii) stakeholder representation.

The Board of Directors includes representatives from different stakeholder groups, including minority common shareholders, minority preferred shareholders, and employees, thereby broadening the diversity of perspectives in the decision-making process.

2-26 a) Describe the mechanisms for individuals.

2-26 a) i) seek advice on implementing the organization’s policies and practices for responsible business conduct;

Our commitment to integrity is formalized in Banrisul’s Code of Ethics and Conduct, which provides guidance on preventing conflicts of interest, confidentiality of information, and compliance with legal and regulatory standards.

2-26 a) ii) raise concerns about the organization’s business conduct.

We have a Whistleblower Channel to receive reports from employees, managers, customers, suppliers, and other stakeholders regarding irregularities, such as fraud, corruption, harassment, or violations of the Code of Ethics and Conduct.

2-28 a) Report industry associations, other membership associations, and national or international advocacy organizations in which it participates in a significant role.

We are members of industry associations and initiatives that promote the development of the financial system and sustainability, such as:

• ABBC – Brazilian Association of Banks
• ABDE – Brazilian Development Association
• ANBIMA – Brazilian Association of Financial and Capital Market Entities
• Amcham – American Chamber of Commerce
• Febraban – Brazilian Federation of Banks
• Global Compact
• Financial Innovation Lab
• Women Entrepreneurs Advancement Committee
• Impacta Mais RS Project

2-10 a) Describe the nomination and selection processes for the highest governance body and its committees.

The Eligibility and Compensation Committee is an advisory body to the Board of Directors, contributing to the adoption of governance practices aligned with market best practices and regulatory requirements applicable to financial institutions.

Its responsibilities include evaluating and providing opinion on the nomination and eligibility processes for executive officers, fiscal council members, and members of statutory committees, as well as proposing and reviewing the management compensation policy. The Committee also supports the Board in conducting management performance evaluation processes and in defining guidelines that promote alignment between compensation, risk management, and sustainable value creation.

In addition, the Nomination and Succession Policy guides the eligibility process for governance positions, ensuring that the selection process considers technical criteria, professional experience, and alignment with the Company’s strategic objectives.

2-10 b) Describe the criteria used for nominating and selecting highest governance body members, including whether and how the following are taken into consideration:

2-10 b) i) views of stakeholders (including shareholders);

2-10 b) ii) diversity;

2-10 b) iii) independence;

Minority shareholders holding common and preferred shares are guaranteed the right to elect and remove, in a separate vote at the Shareholders Meeting, one member of the Board of Directors, and employees are guaranteed the right to nominate a representative to the Board, who will be chosen through a prior election conducted in accordance with applicable internal charter, ensuring the consideration of different stakeholders in the selection and appointment process and promoting greater inclusion and representation on the highest governance body.

2-10 b) iv) competencies relevant to the impacts of the organization.

The eligibility process for governance roles considers technical criteria, professional experience, and alignment with the Company’s strategic objectives.

2-1 a) Report its legal name.

Banrisul – Banco do Estado do Rio Grande do Sul S.A.

2-1 b) Report its nature of ownership and legal form.

Banco do Estado do Rio Grande do Sul S.A. (“Banrisul” and “Institution”) is a publicly-held company operating as a commercial bank, headquartered in Porto Alegre (RS).

We are an instrument for implementing the economic and financial policy of the State of Rio Grande do Sul, in alignment with the State Government’s plans and programs.

Our shares are traded on B3 – Brasil, Bolsa, Balcão, under the ticker symbols BRSR3, BRSR5, and BRSR6, in compliance with the regulations applicable to financial institutions and publicly-held companies.

2-1 c) Report the location of its headquarters.

Our administrative headquarters are located in Porto Alegre (RS).

2-1 d) Report its countries of operation.

We have a consolidated footprint in Rio Grande do Sul and have expanded our operations nationwide.

2-23 a) Describe its policy commitments for responsible business conduct, including:

2-23 a) i) the authoritative intergovernmental instruments that the commitments reference;

The guidelines of the Code of Ethics and Conduct are aligned with international human rights standards, such as the International Bill of Human Rights, the Declaration of the International Labour Organization (ILO), the United Nations Guiding Principles on Business and Human Rights (UNGPs), and the Rio Declaration on Environment and Development.

2-23 a) ii) whether the commitments stipulate conducting due diligence;

The commitments set forth in the PRSAC indirectly address the performance of due diligence.

2-23 a) iii) whether the commitments stipulate applying the precautionary principle;

The agreements do not envisage the application of the precautionary principle.

2-23 a) iv) whether the commitments stipulate respecting human rights.

The Code of Conduct and Ethics and the PRSAC explicitly establish respect for human rights. The Code addresses this issue by prohibiting discrimination, harassment, and aggression, and by promoting equal opportunities and dignity. The PRSAC reiterates this commitment by establishing the protection and promotion of human rights as a principle, with a focus on diversity, equity, and inclusion, as well as on the assessment of social impacts.

2-23 b) Describe its specific policy commitment to respect human rights, including:

2-23 b) i) the internationally recognized human rights that the commitment covers;

Banrisul’s commitment to human rights, as set forth in the Code of Conduct and the PRSAC, covers internationally recognized rights, especially those related to equality, dignity, integrity, non-discrimination, working conditions, and environmental protection.

2-23 b) ii) the categories of stakeholders, including at-risk or vulnerable groups, that the organization gives particular attention to in the commitment.

Our commitment guides the conduct of directors, management, employees, interns, suppliers, and partners.

2-23 c) Provide links to the policy commitments if publicly available, or, if the policy commitments are not publicly available, explain the reason.

• Banrisul Anti-Corruption Policy.
• Social, Environmental, and Climate Responsibility Policy (PRSAC).
• Annual Letter of Corporate Governance 2025 – Year 2024.
• Code of Ethics and Conduct.
• Information and Cybersecurity Policy for Third-Party Contractors.
• Personal Data Protection Guidelines.

2-23 d) Report the level at which each of the policy commitments was approved within the organization, including whether this is the most senior level.

Policy commitments are approved by the Board of Directors.

2-23 e) Report the extent to which the policy commitments apply to the organization’s activities and to its business relationships.

Our commitment to integrity is formalized in Banrisul’s Code of Ethics and Conduct, which guides the behavior of directors, management, employees, interns, suppliers, and partners.

2-23 f) Describe how the policy commitments are communicated to workers, business partners, and other relevant parties.

The Code is disseminated through communication and training initiatives, and its implementation is monitored by the Ethics Committee.

2-20 a) Describe the process for designing its remuneration policies and for determining remuneration, including:

2-20 a) i) whether independent highest governance body members or an independent remuneration committee oversees the process for determining remuneration;

The process of determining compensation is guided by the Eligibility and Compensation Committee, a statutory body consisting of three independent members, pursuant to CMN Resolution 5,177/2024. The Committee assists the Board of Directors in analyzing and formulating the compensation proposals based on market studies and governance practices adopted by the institution.

2-20 a) ii) how the views of stakeholders (including shareholders) regarding remuneration are sought and taken into consideration;

The compensation proposal is prepared by the Eligibility and Compensation Committee and subsequently reviewed by the Board of Directors, which records its decision in the minutes. The proposal is then submitted for deliberation by the shareholders at the Annual Shareholders Meeting.

2-20 a) iii) whether remuneration consultants are involved in determining remuneration and, if so, whether they are independent of the organization, its highest governance body and senior executives.

No external consulting firm was engaged to determine compensation.

2-20 b) Report the results of votes of stakeholders (including shareholders) on remuneration policies and proposals, if applicable.

The voting results are disclosed via the final voting tally published on Banrisul’s Investor Relations page.

2-19 a) Describe the remuneration policies for members of the highest governance body and senior executives, including:

2-19 a) i) fixed pay and variable pay;

Members of the Board of Directors receive fixed annual compensation equivalent to twelve monthly fees and are not eligible for variable compensation or additional benefits. This structure reinforces the Board’s role in strategic oversight and preserves its independence in decision-making. In 2025, there were no specific targets related to ESG issues.

For members of the Executive Board, compensation includes fixed and variable components. Executive officers thirteen annual fees plus a representation allowance, whose individual amount is set by the Board of Directors after consulting the Eligibility and Compensation Committee. In addition to fixed compensation, they are eligible for variable compensation programs linked to the Bank’s performance, subject to the limits defined by law and the overall compensation approved at the Shareholders Meeting.

2-19 a) ii) sign-on bonuses or recruitment incentive payments;

2-19 a) iii) termination payments;

2-19 a) iv) clawbacks;

The policy does not provide for sign-on bonuses or recruitment incentives, special severance payments, or bonus clawback mechanisms.

2-19 a) v) retirement benefits.

Executive officers may join supplemental pension and insurance plans. These benefits may vary depending on the specific profile of each professional. Executive officers who were previously employees of Banrisul will retain the benefit plans.

2-19 b) Describe how the remuneration policies for members of the highest governance body and senior executives relate to their objectives and performance in relation to the management of the organization’s impacts on the economy, environment, and people.

Variable compensation is linked to the bank’s performance and the achievement of targets aligned with the Bank’s strategic plan. Among the indicators considered are financial results, operational efficiency, market share, and customer satisfaction levels, as well as initiatives related to modernization, innovation, and digital transformation. The compensation policy thus helps align the actions of Senior Management with Banrisul’s strategic objectives and the generation of sustainable value for both the institution and its stakeholders.

2-3 a) Specify the reporting period for, and the frequency of, its sustainability reporting.

The report is published annually.

2-3 b) Specify the reporting period for its financial reporting and, if it does not align with the period for its sustainability reporting, explain the reason for this.

Information in the Sustainability Report refers to the fiscal year from January 1 to December 31, 2025.

2-3 c) Report the publication date of the report or reported information.

July 8, 2026.             

2-3 d) Specify the contact point for questions about the report or reported information.

Questions or requests for clarification may be sent to the Investor Relations team through the website, email, or by phone at (51) 3215-3232.

2-4 a) Report restatements of information made from previous reporting periods and explain:

2-4 a) i) the reasons for the restatements;

2-4 a) ii) the effect of the restatements.

2-21: The organization has restated data about its compensation rate due to the change in methodology, which excludes executive officers and vice presidents from the calculation of the average salary, as they are not classified as employees. This methodological change explains the difference between the rates reported in 2024 (8.97) and 2025 (11.09).

201-1: Starting in 2025, the indicators were consolidated in accordance with IFRS. Consequently, to ensure comparability, the numbers for previously published years (2023 and 2024) were altered to align with the new methodology. With the change in methodology and compared to the report published the previous year, the economic value retained in 2023 increased 32.4%, while the number for 2024 decreased 34.4%.

404-1: The methodology used to calculate the 2025 data has been revised and now uses the employee base defined in GRI 2-7, which excludes interns.

405-1: The organization restated its workforce diversity data due to a change in the definition of the reported categories, excluding interns from the data since they are not classified as direct employees. As a result, historical data was recalculated using this same methodology to ensure the comparability and consistency of the indicators across years.

G4 FS7 and FS8: In 2025, the Bank streamlined the management of its sustainable portfolio including new lines of credit and refining technical criteria (such as those used in Renovagro and Proirriga). 

 2-12 a) Describe the role of the highest governance body and of senior executives in developing, approving, and updating the organization’s purpose, value or mission statements, strategies, policies, and goals related to sustainable development.

The Annual Shareholders Meeting is the highest governance body, responsible for major corporate decisions. The Board of Directors reports to it and is responsible for setting strategic guidelines and overseeing management, while the Executive Board runs the operations and implements the strategies and policies approved.

2-12 b) Describe the role of the highest governance body in overseeing the organization’s due diligence and other processes to identify and manage the organization’s impacts on the economy, environment, and people, including:

2-12 b) i) whether and how the highest governance body engages with stakeholders to support these processes;

The highest governance body does not engage with stakeholders in due diligence processes.

2-12 b) ii) how the highest governance body considers the outcomes of these processes.

The highest governance body does not engage with stakeholders in due diligence processes.

2-12 c) Describe the role of the highest governance body in reviewing the effectiveness of the organization’s processes as described in 2-12 b, and report the frequency of this review.

SAC risk management is coordinated by the Corporate Risk Unit under the supervision of the Risk Department, the Risk Committee, the Social, Environmental, and Climate Responsibility Committee, and the Board of Directors, operating independently of Internal Audit. This topic is also reported monthly to the Social, Environmental, and Climate Responsibility Committee and quarterly to the Board of Directors.

2-14 a) Report whether the highest governance body is responsible for reviewing and approving the reported information, including the organization’s material topics, and if so, describe the process for reviewing and approving the information.

2-14 b) If the highest governance body is not responsible for reviewing and approving the reported information, including the organization’s material topics, explain the reason for this.

The Sustainability Report is approved by the Executive Board and the Social, Environmental, and Climate Responsibility Committee, and is subsequently submitted to the Board of Directors for review.

2-22 a) Report a statement from the highest governance body or most senior executive of the organization about the relevance of sustainable development to the organization and its strategy for contributing to sustainable development.

The Message from Management is available in the Sustainability Report.

2-8 a) Report the total number of workers who are not employees and whose work is controlled by the organization and describe:

2-8 a) i) the type of work they perform;

¹ Includes customer service, teller operations, providing documents to customers, supporting the activities of branches and other departments within the Bank, and other administrative duties.

² The employee data does not include Bagergs.

2-8 a) ii) the most common types of worker and their contractual relationship with the organization.

Interns are hired through a partnership with the Centro de Integração Empresa Escola (CIEE). The deputed employee joined us through a deputation agreement between public organizations.

2-8 b) Describe the methodologies and assumptions used to compile the data, including whether the number of workers who are not employees is reported:

2-8 b) i) in head count, full-time equivalent (FTE), or using another methodology;

2-8 b) ii) at the end of the reporting period, as an average across the reporting period, or using another methodology.

The numbers were obtained from our database based on the total consolidated data at the end of the year.

2-8 c) Describe significant fluctuations in the number of workers who are not employees during the reporting period and between reporting periods.

During this period, difficulties were encountered in filling internship positions in various locations due to the lack of students approved in previous recruitment processes, and so a new recruitment drive was held in December 2025 to address this shortfall.

2-25 a) Describe its commitments to provide for or cooperate in the remediation of negative impacts that the organization identifies it has caused or contributed.

Banrisul is committed to addressing negative impacts through initiatives such as reducing GHG emissions by transitioning to renewable energy and offsetting residual consumption, and by upholding labor rights through Collective Bargaining Agreements (CBAs) in collaboration with labor unions.

2-25 b) Describe its approach to identify and address grievances, including the grievance mechanisms that the organization has established or participates.

We have a Whistleblower Channel to receive reports from employees, managers, customers, suppliers, and other stakeholders regarding suspected irregularities, such as fraud, corruption, harassment, or violations of the Code of Ethics and Conduct. Reports may be submitted either with identification or anonymously, and we guarantee the confidentiality of information and protection against reprisals.

2-25 c) Describe other processes by which the organization provides for or cooperates in the remediation of negative impacts that it identifies it has caused or contributed.

Notable among the mitigation initiatives are the expanded use of renewable energy, which accounted for 49.59% of consumption in 2025, and the offsetting of emissions through carbon credits and renewable energy certificates.

Among the goals we have set are expanding awareness and training initiatives on harassment prevention for senior leadership and all levels of management by 2026, as well as streamlining institutional processes related to reporting, investigating, and holding individuals accountable for cases of harassment.

2-25 d) Describe how the stakeholders who are the intended users of the grievance mechanisms are involved in the design, review, operation, and improvement of these mechanisms.

The Ombudsman’s Office is the final recourse for customers and users, while internal initiatives for listening and dialogue—including collective bargaining agreements with labor unions—help address concerns and bolster labor relations.

2-25 e) Describe how the organization tracks the effectiveness of the grievance mechanisms and other remediation processes, and report examples of their effectiveness, including stakeholder feedback.

The channel is managed by an independent Controls and Compliance department, which is responsible for analyzing and investigating cases, including verifying information, collecting evidence, and determining corrective or disciplinary measures. Cases involving rights violations may be referred to the People Management Committee and, depending on the severity, to the Executive Board. Follow-up is done through periodic reports to Senior Management, and cases are resolved within 45 days, in accordance with CMN Resolution 4,859/2020. Records are maintained in a traceable system that permits analyses in order to continuously improve the processes.

1) The entity shall describe the processes and policies that are set out in its whistleblower programme, including internal compliance programmes; whistleblower hotline details (for example, whether it is managed by an independent third party); reference to, and publication of, the hotline number (for example, within corporate compliance manuals or codes of ethics); whistleblower incentives for reporting violations; and methods for submitting tips.

We have a Whistleblower Channel to receive reports from employees, managers, customers, suppliers, and other stakeholders regarding irregularities, such as fraud, corruption, harassment, or violations of the Code of Ethics and Conduct. Reports may be submitted with identification or anonymously, with the confidentiality of the information and protection against retaliation guaranteed.

In 2025, we enhanced this mechanism by implementing a specialized solution that enables complaints to be filed 24 hours a day via our website or the toll-free number (0800), with the issuance of a case number, tracking of reports, and submission of evidence.

The channel is managed by an independent Controls and Compliance department, which is responsible for analyzing and investigating cases, including verifying information, collecting evidence, and determining corrective or disciplinary measures. Cases involving rights violations may be referred to the People Management Committee and, depending on the severity, to the Executive Board.

Follow-up is done through periodic reports to Senior Management, and cases are resolved within 45 days, in accordance with CMN Resolution 4,859/2020. Records are maintained in a traceable system that permits analyses in order to continuously improve the processes.

In addition, our Ombudsman’s Office serves as a final recourse for customers and users, while internal initiatives for listening and dialogue, including collective agreements with labor unions, help address concerns and strengthen labor relations.

3-3 a) Describe the actual and potential, negative and positive impacts on the economy, environment, and people, including impacts on their human rights.

3-3 b) Report whether the organization is involved with the negative impacts through its activities or as a result of its business relationships, and describe the activities or business relationships.

The responses to these topics are available in the impacts section on the material topics page.

3-3 c) Describe its policies or commitments regarding the material topic.

This topic is managed through the Integrity Program, which brings together policies, procedures, and control mechanisms aimed at preventing, identifying, and addressing conduct inconsistent with institutional principles.

Our commitment to integrity is formalized in Banrisul’s Code of Ethics and Conduct, which guides the behavior of directors, management, employees, interns, suppliers, and partners.

Prevention of money laundering and corruption is carried out under the Integrity Program, through tools such as the Anti-Corruption Policy and the Whistleblower Channel. The Anti-Corruption Policy is aligned with applicable legislation, including Federal Laws 12,846/2013 and 13,303/2016, and establishes the guidelines to prevent, detect, and address situations related to fraud and corruption.

3-3 d) Describe actions taken to manage the topic and related impacts, including:

3-3 d) i) actions to prevent or mitigate potential negative impacts;

3-3 d) ii) actions to address actual negative impacts, including actions to provide for or cooperate in their remediation;

We have a Whistleblower Channel to receive reports from employees, managers, customers, suppliers, and other stakeholders regarding irregularities, such as fraud, corruption, harassment, or violations of the Code of Ethics and Conduct. Reports may be submitted with identification or anonymously, with the confidentiality of the information and protection against retaliation guaranteed.

In 2025, we enhanced this mechanism by implementing a specialized solution that enables complaints to be filed 24 hours a day via our website or the toll-free number (0800), with the issuance of a case number, tracking of reports, and submission of evidence.

The channel is managed by an independent Controls and Compliance department, which is responsible for analyzing and investigating cases, including verifying information, collecting evidence, and determining corrective or disciplinary measures. Cases involving rights violations may be referred to the People Management Committee and, depending on the severity, to the Executive Board.

3-3 d) iii) actions to manage actual and potential positive impacts.

As part of our efforts to strengthen our culture of integrity, we provide mandatory training on ethics and prevention of corruption to all employees. In 2025, we also held workshops on harassment prevention for senior management and middle management, with plans to expand this initiative in 2026.

3-3 e) Report the following information about tracking the effectiveness of the actions taken:

3-3 e) i) processes used to track the effectiveness of the actions;

The effectiveness of these actions is monitored through periodic reports, including the Internal Controls and Compliance Report, which consolidates the results of the initiatives and the functioning of the integrity mechanisms.

3-3 e) ii) goals, targets, and indicators used to evaluate progress;

This topic is monitored through indicators and targets, such as training sessions and the handling of reports received.

3-3 e) iii) the effectiveness of the actions, including progress toward the goals and targets;

The effectiveness of these measures can be seen in the increased transparency and traceability of governance actions and the mitigation of risks related to misconduct and fraud.

3-3 e) iv) lessons learned and how these have been incorporated into the organization’s operational policies and procedures.

The lessons learned from complaints, reports, and internal assessments are incorporated into updates to policies and procedures, thus contributing to the continuous improvement of governance, transparency, and organizational culture.

3-3 f) Describe how engagement with stakeholders has informed the actions taken (3-3 d) and how it has informed whether the actions have been effective (3-3 e).

Follow-up is done through periodic reports to Senior Management, and cases are resolved within 45 days, in accordance with CMN Resolution 4,859/2020. Records are maintained in a traceable system that permits analyses in order to continuously improve the processes. In addition, our Ombudsman’s Office serves as a final recourse for customers and users, while internal initiatives for listening and dialogue, including collective agreements with labor unions, help address concerns and strengthen labor relations.

205-1 a) Total number and percentage of operations assessed for risks related to corruption.

All of Banrisul’s operations (542 in total) were assessed for corruption-related risks.

205-1 b) Significant risks related to corruption identified through the risk assessment.

• External fraud;
• Labor claims and workplace safety deficiencies;
• Inappropriate practices regarding customers, products, and services;
• Damage to physical assets owned by or used by the Institution;
• Interruption of the Institution’s activities;
• Failures in information technology (IT) systems, processes, or infrastructure;
• Failures in the execution, meeting of deadlines, or management of the Institution’s activities.

404-1 a) Average hours of training that the organization’s employees have undertaken during the reporting period, by:  i. gender  ii. employee category.

¹ In 2025, the Banrisul Nosso Jeito Program was implemented, providing training to all of our superintendents and managers.
² The decrease is due to the prioritization of management training, which increased in 2025.
³ The methodology used to calculate the 2025 data was revised and now uses the employee base defined in GRI 2-7, which excludes interns. | GRI 2-4

3-3 a) Describe the actual and potential, negative and positive impacts on the economy, environment, and people, including impacts on their human rights.

3-3 b) Report whether the organization is involved with the negative impacts through its activities or as a result of its business relationships, and describe the activities or business relationships.

Responses to these topics are available in the Impacts section on the material topics page.

3-3 c) Describe its policies or commitments regarding the material topic.

We are committed to the continuous professional development of our employees, going beyond regulatory compliance and aligning our people management practices with recognized industry standards.

3-3 d) Describe actions taken to manage the topic and related impacts, including:

3-3 d) i) actions to prevent or mitigate potential negative impacts; 

3-3 d) ii) actions to address actual negative impacts, including actions to provide for or cooperate in their remediation;

3-3 d) iii) actions to manage actual and potential positive impacts.

We manage this topic in an integrated manner with our planning, budgeting, and decision-making processes, which enables us to identify training needs, coordinate educational initiatives, and monitor the results of professional development programs.

In this context, we organize training initiatives focused on technical improvement and the development of skills aligned with the evolution of our activities.

Learning initiatives are primarily led by our Corporate University, which is responsible for designing training programs, professional development courses, and skills development initiatives aligned with our institutional strategies. These initiatives cover areas such as management, innovation, technology, customer service, governance, and regulatory topics in the financial system. We also provide access to our employees’ final course projects, which are archived in an internal repository, thereby promoting knowledge sharing.

3-3 e) Report the following information about tracking the effectiveness of the actions taken:

3-3 e) i) processes used to track the effectiveness of the actions;

3-3 e) ii) goals, targets, and indicators used to evaluate progress;

These initiatives are monitored based on indicators such as participation, number of training sessions, hours of training, certifications obtained, satisfaction levels, and Net Promoter Score (NPS) metrics applied to educational programs, as well as an assessment of the practical application of acquired knowledge and career progression. We also hold feedback surveys and analyses on the applicability of academic studies conducted by employees.

We also track indicators of hiring, termination, and turnover to assess workforce dynamics and guide retention strategies, with monitoring segmented by gender, age group, and operational units.

3-3 e) iii) the effectiveness of the actions, including progress toward the goals and targets;

In 2025, we allocated R$10.8 million to programs focused on higher education and employee training.

The Relationship Manager Training Program trained 247 professionals during a 13-day in-person session in Porto Alegre, covering planning, products and services, service excellence, and the development of skills such as awareness, self-confidence, and self-responsibility.

In 2025, we hired 147 new employees from the most recent public competitive exam, in line with our strategy to rebuild and strengthen our teams, compared to the 666 hires made in 2024. The profile of new hires was consistent with that of the previous year, with a predominance of professionals aged between 30 and 50 (55.1%), followed by employees under 30 (40.8%) and a small proportion over 50 (4.1%), a pattern similar to that observed in 2024 (54.4%, 43.5%, and 2.1%, respectively).

In terms of gender, new hires in 2025 were 66.7% male and 33.3% female, continuing the trend from 2024, when men accounted for 70.4% and women for 29.6% of new hires. In terms of region, new hires remained concentrated in the South, as in the previous year.

3-3 e) iv) lessons learned and how these have been incorporated into the organization’s operational policies and procedures.

Notable among the initiatives are the enhanced onboarding program for new employees, revisions to selection processes and internal mobility opportunities, as well as the replenishment of teams through public competitive exams and the promotion of well-being initiatives, including those related to mental health.

3-3 f) Describe how engagement with stakeholders has informed the actions taken (3-3 d) and how it has informed whether the actions have been effective (3-3 e).

The results are consolidated in management reports and shared with the Executive Board and employees through institutional communications.

401-1 a) Total number and rate of new employee hires during the reporting period, by age group, gender and region.

¹ The rates were calculated based on the total number of employees.

401-1 b) Total number and rate of employee turnover during the reporting period, by age group, gender and region.

¹ The rates were calculated by subtracting the total number of employees who left from the total number of employees hired in 2025.

404-2 a) Type and scope of programs implemented and assistance provided to upgrade employee skills.

In 2025, we conducted the Relationship Manager Training Program, which trained 247 professionals during a 13-day in-person session in Porto Alegre, covering planning, products and services, service excellence, and the development of skills such as awareness, self-confidence, and self-responsibility.

Another initiative was the Banrisul Nosso Jeito Program, a learning program structured around tracks that develop skills we consider essential for our future, covering commercial, executive, and technical areas. The program prepares the commercial team by enhancing behavior, products, and services; trains leadership in people management, strategic vision, and culture; technical teams in digital, behavioral, and collaborative skills aligned with the new banking model; and drives the strategic use of data, artificial intelligence, and technology to promote innovation, efficiency, ownership, and increasingly human and effective experiences for our customers.

404-2 b) Transition assistance programs provided to facilitate continued employability and the management of career endings resulting from retirement or termination of employment.

The Institution has not identified any specific career transition assistance programs related to retirement.

405-1 a) Percentage of individuals serving on the organization’s governing bodies in each of the following diversity categories:

405-1 a) i) gender;

405-1 a) ii) percentage of employees by job category, by age group;

405-1 a) iii) percentage of employees by job category, by color and/or race.

¹ There were no brown, Indigenous, or yellow people in governance bodies.

405-1 b) Percentage of employees by job category in each of the following diversity categories:

405-1 b) i) gender;

¹ Historical data on diversity has been restated to reflect the exclusion of interns from the calculation base, as they do not have a direct employment relationship. This adjustment standardizes information from previous years with the current methodology, enabling correct comparison between periods. | GRI 2-4

405-1 b) ii) percentage of employees by job category, by age group;

¹ There are no superintendents or assistants below 30.

² Historical data on diversity was restated to reflect the exclusion of interns from the calculation base, as they do not have a direct employment relationship. This adjustment standardizes information from previous years with the current methodology, enabling correct comparison between periods. | GRI 2-4

405-1 b) iii) other diversity indicators, when relevant (such as minorities or vulnerable groups).

¹ There are no superintendents or assistants of Indigenous or Yellow descent. There are no Indigenous managers.

3-3 a) Describe the actual and potential, negative and positive impacts on the economy, environment, and people, including impacts on their human rights.

3-3 b) Report whether the organization is involved with the negative impacts through its activities or as a result of its business relationships, and describe the activities or business relationships.

Responses to these topics are available in the impacts section on the material topics page.

3-3 c) Describe its policies or commitments regarding the material topic.

In 2025, we participated in the Diversity Census conducted by the Brazilian Federation of Banks (Febraban), an initiative that provides a more updated view of the composition of the workforce in the financial sector and helps identify barriers and opportunities for increasing equity.

3-3 d) Describe actions taken to manage the topic and related impacts, including:

3-3 d) i) actions to prevent or mitigate potential negative impacts;

Initiatives were rolled out to strengthen institutional practices related to the prevention of discrimination and harassment. These included workshops for managers and superintendents on harassment prevention, held in the second half of 2025, in which 373 managers participated.

We also launched initiatives aimed at promoting sexual and gender diversity, including discussions and educational content during the LGBTQIAPN+ Pride Month, besides creating information and awareness resources on the corporate intranet. These initiatives seek to expand knowledge about diversity and foster a more welcoming and respectful work environment.

3-3 d) ii) actions to address actual negative impacts, including actions to provide for or cooperate in their remediation;

Reports received through the Whistleblowing Channel are systematically reviewed and followed, and cases are evaluated and referred to the People Management Committee when necessary. This process enables us to monitor incidents and take corrective and disciplinary action, where applicable.

Moreover, a specialized consulting firm was hired to assist in diagnosing and mapping the risks related to harassment and discrimination, as well as to help establish an institutional process for handling complaints, internal investigations, and accountability. This collaborative effort involved the Human Resources, Legal, Compliance, Audit, and Ombudsman areas.

3-3 d) iii) actions to manage actual and potential positive impacts.

We have rolled out initiatives that foster dialogue, raise awareness, and help build more inclusive professional environments. Notable initiatives in 2025 include meetings and activities to raise awareness on diversity, such as the roundtable discussion “Women Leadership: Challenges, Achievements, and the Future of Work,” held in observance of International Women’s Day.

We also support cultural initiatives held at venues such as the Casa de Cultura Mario Quintana (CCMQ), which hosts activities to celebrate diversity and Afro-Brazilian cultural expressions.

3-3 e) Report the following information about tracking the effectiveness of the actions taken:

3-3 e) i) processes used to track the effectiveness of the actions;

The effectiveness of these initiatives is evaluated by monitoring the actions taken, employee participation, and feedback obtained through dialogue forums and our affinity groups.

3-3 e) ii) goals, targets, and indicators used to evaluate progress;

Among the goals we have set are expanding awareness and training initiatives on harassment prevention for senior leadership and all levels of management in 2026, as well as improving institutional processes related to reporting, investigating, and holding individuals responsible for cases of harassment.

3-3 e) iii) the effectiveness of the actions, including progress toward the goals and targets;

The measures taken have contributed to employee engagement, as information and education can foster more welcoming, respectful, and inclusive work environments.

3-3 e) iv) lessons learned and how these have been incorporated into the organization’s operational policies and procedures.

In the first half of 2026, we plan to expand these training programs to managers from other regional superintendent offices, including leaders from other regions of the state and units outside Rio Grande do Sul, as well as the Executive Board and the Board of Directors.

3-3 f) Describe how engagement with stakeholders has informed the actions taken (3-3 d) and how it has informed whether the actions have been effective (3-3 e).

We promote alignment among technical departments, managers, and responsible units to support the inclusion of people with disabilities and transgender individuals and to structure the monitoring of their progress, ensuring greater traceability of actions and consistency of information over time. Discussions and inputs are recorded in minutes of meetings and evaluations of the activities, enabling us to identify the lessons learned and opportunities for improvement.

417-3 a) Total number of incidents of non-compliance with regulations and/or voluntary codes concerning marketing communications, including advertising, promotion, and sponsorship, by:

417-3 a) i) incidents of non-compliance with regulations resulting in a fine or penalty;

417-3 a) ii) incidents of non-compliance with regulations resulting in a warning;

417-3 a) iii) incidents of non-compliance with voluntary codes.

417-3 b) If the organization has not identified any non-compliance with regulations and/or voluntary codes, a brief statement of this fact is sufficient.

We did not identify any instances of non-compliance with laws or voluntary codes. In recent years, we implemented several controls, which resulted in more transparent and efficient management of marketing activities.

3-3 a) Describe the actual and potential, negative and positive impacts on the economy, environment, and people, including impacts on their human rights.

3-3 b) Report whether the organization is involved with the negative impacts through its activities or as a result of its business relationships, and describe the activities or business relationships.

Responses to these topics are available in the impacts section on the material topics page.

3-3 c) Describe its policies or commitments regarding the material topic.

We have a Customer and User Relationship Policy that establishes guidelines for all stages of the customer journey, with a focus on transparency, fairness, and responsibility in interactions. These guidelines also govern the communication of products and services, ensuring clarity in contracts, institutional materials, campaigns, and digital channels.

3-3 d) Describe actions taken to manage the topic and related impacts, including:

3-3 d) i) actions to prevent or mitigate potential negative impacts;

The policy also establishes continuous employee training, including onboarding sessions and online courses, with a focus on consultative selling, product suitability, and quality customer service. It also guides the monitoring of sales pitches and the periodic review of materials, ensuring accessible language, especially for more vulnerable audiences. In this context, we follow the precautionary principle in communication, with an emphasis on the proper disclosure of risks, costs, and conditions, and offer customer service channels and the Ombudsman’s Office to address customer concerns.

3-3 d) ii) actions to address actual negative impacts, including actions to provide for or cooperate in their remediation;

We have an integrated customer relationship framework that combines in-person service, digital channels, and institutional mechanisms for listening to and resolving customer concerns. This multichannel approach facilitates access to financial services, and ensures that customer questions, requests, and feedback are addressed promptly, transparently, and with a high standard of quality.

This framework includes diverse customer touchpoints, designed to cater to different customer profiles and service needs, including branch offices, call centers, digital channels, Customer Service (SAC), the Ombudsman’s Office, and digital interaction platforms. These channels enable customers to submit requests, clarify doubts, and track queries related to our products and services.

3-3 d) iii) actions to manage actual and potential positive impacts.

In 2025, we redesigned the app, improving its usability and the organization of information, besides adding features such as categorization of expenses, setting budgets, and integrated access to receipts. We also expanded features such as loan amortization and loan repayments directly through the app, further empowering customers.

We also implemented digital solutions, including the virtual assistant Bah, customer service channels via WhatsApp, process automation, and the SAF Inbound Channel, which enables immediate communication with customers in cases of atypical transactions, thus enhancing security.

3-3 e) Report the following information about tracking the effectiveness of the actions taken:

3-3 e) i) processes used to track the effectiveness of the actions;

Our Ombudsman’s Office is an independent customer relations body dedicated to reviewing and addressing complaints that have not been resolved through conventional customer service channels. Its role is to ensure that complaints are evaluated impartially, thereby contributing to the continuous improvement of our services and to greater transparency in our relations with consumers.

Through this channel, we receive and track complaints, suggestions, compliments, and requests, ensuring that each submission is recorded, reviewed, and appropriately addressed. The requests received by the Ombudsman’s Office are analyzed in conjunction with the concerned departments, enabling us to assess the adequacy of the solutions presented to customers. Apart from mediating conflicts, the Ombudsman’s Office also plays a strategic role in identifying opportunities for improving internal processes, products, and customer service practices.

The records and analyses made by the Ombudsman’s Office are included in internal management and informational reports, which support decisions and help define corrective or preventive actions aimed at improving the customer experience. Information gathered through this channel helps us evaluate the quality of the services we provide and refine our customer relationship policies, reinforcing our commitment to active listening and the responsible resolution of customer concerns.

3-3 e) ii) goals, targets, and indicators used to evaluate progress;

Key metrics monitored include customer satisfaction surveys (CSAT), the Net Promoter Score (Relational NPS), the Service Level Index (SLI), and the First Call Resolution (FCR) indicator. These metrics enable us to evaluate different aspects of the customer experience, such as service quality, speed in resolving issues, and overall perception of the services provided by the Bank.

3-3 e) iii) the effectiveness of the actions, including progress toward the goals and targets;

The results of these assessments help us identify opportunities for improving services and bolster practices that help build trusting relationships with our customers. This monitoring also supports the development of strategies aimed at improving the user experience and strengthening long-term relations with the diverse stakeholder segments we serve. We monitor performance indicators periodically and compare them with the internal targets set by us. In 2025, the average results for indicators such as INS, CSAT, and FCR remained within performance ranges considered satisfactory, demonstrating progress in service quality and in resolving customer requests.

3-3 e) iv) lessons learned and how these have been incorporated into the organization’s operational policies and procedures.

By integrating the results of these assessments into our management processes, we seek to continuously improve the quality of our services and strengthen our role as a financial institution committed to excellence in customer service and to creating value for our clients.

3-3 f) Describe how engagement with stakeholders has informed the actions taken (3-3 d) and how it has informed whether the actions have been effective (3-3 e).

Within the scope of customer relationship governance, we have established a dedicated department for implementing and monitoring the Customer and User Relationship Policy. This unit defines metrics and indicators, monitors the customer experience, and identifies opportunities for improvement in service processes.

3-2 a) List its material topics.

• Data privacy and security
• Customer relations and satisfaction
• Ethics, integrity, and transparency
• Innovation and technology
• Talent retention and development
• Social, environmental, and climate risk
• Diversity, equity, and inclusion

3-2 b) Report changes to the list of material topics compared to the previous reporting period.

In relation to the previous materiality assessment, new topics were added to the list, namely “Social, environmental, and climate risk” and “Customer relations and satisfaction.”

The topic “Employee development, retention, and well-being” was redefined as “Talent retention and development,” and the topic “Diversity and inclusion” was redefined as “Diversity, equity, and inclusion.” The topics “Climate Change,” “Sustainable Products and Business,” and “Financial inclusion and education” were excluded in this new phase.

3-1 a) Describe the process it has followed to determine its material topics, including:

For the 2025 cycle, the materiality assessment involved a combined approach of qualitative and quantitative analyses. Initially, a survey was conducted of relevant topics based on national and international references, including industry benchmarks, internal documents, and ESG frameworks. At the same time, risks and opportunities associated with the Bank’s operations were assessed, enabling it to identify the positive and negative impacts—both actual and potential—related to each topic.

The next step involved engaging strategic stakeholders through interviews and conducting an online survey among a broader group of stakeholders, including customers, employees, investors, suppliers, and representatives from the government and civil society. The findings were analyzed using a methodology of weighting based on stakeholder groups, reflecting the significance of each stakeholder group.

The topics were prioritized based on an integrated analysis of the findings of the stakeholder survey and impact assessment, taking into account criteria such as significance to the business, magnitude of impacts, and their influence on decision-making. This process resulted in the development of a materiality matrix, which guides the management of priority topics and the disclosure of information in the Report.

3-1 a) i) how it has identified actual and potential, negative and positive impacts on the economy, environment, and people, including impacts on their human rights, across its activities and business relationships;

Risks and opportunities associated with the Bank’s operations were assessed, enabling it to identify the positive and negative, actual and potential impacts related to each topic.

3-1 a) ii) how it has prioritized the impacts for reporting based on their significance.

The impacts were classified according to their nature and their financial effect on the Company.

3-1 b) Specify the stakeholders and experts whose views have informed the process of determining its material topics.

The process was also conducted in accordance with international sustainability guidelines and standards, ensuring methodological consistency and comparability of the reported information. The topics were validated and finally approved by the relevant governance bodies.

3-3 a) Describe the actual and potential, negative and positive impacts on the economy, environment, and people, including impacts on their human rights.

3-3 b) Report whether the organization is involved with the negative impacts through its activities or as a result of its business relationships, and describe the activities or business relationships.

The responses to these topics are available in the impacts section on the material topics page.

3-3 c) Describe its policies or commitments regarding the material topic.

Digital transformation is one of our strategic pillars for strengthening competitiveness in the financial system and expanding our service capacity in an increasingly dynamic and technology-driven market. In this context, we are engaged in a continuous process of modernization, with investments in infrastructure, platform upgrades, and the development of more agile, integrated solutions centered on the customer experience.

To ensure the integrity and security of our digital operations, we have an Information and Cybersecurity Policy, which is periodically reviewed and aligned with international standards and best practices. The policy establishes the guidelines for protecting the Bank’s and its customers’ information assets and for preventing technological risks.

3-3 d) Describe actions taken to manage the topic and related impacts, including:

3-3 d) i) actions to prevent or mitigate potential negative impacts;

3-3 d) ii) actions to address actual negative impacts, including actions to provide for or cooperate in their remediation;

3-3 d) iii) actions to manage actual and potential positive impacts.

Recent advancements include the modernization of the Banrisul app and the addition of features focused on financial management, product sign-ups, and transaction processing. The digital customer journey was redesigned to simplify services such as Pix, card management, and statement queries, providing users with greater ease of use and autonomy.

The expansion of the Banrisul Digital Account represents another milestone, with 300,000 accounts opened nationwide, extending our reach beyond Rio Grande do Sul and enabling accounts to be opened entirely online.

The digitization of operations has helped streamline internal processes, integrate business areas, and expand the use of data in risk management, credit analysis, and development of solutions. This process is led by multidisciplinary teams, and uses agile methodologies and omnichannel solutions.

We have also expanded our presence in the technology ecosystem through APIs and Banking as a Service (BaaS) initiatives, in addition to using artificial intelligence to support operational routines and decision-making.

The Information Technology Architecture area is responsible for defining and enhancing the processing, storage, and communication architecture, ensuring the reliability, availability, and currency of the digital infrastructure, as well as supporting the adoption of new technologies by business units.

Operations are continuously monitored by a Security Operations Center (SOC), which works around the clock to detect unauthorized access, hacking attempts, and information security incidents.

In case of critical incidents, response protocols are activated, including crisis rooms and coordinated action by technical teams, as well as the roll-out of the Operational Continuity, Disaster Recovery, and Business Continuity Plans.

Technology risk management is supported by periodic incident reports and action plans, which are monitored by the Executive Board and the Board of Directors, including issues related to fraud and scams.

3-3 e) Report the following information about tracking the effectiveness of the actions taken:

3-3 e) i) processes used to track the effectiveness of the actions;

The effectiveness of innovation and digital transformation initiatives is monitored through performance indicators, internal assessments, and ongoing interaction with partner departments, enabling us to identify opportunities for improvement and prioritize corrective actions.

3-3 e) ii) goals, targets, and indicators used to evaluate progress;

We work toward a goal: to have no significant information security incidents, which was achieved in 2025.

3-3 e) iii) the effectiveness of the actions, including progress toward the goals and targets;

In the first two editions, we accelerated 60 startups, providing over 1,000 hours of mentoring to around 140 entrepreneurs. More than 40% of participants reported the launch of new business ventures or partnerships after the program.

3-3 e) iv) lessons learned and how these have been incorporated into the organization’s operational policies and procedures.

Notable among these advancements are solutions that give customers greater autonomy, such as Pix in installments—integrated with the Bank’s credit line—and the Banri Global Account, a multi-currency international account that allows transactions directly through the app.

We also streamlined our payment methods, with improvements to Banricompras, inclusion of contactless payments and greater interoperability, enhancing the convenience of transactions.

We also launched the new Investment Portal, integrated into the app, offering a more intuitive experience and simplified access to products and portfolio tracking.

3-3 f) Describe how engagement with stakeholders has informed the actions taken (3-3 d) and how it has informed whether the actions have been effective (3-3 e).

During the development of digital solutions, users participate in pilot tests and validation processes, helping to identify bottlenecks and guide technical and operational adjustments.Project outcomes are shared at internal meetings and on corporate platforms, fostering team engagement and the exchange of feedback. Interaction with employees, the branch network, and technology partners also contributes to continuous cycles of solution enhancements.

1) The entity shall disclose the amount of card-related fraud losses incurred during the reporting period.

2) The entity shall disclose card-related fraud losses as (1) card-not-present (CNP) and (2) card-present and other fraud losses.

Banrisul does not distinguish between card-present and card-not-present frauds.

3-3 a) Describe the actual and potential, negative and positive impacts on the economy, environment, and people, including impacts on their human rights.

3-3 b) Report whether the organization is involved with the negative impacts through its activities or as a result of its business relationships, and describe the activities or business relationships.

The responses to these topics are available in the impacts section on the material topics page.

3-3 c) Describe its policies or commitments regarding the material topic.

Digital transformation is one of our strategic pillars for strengthening competitiveness in the financial system and expanding our service capacity in an increasingly dynamic and technology-driven market. In this context, we are engaged in a continuous process of modernization, with investments in infrastructure, platform upgrades, and the development of more agile, integrated solutions centered on the customer experience.

To ensure the integrity and security of our digital operations, we have an Information and Cybersecurity Policy, which is periodically reviewed and aligned with international standards and best practices. The policy establishes the guidelines for protecting the Bank’s and its customers’ information assets and for preventing technological risks.

3-3 d) Describe actions taken to manage the topic and related impacts, including:

3-3 d) i) actions to prevent or mitigate potential negative impacts;

3-3 d) ii) actions to address actual negative impacts, including actions to provide for or cooperate in their remediation;

3-3 d) iii) actions to manage actual and potential positive impacts.

Recent advancements include the modernization of the Banrisul app and the addition of features focused on financial management, product sign-ups, and transaction processing. The digital customer journey was redesigned to simplify services such as Pix, card management, and statement queries, providing users with greater ease of use and autonomy.

The expansion of the Banrisul Digital Account represents another milestone, with 300,000 accounts opened nationwide, extending our reach beyond Rio Grande do Sul and enabling accounts to be opened entirely online.

The digitization of operations has helped streamline internal processes, integrate business areas, and expand the use of data in risk management, credit analysis, and development of solutions. This process is led by multidisciplinary teams, and uses agile methodologies and omnichannel solutions.

We have also expanded our presence in the technology ecosystem through APIs and Banking as a Service (BaaS) initiatives, in addition to using artificial intelligence to support operational routines and decision-making.

The Information Technology Architecture area is responsible for defining and enhancing the processing, storage, and communication architecture, ensuring the reliability, availability, and currency of the digital infrastructure, as well as supporting the adoption of new technologies by business units.

Operations are continuously monitored by a Security Operations Center (SOC), which works around the clock to detect unauthorized access, hacking attempts, and information security incidents.

In case of critical incidents, response protocols are activated, including crisis rooms and coordinated action by technical teams, as well as the roll-out of the Operational Continuity, Disaster Recovery, and Business Continuity Plans.

Technology risk management is supported by periodic incident reports and action plans, which are monitored by the Executive Board and the Board of Directors, including issues related to fraud and scams.

3-3 e) Report the following information about tracking the effectiveness of the actions taken:

3-3 e) i) processes used to track the effectiveness of the actions;

The effectiveness of innovation and digital transformation initiatives is monitored through performance indicators, internal assessments, and ongoing interaction with partner departments, enabling us to identify opportunities for improvement and prioritize corrective actions.

3-3 e) ii) goals, targets, and indicators used to evaluate progress;

We work toward a goal: to have no significant information security incidents, which was achieved in 2025.

3-3 e) iii) the effectiveness of the actions, including progress toward the goals and targets;

In the first two editions, we accelerated 60 startups, providing over 1,000 hours of mentoring to around 140 entrepreneurs. More than 40% of participants reported the launch of new business ventures or partnerships after the program.

3-3 e) iv) lessons learned and how these have been incorporated into the organization’s operational policies and procedures.

Notable among these advancements are solutions that give customers greater autonomy, such as Pix in installments—integrated with the Bank’s credit line—and the Banri Global Account, a multi-currency international account that allows transactions directly through the app.

We also streamlined our payment methods, with improvements to Banricompras, inclusion of contactless payments and greater interoperability, enhancing the convenience of transactions.

We also launched the new Investment Portal, integrated into the app, offering a more intuitive experience and simplified access to products and portfolio tracking.

3-3 f) Describe how engagement with stakeholders has informed the actions taken (3-3 d) and how it has informed whether the actions have been effective (3-3 e).

During the development of digital solutions, users participate in pilot tests and validation processes, helping to identify bottlenecks and guide technical and operational adjustments.Project outcomes are shared at internal meetings and on corporate platforms, fostering team engagement and the exchange of feedback. Interaction with employees, the branch network, and technology partners also contributes to continuous cycles of solution enhancements.

418-1 a) Total number of substantiated complaints received concerning breaches of customer privacy, categorized by:

418-1 a) i) complaints received from outside parties and substantiated by the organization;

418-1 a) ii) complaints from regulatory bodies.

418-1 b) Total number of identified breaches, thefts, or losses of customer data.

418-1 c) If the organization has not identified any substantiated complaints, a brief statement to that effect will suffice.

¹ In the last 3 years, there have been no complaints from regulatory agencies, and no leaks, thefts, or losses of customer data were identified.

² In 2025, eight customer complaints involving the issue of “bank secrecy” and/or the root cause LGPD were recorded through the Ombudsman’s Office service channels, including external agencies; none of these complaints was classified as valid (those recorded through the Ombudsman’s Office channel were classified as unfounded, and those filed with BACEN—where the classification of validity is determined by the BACEN—were considered “inconclusive”).

1) Total number and percentage of all available access points in areas with low population density or economically disadvantaged areas, by region and by type of access.

2) Provide context for this data in relation to overall access to financial services in the reported regions/provide any benchmarks.

3) The classification system used by the reporting organization to categorize the regions.

¹ The urbanization rate for Rio Grande do Sul, with an average of 87.5%, was used to identify 412 localities with rates below this value. Data is from the 2022 IBGE Census, the most recent available.

1) Whether the organization has implemented auditing systems for its environmental and social risk assessment policies.

Processes related to Social, Environmental, and Climate risk management are periodically assessed through internal control and audit mechanisms to ensure compliance with institutional policies, regulatory standards, and best governance practices. Internal Audit plays an independent role in this process, evaluating the effectiveness of controls and the compliance of the procedures adopted.

2) Any exclusions or limitations to the audit coverage of regions or products and services.

There are no exclusions or limitations on audit coverage related to regions or products and services.

3) Whether the audit(s) was carried out using internal/ external auditor(s).

Internal Audit.

4) The names of any standards utilized for the audit.

In 2025, we evaluated the processes related to the formulation and implementation of the Social, Environmental, and Climate Responsibility Policy in compliance with CMN Resolution 4,945/2021. For 2026, a new audit is planned, focusing on social, environmental, and climate risk management, in line with the guidelines established by CMN Resolutions 4,945/2021 and 4,557/2017.

5) Follow-up actions (if any) to overall findings of the audit(s).

As part of its responsibilities, Internal Audit periodically monitors these processes and issues its opinions, whenever applicable, which are forwarded for resolution and compliance.

1) The entity shall describe its approach to the incorporation of environmental, social and governance (ESG) factors in its credit analysis. 

In our credit analysis, we incorporate ESG factors into procedures that cover the customer, the transaction, and collateral. Although we have not formally adopted the Equator Principles, we apply equivalent procedures for transactions with exposure of over R$10 million, which we consider a structured ESG assessment, whose score is integrated into the internal risk rating. In such cases, transactions with a specific purpose are subject to the preparation of a technical opinion on social, environmental, and climate risk (RSAC), which is considered in the Credit Committee’s decision. In 2025, 22 RSAC opinions were issued for targeted credit transactions of over R$10 million.

2) The entity shall describe the policies that determine its approach to the incorporation of ESG factors in its credit analysis.

Our operations are guided by Banrisul’s Social, Environmental, and Climate Responsibility Policy, which establishes guidelines for integrating ESG aspects into the institution’s strategy, products, and processes, promoting the efficient use of natural resources, respect for human rights, support for the transition to a low-carbon economy, and the strengthening of governance and a culture of integrity.

4) The entity shall discuss how it incorporates ESG factors when estimating credit losses over the contractual term of the entity’s financial assets.

The estimate of expected losses is not directly adjusted for ESG factors.

5) The entity shall describe its approach to implementation of the aspects of the entity’s ESG incorporation practices.

The implementation of this agenda is guided by policies, governance mechanisms, and monitoring tools that enable us to integrate ESG criteria into our operations. The main tool is the Social, Environmental, and Climate Responsibility Policy (PRSAC), which establishes guidelines for incorporating these aspects into the Bank’s strategic decisions and operations.

6) The entity shall describe its oversight and accountability approach to the incorporation of ESG factors.

SAC risk management is coordinated by the Corporate Risk Unit, under the supervision of the Risk Management Department, the Risk Committee, the Social, Environmental, and Climate Responsibility Committee, and the Board of Directors, as well as independently by Internal Audit.

Monitoring is conducted through structured reporting, with the focus on the Social, Environmental, and Climate Risks and Responsibility Report, which is submitted to management, as well as periodic updates to the Social, Environmental, and Climate Responsibility Committee and the Board of Directors.

7) The entity shall discuss whether it conducts scenario analysis or modelling in which the risk profile of future ESG trends is calculated at the portfolio level of commercial and industrial credit exposure.

8) The entity shall discuss ESG trends it considers apply broadly in terms of their effect on sectors and industries, as well as the trends it deems as sector- or industry-specific.

SAC risk analysis is integrated into credit approval, supplier evaluation, and product development processes, taking into account physical risks associated with extreme weather events and transition risks related to economic and regulatory changes. Social aspects, such as human rights, inclusion, and impacts on communities, are also considered, as well as environmental aspects, including potential impacts resulting from environmental degradation, the inappropriate or intensive use of natural resources, and environmental and regional restrictions associated with the financed activities.

9) The entity shall describe significant concentrations of credit exposure to ESG factors, which may include carbon-related assets, water-stressed regions and cybersecurity risks.

The sector assessment takes into account the SAC Risk Taxonomy, and no significant concentrations above the defined limits were identified.

10) The entity shall describe how ESG factors are incorporated in the assessment of and influence the entity’s views.

Banrisul considers ESG factors in credit assessments by analyzing their effects on macro- and microeconomic scenarios, the borrower’s risk rating, expected losses, and collateral. These factors may influence limits, mitigating factors, and contractual terms, but do not directly alter the term of the transactions, estimated expected losses, or the value of collateral, which follow traditional credit and valuation criteria.

305-1 a) Gross direct (Scope 1) GHG emissions in metric tons of CO₂ equivalent.

305-1 b) Gases included in the calculation: CO₂, CH₄, N₂O, HFCs, PFCs, SF₆,NF₃, or all of them.

305-1 c) Biogenic CO2 emissions in metric tons of CO₂ equivalent.

305-1 d) Base year for the calculation, if applicable, including:

305-1 d) i) the justification for its selection;

305-1 d) ii) emissions in the base year;

305-1 d) iii) the context of any significant changes in emissions that necessitated new calculations of emissions in the base year.

305-1 e) Source of the emission factors and global warming potential (GWP) values used, or a reference to the source of the GWP values.

305-1 f) The consolidation approach chosen for emissions: equity, financial, or operational control.

305-1 g) Standards, methodologies, assumptions, and/or calculation tools adopted.

305-2 a) Gross location-based energy indirect (Scope 2) GHG emissions in metric tons of CO₂ equivalent.

305-2 b) If applicable, the total indirect GHG emissions (Scope 2) from energy purchases, in metric tons of CO₂ equivalent, calculated on a market-based basis.

305-2 c) If available, the gases included in the calculation; whether CO₂, CH₄, N₂O, HFCs, PFCs, SF₆, NF₃, or all.

305-2 d) Base year for the calculation, if applicable, including:

305-2 d) i) the rationale for its selection;

305-2 d) ii) emissions in the base year;

305-2 d) iii) the context of any significant changes in emissions that necessitated recalculating emissions for the base year.

305-2 e) Source of the emission factors and global warming potential (GWP) values used, or a reference to the GWP source.

305-2 f) The consolidation approach adopted for emissions; whether based on equity ownership, financial control, or operational control.

305-2 g) Standards, methodologies, assumptions, and/or calculation tools adopted.

305-3 a) Gross other indirect (Scope 3) GHG emissions in metric tons of CO₂ equivalent.

305-3 b) If available, the gases included in the calculation; CO₂, CH₄, N₂O, HFCs, PFCs, SF₆, NF₃, or all of them.

305-3 c) Biogenic CO₂ emissions in metric tons of CO₂equivalent.

305-3 d) Other categories and activities of indirect GHG emissions (Scope 3) included in the calculation.

305-3 e) Base year for the calculation, if applicable, including:

305-3 e) i) the rationale for its selection;

305-3 e) ii) emissions in the base year;

305-3 e) iii) the context of any significant changes in emissions that necessitated new emissions calculations for the base year.

305-3 f) Source of the emission factors and global warming potential (GWP) values used, or a reference to the GWP source.

305-3 g) Standards, methodologies, assumptions, and/or calculation tools adopted.

Tons of CO2e per year

¹ The greenhouse gases (GHGs) included in the inventory, in accordance with the GHG Protocol methodology, are CO₂, CH₄, N₂O, HFCs, PFCs, SF₆, and NF₃. The first complete and verified inventory was conducted in 2021, providing greater accuracy and transparency to the metrics and targets. Scope 1 emissions for that year totaled 958.9 tCO₂e. Emissions are calculated using emission factors defined by the GHG Protocol calculation tool and verified by an independent audit firm. The inventory data consolidates emissions from three companies: Banco do Estado do Rio Grande do Sul, Banrisul Soluções em Pagamentos, and Banrisul Armazéns Gerais. The calculation methodology adopts the operational control and equity ownership approaches, in accordance with GHG Protocol guidelines.

²  In our first inventory, conducted in 2020, our emissions under the purchase choice approach were not reduced to zero because we did not purchase renewable energy certificates that year and had not yet begun the transition to renewable energy consumption. These processes began in 2021 when we started demonstrating the traceability of all energy consumed using I-RecECs, thereby zeroing our emissions through the purchase choice approach.

³  Biogenic emissions increased due to higher emissions in the Upstream Transportation and Home-to-Work categories, as these emissions directly depend on the results of those categories for calculation.

⁴ To monitor the target for reducing emissions, the sum of Scopes 1 and 2 (using the purchase-based approach) is considered, with 2020 as the base year, compared to emissions in the most recent measured year.

201-1 1 a) Direct economic value generated and distributed (EVG&D) on an accruals basis, including the basic components for the organization’s global operations as listed below. If data are presented on a cash basis, report the justification for this decision in addition to reporting the following basic components:

201-1 a) i) direct economic value generated: revenues;

201-1 a) ii) economic value distributed: operating costs, employee wages and benefits, payments to providers of capital, payments to government by country, and community investments;

201-1 a) iii) economic value retained: ‘direct economic value generated’ less ‘economic value distributed.

¹ The 2023 and 2024 numbers have been restated to comply with the IFRS standard adopted in 2025. The change resulted in a 32.4% increase in economic value retained for 2023 and a 34.4% decrease for 2024, ensuring comparability between the years. | GRI 2-4

201-1 b) Where significant, report EVG&D separately at country, regional, or market levels, and the criteria used for defining significance.

Banrisul’s focus of operations is southern Brazil.

302-1 a) Total fuel consumption within the organization from non-renewable sources, in joules or multiples, and including fuel types used.

302-1 b) Total fuel consumption within the organization from renewable sources, in joules or multiples, and including fuel types used.

302-1 c) In joules, watt-hours or multiples, the total:

302-1 c) i) electricity consumption;

302-1 c) ii) heating consumption;

302-1 c) iii) cooling consumption;

302-1 c) iv) steam consumption.

302-1 d) In joules, watt-hours or multiples, the total:

302-1 c) i) electricity sold;

302-1 c) ii) heating sold;

302-1 c) iii) cooling sold;

302-1 c) iv) steam sold.

302-1 e) Total energy consumption within the organization, in joules or multiples.302-1 f) Standards, methodologies, assumptions, and/or calculation tools used.

 ¹ Information on Non-Renewable Fuels (LPG) is in tons (t), which is the standard unit used by the GHG Protocol methodology. Other conversions follow the 2021 National Energy Balance (base year 2020). To convert the LPG value from tons to GJ, we use the maximum permitted density of LPG as per applicable law (https://www.in.gov.br/en/web/dou/-/resolucao-n-825-de-28-de-agosto-de-2020-274891354).

² Since 2023, we have been tracking ethanol refueling for vehicles in our own and leased fleets, given its lower greenhouse gas emissions, thereby contributing to the mitigation efforts in the Mobile Combustion category.

³ Since 2023, the calculation of diesel consumption has also included the quantity used by motor vehicles, in addition to the amount already used by generators.

⁴ No energy was sold. There was no consumption of heating, cooling, or steam.

^⁵ In the second half of 2025, we began consuming renewable energy through the Distributed Generation process.

203-1 a) Extent of development of significant infrastructure investments and services supported.

In 2025, the Banrisul Group sponsored more than 480 projects in various fields and made 28 donations, distributed across several municipalities in Rio Grande do Sul.

These investments include cultural, educational, and sports projects, as well as support for fairs, shows, and exhibitions held in different regions of the state. The initiatives supported cover topics related to family farming, agriculture and livestock, industry, regional tourism, gastronomy, and technology, helping to boost local economies and strengthen the institution’s ties with the communities where it operates.

203-1 b) Current or expected impacts on communities and local economies, including positive and negative impacts where relevant.

We contribute to creating positive indirect economic impacts by strengthening employability, entrepreneurship, and regional economic dynamics.

203-1 c) Whether these investments and services are commercial, in-kind, or pro bono engagements.

Investments are made in kind.

a) Report the list of initiatives to make facilities and services accessible to disadvantaged peoples.

1) List of products and services broken down by business line (retail banking, commercial and corporate banking, insurance) for each of the topics below.

¹ We have adopted the current nomenclature for sustainable products, but the purpose and account balance encompass the historical record of the line.

² We have adopted the current nomenclature for sustainable products; however, the purpose and account balance encompass the historical record of the product line.

306-3 a) Total weight of waste generated in metric tons, and a breakdown of this total by composition of the waste.

306-4 a) Total weight of waste not destined for disposal, and a breakdown of that total by waste composition.

306-4 b) Total weight of hazardous waste diverted from disposal in metric tons, and a breakdown of this total by the following recovery operations:

306-4 b) i) preparation for reuse;

306-4 b) ii) pecycling;

306-4 b) iii) other recovery operations.

306-4 c) total weight of non-hazardous waste diverted from disposal in metric tons, and a breakdown of this total by the following recovery operations:

306-4 c) i) preparation for reuse;

306-4 c) ii) recycling;

306-4 c) iii) other recovery operations. 

306-4 d) For each recovery operation listed in Disclosures (306-4 b) and (306-4 c), a breakdown of the total weight in metric tons of hazardous waste and of non-hazardous waste diverted from disposal:

306-4 d) i) onsite;

306-4 d) ii) offsite.

306-5 a) Total weight of waste directed to disposal in metric tons, and a breakdown of this total by composition of the waste.

306-5 b) Total weight of hazardous waste directed to disposal in metric tons, and a breakdown of this total by the following disposal operations:

306-5 b) i) incineration (with energy recovery);

306-5 b) ii) incineration (without energy recovery);

306-5 b) iii) landfilling;

306-5 b) iv) other disposal operations.

306-5 c) Total weight of non-hazardous waste directed to disposal in metric tons, and a breakdown of this total by the following disposal operations:

306-5 c) i) incineration (with energy recovery);

306-5 c) ii) incineration (without energy recovery);

306-5 c) iii) landfilling;

306-5 c) iv) other disposal operations.306-5 d) For each disposal operation listed in Disclosures (306-5 b) and (306-5 c), a breakdown of the total weight in metric tons of hazardous waste and of non-hazardous waste directed to disposal:

306-5 d) i) onsite;

306-5 d) ii) offsite.

¹ Data on fluorescent lamps, classified as hazardous waste, Class I, is reported in units.

² There was no recovery of waste not intended for final disposal within the Organization, only outside it. In 2025, 2,969 pieces of furniture were donated, all of which were reused by the beneficiary entities.

¹ Organic waste from the Banrisul Headquarters Building destined for landfills is accounted for based on data recorded by Fepam regarding the transportation and final disposal of the waste. Adoption of this control method has made it possible to account for the total volume of waste sent to landfills, which explains the significant year-on-year increase.

² In 2025, no data was available on the weight of hazardous waste not destined for final disposal.

306-2 a) Measures taken, including circular economy measures, to prevent waste generation in the organization’s own operations and throughout its upstream and downstream value chain, as well as to manage the significant impacts of the waste generated.

The Reciclar Program is one of our corporate initiatives on sustainable waste management. Since its launch in 2001, the program has encouraged the proper separation of recyclable materials, expand the environmentally sound disposal of waste generated by our administrative activities, and promote environmental awareness among our employees.

The program includes the implementation of selective waste collection procedures at various Bank locations, as well as educational and awareness initiatives on proper waste sorting in the workplace. The collected materials, such as paper, cardboard, plastics, and metals, are sent to specialized recycling companies, which contributes to the reuse of resources and the reduction of waste sent to landfills.

Besides strengthening circular economy practices, the Reciclar Program also helps foster a culture of environmental responsibility among our employees, encouraging the adoption of sustainable practices in our day-to-day operations.

306-2 b) If the waste generated by the organization through its own activities is managed by a third party, a description of the process used to determine whether the waste is managed in accordance with contractual or legal obligations.

Waste management is an integral part of our environmental responsibility practices and is aligned with the guidelines of the Social, Environmental, and Climate Responsibility Policy (PRSAC).

Since 2018, we have had a Solid Waste Management Plan in place, which guides internal procedures for sorting, storage, transportation, and final disposal, ensuring compliance with environmental laws.

The waste generated by our activities is classified according to its nature, taking into account administrative operations, infrastructure maintenance, renewal of technological equipment, and operational logistics.

306-2 c) The processes used to collect and monitor waste-related data.

This information is tracked through internal records and official documents, such as Waste Transport Manifests (MTR), disposal certificates, and reports issued by specialized companies, ensuring the traceability and proper environmental disposal of waste.

In addition to internal practices, we have established guidelines for proper waste management in the supply chain through the Supplier Manual, which provides guidance on compliance with applicable environmental laws.

201-2 a) Risks and opportunities posed by climate change that have the potential to generate substantive changes in operations, revenue, or expenditure, including:

201-2 a) i) a description of the risk or opportunity and its classification as either physical, regulatory, or other;

In the context of physical risks, we assess extreme events and long-term environmental changes, such as floods, droughts, and storms, which could affect customers and the sectors financed, increase delinquency rates, and require additional provisions. We also consider the potential depreciation of assets used as collateral due to environmental degradation.

Regarding transition risks, we analyze the impacts of regulatory changes, carbon pricing, and the adoption of new technologies, which may affect emission-intensive sectors. These factors can generate significant financial impacts, but they also create business opportunities.

201-2 a) ii) a description of the impact associated with the risk or opportunity;

We analyze the impacts of regulatory changes, carbon pricing, and the adoption of new technologies.

201-2 a) iii) the financial implications of the risk or opportunity before action is taken;

In the area of sustainable finance, we offer credit lines and financial solutions to initiatives that promote energy transition, responsible production, and create positive social impact. Among our key areas of focus are:

• financing for the deployment of renewable energy generation systems, including solar, wind, biomass, and biogas projects;

• credit lines for family farming and low-carbon agriculture, encouraging more sustainable production practices that are resilient to climate change;

• financing for energy efficiency projects aimed at modernizing equipment and reducing energy consumption;

• support for initiatives related to infrastructure and essential services, such as sanitation, health, and education projects; and

• credit lines to strengthen micro, small, and medium-sized enterprises, contributing to regional economic development and income generation.

201-2 a) iv) the methods used to manage the risk or opportunity;

The portfolio is monitored periodically to identify concentrations and continuously improve risk management.

When negative impacts are identified, we take proportionate corrective measures, incorporating repeating occurrences into the planning and updating of policies and procedures.

In this context, we have expanded our offering of credit solutions for climate mitigation and adaptation, including programs such as RenovaAgro, Pronaf, and Proirriga, as well as solutions for energy efficiency and renewable energy generation, such as Finame Fundo Clima, Finame Baixo Carbono, Energy Efficiency Promotion, and CDC Sustainability.

The effectiveness of these actions is measured through audits, monitoring of ESG indicators, and periodic assessments of risks and compliance. Goals and targets are defined based on corporate policies, regulatory guidelines, and international commitments, with progress tracked using performance indicators and metrics.

201-2 a) v) the costs of actions taken to manage the risk or opportunity.

The costs of the measures taken to manage climate risks and opportunities totaled R$ 1,005,700.70.

3-3 a) Describe the actual and potential, negative and positive impacts on the economy, environment, and people, including impacts on their human rights.

3-3 b) Report whether the organization is involved with the negative impacts through its activities or as a result of its business relationships, and describe the activities or business relationships.

The responses to these topics are available in the impacts section on the material topics page.

3-3 c) Describe its policies or commitments regarding the material topic.

The management of social, environmental, and climate risks (SAC risks) is guided by the Social, Environmental, and Climate Risk Management Policy (PGRSAC), approved by the Board of Directors, which establishes the guidelines to identify, assess, monitor, and mitigate these risks, in accordance with the Risk Appetite Statement (RAS) and applicable regulations.

Complementarily, the Social, Environmental, and Climate Responsibility Policy (PRSAC) guides the incorporation of these topics into the corporate strategy, including the integration of social and environmental aspects into products, services, and business opportunities. Its implementation is led by the Chief Risk Officer (CRO), who ensures alignment between risk management, sustainability, and governance.

3-3 d) Describe actions taken to manage the topic and related impacts, including:

3-3 d) i) actions to prevent or mitigate potential negative impacts; 

3-3 d) ii) actions to address actual negative impacts, including actions to provide for or cooperate in their remediation;

3-3 d) iii) actions to manage actual and potential positive impacts.

We have invested in expanding our digital channels and developing solutions that enable customers to open and manage accounts entirely online. The Banrisul Digital Account, launched in 2024, is one of the key advancements in this strategy. The solution offers 100% digital account opening, no fees, and credit card compatibility with digital wallets such as Apple Pay, Google Pay, and Samsung Pay. With 100% digital account opening and integrated management through the Bank’s app, the solution has helped expand access to banking services in different regions of the country.

In 2025, we launched a new version of our app, featuring more intuitive navigation and enhanced features, developed in response to customer feedback and aligned with international digital accessibility guidelines. The upgraded version introduced a more modern design and seamless navigation, expanding the financial control offered to users and the range of services available in the digital environment, enabling users to perform financial transactions, track account activity, and organize their finances in a simpler and more integrated manner.

On the environmental front, we launched initiatives aimed at reducing our operational impacts and promoting sustainable practices. Of particular note is the annual preparation of the Greenhouse Gas Emissions Inventory, which we have been conducting since 2020 based on the GHG Protocol methodology. This enables us to monitor emissions associated with energy and fuel consumption, as well as travel, and to guide our continuous improvement efforts.

Besides managing operational impacts, we allocate resources to initiatives that promote sustainable development. We offer credit lines for energy transition, energy efficiency, sanitation, low-carbon agriculture, and provide support for family farming. We also provide financial solutions aimed at strengthening micro and small businesses and expanding access to essential services.

On the social front, our efforts are related to regional development. A notable example is the Banrisul Cultural and Social Institute, an initiative to support cultural, social, and educational projects, including through investments in restoring and modernizing public libraries in municipalities impacted by climate events.

3-3 e) Report the following information about tracking the effectiveness of the actions taken:

3-3 e) i) processes used to track the effectiveness of the actions;

Actions are monitored through structured reports, notably the Social, Environmental, and Climate Risk and Responsibility Report, which is submitted to Management, in addition to periodic updates to the Social, Environmental, and Climate Responsibility Committee and the Board of Directors.

3-3 e) ii) goals, targets, and indicators used to evaluate progress;

The goals and targets related to social, environmental, and climate risks and sustainability opportunities are defined based on corporate policies, regulatory guidelines, and international commitments undertaken by the Bank. These targets cover topics such as energy efficiency and the improvement of credit processes using ESG criteria.

3-3 e) iii) the effectiveness of the actions, including progress toward the goals and targets;

We are included in B3’s Carbon Efficient Index (ICO2) portfolio, which underscores our commitment to low-carbon practices and transparency in emissions management. Moreover, approximately 49.59% of the energy consumed came from renewable sources, supported by measures such as purchasing energy from solar farms and modernizing our infrastructure.

3-3 e) iv) lessons learned and how these have been incorporated into the organization’s operational policies and procedures.

In 2025, we made further progress in our sustainable finance agenda by developing Banrisul’s Sustainable Finance Framework and conducting the first sustainability assessment of our loan portfolio, in alignment with international benchmarks such as Green, Climate, and Social Bonds. These enhancements strengthen the management and offering of sustainable products and expand the Bank’s capacity to invest in low-carbon activities with high positive social and environmental impact.

3-3 f) Describe how engagement with stakeholders has informed the actions taken (3-3 d) and how it has informed whether the actions have been effective (3-3 e).

The transparency of our ESG practices is reflected in the regular disclosure of information about our performance. The Sustainability Report, prepared annually in accordance with GRI guidelines and subject to independent assurance, presents quantitative and qualitative indicators that enable us to track the progress of our initiatives and compare them with industry peers.

408-1 a) The reporting organization shall report the following information:

408-1 a) i) child labor;

408-1 a) ii) young workers exposed to hazardous work.

408-1 b) Operations and suppliers considered to have significant risk for incidents of child labor either in terms of:

408-1 b) i) type of operation (such as manufacturing plant) and supplier;

408-1 b) ii) countries or geographic areas with operations and suppliers considered at risk.

During the reporting period, we did not identify any operations or suppliers with significant risks related to child labor, youth exposed to hazardous work, or forced labor in the activities of our partners and suppliers, reinforcing our commitment to responsible business practices and respect for fundamental labor rights.

408-1 c) Measures taken by the organization during the reporting period to contribute to the effective abolition of child labor.

In the course of our business, we establish commercial relationships with various types of organizations, including service providers, technology vendors, specialized consulting firms, partner financial institutions, and other entities that support the execution of our operations and strategic initiatives. These relationships are formalized through contracting and monitoring processes that take into account technical, legal, and compliance criteria.

As part of our sustainability governance, we incorporate social and environmental aspects into our supplier management functions. Our contracting and evaluation processes are designed to ensure compliance with legal requirements, labor practices, and respect for human rights, thereby helping to reduce social and environmental risks across our supply chain.

Besides ensuring compliance with legal and regulatory requirements, we seek to foster long-term relationships based on trust, integrity, and a commitment to creating shared value. By including social, environmental, and governance criteria into our procurement processes and supplier relationships, we help build a more sustainable value chain that is aligned with the principles of responsible development.

409-1 a) Operations and suppliers considered to have significant risk for incidents of forced or compulsory labor either in terms of:

409-1 a) i) type of operation (such as manufacturing plant) and supplier;

409-1 a) ii) countries or geographic areas with operations and suppliers considered at risk.

During the reporting period, we did not identify any operations or suppliers with significant risks related to child labor, young people exposed to hazardous work, or forced labor in the activities of our partners and suppliers, reinforcing our commitment to responsible business practices and respect for fundamental labor rights.

409-1 b) Measures taken by the organization in the reporting period intended to contribute to the elimination of all forms of forced or compulsory labor.

In the course of our business, we establish commercial relationships with various types of organizations, including service providers, technology vendors, specialized consulting firms, partner financial institutions, and other entities that support the execution of our operations and strategic initiatives. These relationships are formalized through contracting and monitoring processes that take into account technical, legal, and compliance criteria.

As part of our sustainability governance, we incorporate social and environmental aspects into our supplier management functions. Our contracting and evaluation processes are designed to ensure compliance with legal requirements, labor practices, and respect for human rights, thereby helping to reduce social and environmental risks across our supply chain.

Besides ensuring compliance with legal and regulatory requirements, we seek to foster long-term relationships based on trust, integrity, and a commitment to creating shared value. By including social, environmental, and governance criteria into our procurement processes and supplier relationships, we help build a more sustainable value chain that is aligned with the principles of responsible development.