30. Risk management

The Group has a specific structure for risk management, including policies and procedures, covering the evaluation and monitoring of operational, credit, market and liquidity risks (including cash flow and investments of funds held in payment accounts) incurred by the institution.

The Group’s approach to risk management requires that its risk taking be consistent with its risk appetite. Risk appetite is the aggregate level of risk that the Group is willing to tolerate to achieve its strategic objectives and business plan. PicPay’s risks are generally categorized and summarized as follows:

30.1 Credit risk

The Group’s credit risk arises from its cash, cash equivalents, financial investments, OTC derivatives, acquirer and card issuer receivables, other receivables and loans to its users.

Concentrations of credit risk for similar financial instruments are already being shown in accordance with NE 8.2.1 Credit loss allowance breakdown.

The Risk and Treasury departments manage credit risk associated with bank account balances and investments in financial institutions, prioritizing those with a “AAA” rating from agencies like Moody’s, S&P or Fitch. Because the Group’s accounts receivable mostly consist of high liquidity investments and operational accounts approved by major financial institutions with low-risk ratings, the expected credit loss is not material. Furthermore, these financial institutions are legally responsible for the accounts receivable.

The Group’s available resources are mostly invested in bonds issued by the Brazilian government and reverse repos collateralized by bonds issued by the Brazilian government. There is no significant expected credit loss recognized for these assets.

The Group recognizes amounts receivable from acquirers related to its activity as a sub-acquirer and from card issuers related to its activities as an acquirer and also when its users use its app to settle bank slips or make other payments using an on-boarded credit card. These receivables are due in up to twelve monthly installments. As a result, the Group is exposed to the risk of default by the acquirers and card issuers.

In its role as a sub-acquirer, the Group uses acquirers of national reach while seeking to avoid concentration in any single acquirer and increase financial efficiency. When acting as sub-acquirer, PicPay processes all credit card transactions with the acquirers Cielo and Getnet and card issuers.

The Group uses only acquirers authorized to operate by BACEN, which are supervised and monitored by BACEN, including with respect to the minimum capitalization required, and which have a national “AAA” rating by the rating agencies (S&P or Fitch). The acquirers may default on their financial obligations due to lack of liquidity, operational failure or other reasons, situations in which the Group can be held responsible for making the payment due to commercial establishments without having received the corresponding funds from the acquirer.

Until now, the Group has not suffered losses on receivables from acquirers and management does not expect any significant losses from non-performance by these counterparties in addition to the amounts already recognized as chargebacks.

Credit card issuers are supervised by BACEN. The payment arrangements (Visa, Mastercard, Elo and others) have their own risk models and collateral requirements to evaluate and mitigate the default risk of the issuers, which mitigate the risk of the acquirers and the systemic risk of Brazilian payment arrangements. Additionally, the acquires and issuers have others risk mitigators such as:

As of December 31, 2025, the Group had an amount receivable totaling R$ 463,663 (R$ 181,572 on December 31, 2024) from the acquirers and R$ 3,273,306 (R$ 3,653,774 on December 31, 2024) from card issuers. Based on the probabilities of default attributed by the rating agencies and the risk mitigation processes presented above, the Group made a provision for expected credit losses in the amount of R$ 397 (R$ 400 on December 31, 2024).

Consumer loans include: (i) public and private payroll loans, personal loans and FGTS advances; and (ii) credit cards that are transactions in one-payment, installment with interest and installments without interest. Consumers must meet certain credit risk criteria to be eligible for a credit offering.

“Payroll loans” are loans for which the payments of principal and interest are deducted either directly from the consumer’s salary from the payroll of a government-related entity or private company or from their government-sponsored pension or other benefit payments. The ability to collect the payments directly from the payroll significantly enhances the credit quality of these secured loans.

“FGTS advances” are loans in which consumers can draw down in advance up to seven annual installments of their FGTS.  The group receives the payment of these installments directly from the FGTS. FGTS advances are collateralized by the deposits held in the FGTS fund.

As of December 31, 2025, the Group had a provision for expected credit losses in the amount of R$ 3,155,386 (R$ 864,220 on December 31, 2024).

Other receivables relate mainly to transactions involving related parties that are based on conditions negotiated between Group and related companies. In December 31, 2025 and 2024, the Group did not record any impairment loss on accounts receivable related to the amounts due from related parties as it understands that there is no significant credit risk on outstanding balances.

Due to the nature of PicPay’s financial services, and the actual counterparty related to its receivables and investments, no significant credit risk increase was observed. Additionally, the Group does not have any credit-impaired financial assets.

The Group’s maximum credit exposure from financial assets, pre-approved credit card limits and derivative financial instruments is presented in the table below:

30.2 Market risk

The Group may face financial losses due to market fluctuations that affect the value of its financial position. These changes can arise from a variety of factors, the most relevant of which in PicPay’s case is fluctuations in interest rates.

As of December 31, 2025 and 2024, the Group had derivative financial instruments for accounting and economic hedge purposes. It is the Group’s policy that no trading in derivatives for speculative purposes may be undertaken.

The risks are identified, quantified, managed and reported as per the Group’s risk management policy. Moreover, these limits are continuously monitored by the Risk function, independently from the treasury.

To monitor and control such market risks, the Group employs various methods, including stress scenarios, sensitivity - delta variation (DV), exposure mismatches (GAP), and measurement and monitoring of interest rate risk in the banking book (IRRBB).

a) Interest rate risk

Interest rate risk is the risk that potential changes in interest rates affect the value of a Group’s assets, liabilities, or future cash flows in a way that is detrimental to the Group’s financial position DV01 or interest rate sensitivity refers to the effect on market valuations of cash flows when there is an increase of one basis point in current benchmark interest rates or in the index. Mathematically, the DV01 measures the change in the value of a portfolio of financial instruments for every 1 basis point (1 basis point is equal to 0.01%) change in interest rates.

The analysis below demonstrates the sensitivity of the fair value of the group’s financial instruments to an increase of 1 basis point (DV01) in the Brazilian interest rates.

To complement the table above, the Group measured the sensitivity to changes in the relevant risk variable that were reasonably possible at that date. The reasonably possible risk variation considered was an increase in 10% and a decrease in 10% in interest rates. For fixed rate instruments the table below presents the sensitivity of the fair value to this plus or minus 10% change. For floating rate instruments, the table below presents the sensitivity of 12 months of interest income / expense (assumes no other changes to balance or rates during this period).

b) Exchange rate risk

Foreign exchange risk is the potential financial loss that can occur due to fluctuations in the exchange rates between different currencies.

The Group’s exposure to foreign exchange risk arises mainly from the accounts payable corresponding to US Dollar denominated expenses as well as from balances held in dollars in the Group’s USD denominated current accounts.

As of December 31, 2025 the Group had no amounts exposed to foreign currency.

c) Hedge Accounting

The Group maintains portfolios of consumer loans and FGTS advances which are exposed to interest rate risk. In order to hedge that risk The Group entered into future DI contracts and Pre x DI swaps. 

Starting in February 2024, PicPay assigned the hedging strategy to an eligible hedge accounting structure aiming to eliminate differences between the accounting measurement of its derivatives and hedged items, which are adjusted to reflect changes in CDI. In accordance with its hedging strategy, the Group adopts the “portfolio layer” method.

This method allows the Group to use part of the portfolio of financial assets as a fair value hedge during the hedging period in the event of events such as prepayment, default or sale of operations. The interest rate risk arising from the portfolio layers is mitigated by purchasing DIV01 futures contracts as a hedging instrument. The number of contracts per net maturity needed to cover exposure is assessed based on DV01.

The Group holds fixed rate Government Bonds (LTNs) and fixed-rate financial liabilities which are exposed to interest rate risk. In order to hedge that risk, the Group entered into DI futures contracts. Starting in December 2024, PicPay assigned the hedging strategy to an eligible hedge accounting structure so as to eliminate differences between the accounting measurement of its derivatives and hedged items. In accordance with the hedging strategy, the Group designates the hedge items on an individual basis.

Starting in November 2025, PicPay also designated hedging strategies for NTNF federal government bonds and for the issuance of subordinated financial letters. Both are exposed to the fixed rate and suffer the risk of variation in the risk-free rate (Pre x DI curve). In order to mitigate this risk, the Group uses DI1 futures contracts as hedging instruments.

In December 2025, the Group acquired energy receivables that were contracted at a fixed rate, generating exposure to the risk of variation in the risk-free rate (Pre x DI curve). In order to mitigate this risk, the Group uses DI1 futures contracts as a hedging instrument. Considering the nature of the receivables acquisition product, events such as prepayment, default or sale of transactions for this portion of the portfolio are not expected, and the existence of receivables in amounts equal to or greater than the designated amounts is continuously proven

The Group calculates the DV01 (delta value of a basis point) of the hedged items and futures contracts to identify the optimal hedging ratio. The hedge relationship is monitored periodically and the hedge is rebalanced as needed to ensure hedge effectiveness within the 80-125% required range.

The effectiveness test of the hedge is performed prospectively and retrospectively. In the prospective test, the Group compares the impact of a 1 basis point parallel shift on the interest rate curve (DV01) on the hedged item and on the hedge instrument market value. For the retrospective test, the market-to-market value change since the inception of the hedged item is compared with that of the hedge instrument. In both cases, the hedge is considered effective if the change in value of the hedge instruments is between 80-125% of the change in value of the hedged items.

For designated and qualifying fair value hedges, the cumulative change in the fair value of the hedging derivative and of the hedged item is recognized in the consolidated financial statements of profit or loss in “interest income and gains (losses) on financial instruments – Financial assets at fair value through other comprehensive income”.

30.3 Liquidity risk

Liquidity risk is the possibility that the Group will not have sufficient liquid resources to honor its financial commitments.

PicPay’s liquidity management processes include:

The Group’s projected cash flow is generated and monitored daily by the Treasury to ensure that the Group has the necessary resources to meet financial commitments and operational needs. For the projection of cash, growth assumptions and stress factors are used, which include increased losses and expenses.

The information on financial liabilities is essential information for the projection and management of cash flow, ensuring that the Group has the necessary resources to settle its obligations.

As a cash management procedure, the treasury invests surplus funds in highly quality liquid and unencumbered assets.

The objective of the Group’s liquidity risk management activities is to ensure its ability to meet both expected and unexpected obligations without disrupting daily operations or incurring significant losses.

In order to ensure a sound basis of funding for growth, management has adopted a diversified approach to financing, complementing its main base of deposits, which is predominately made up of retail liabilities. A liquidity risk management policy has been implemented, involving the use of various tools and activities, such as daily cash flow forecasts, liquidity profile monitoring, and maintenance of adequate cash reserves. Any new initiative or product is preliminarily assessed by the market and risk liquidity department.

The treasury department, acting as a first line of defense, is in charge of the implementation of the liquidity management strategy. This approach is coordinated with other sectors, such as risk management, to ensure a sound second line of defense.

The table below shows the expected maturity of the Group’s liabilities. For the deposits that are redeemable immediately, the expected maturity was estimated based on historical data, which was used to estimate, for each vintage of deposits, the probability of the balance remaining for 1 more months given how long it has been in the portfolio.

Considering the earliest date in which customers may exercise their redemption rights, the cash outflows are presented as follows up to 365 days: R$ 27,309,698 (R$ 18,711,067 as of December 31, 2024) and over 365 days: R$ 529,266 (R$ 383,086 as of December 31, 2024).

Liabilities

30.4 Fraud risk

The Group is exposed to several operational risks, one of which is the risk of fraud, which is an undue, illegal or criminal activity that causes a financial loss for one of the parties involved in a financial transaction within the PicPay arrangement. Credit card fraud includes unauthorized use of lost, stolen, fraudulent, counterfeit, or altered cards, as well as misuse of the PicPay user payment account. Within this scenario, the Group is exposed to losses due to transaction chargeback (cancellations).

The chargeback process starts when a user makes a transaction via credit card in the PicPay application and, for reasons unrelated to PicPay, decides to contest the transaction with the card issuer who forwards it to the acquirer who performs the transaction cancellation, reducing the amount of payables it has outstanding with PicPay.

The Group has areas dedicated to preventing fraud strategies and processes which include real-time monitoring of transactions using payment account balances or credit cards for bank slips, withdrawals or transfers between users, analyzing and then approving or declining transactions.

30.5 Capital management

The Group’s capital management objectives are to ensure ongoing compliance with minimum capital requirements set by regulatory authorities, maintain a capital structure appropriate to the risks assumed and support the Group’s operational continuity and stakeholder confidence.

The Group’s subject to the prudential framework defined by the Central Bank of Brazil (BACEN), in accordance with BACEN Resolution No. 200/22 and BACEN Resolution No. 436/24, which establish capital requirements based on factors such as size, operational complexity, and risk profile. The lead entity of the prudential conglomerate is PicPay Payments Institution.

For the year ended December 31, 2024, the PicPay Conglomerate became subject to the most conservative capital levels, equivalent to those of large banks in BACENs classification. The change resulted in the PicPay Conglomerate falling short of the necessary capital requirements. In response, the conglomerate presented a plan to BACEN to meet the requirements. The plan was formulated with input from financial experts and received formal approval from the Board of Directors as follows:

The Group’s available regulatory capital is composed of the following tiers, which are the numerators of its capital indices:

The group’s Risk-Weighted Assets (RWA), which are the denominator of its capital indices, reflect a bank’s exposure to credit, market, payment services and operational risks. RWA’s are calculated, for credit risk for example, by applying different risk weights to different assets depending on their level of risk, resulting in the Risk-Weighted Assets.

The following table presents the Group’s capital ratios as of December 31, 2025 and December 31, 2024, calculated according to BACEN’s regulation on capital requirements and accounting, which differs from IFRS in some respects, notably in the scope of consolidation and in the calculation of expected losses.

On December 31, 2025, the total capital ratio was 11.74% (compared to 9.69% on December 31, 2024), which is 1.24 pp above the regulatory requirement of 10.5% (including the conservation buffer of 2.5%), (0.81 pp below the minimum regulatory requirement including the conservation buffer on December 31, 2024) .

The tier I ratio⁽¹⁾ was 9.25% (compared to 9.69% on December 31, 2024), which is 0.75 pp above the regulatory requirement of 8.5% (including the conservation buffer of 2.5%), (1.19% above the minimum regulatory requirement including the conservation buffer on December 31, 2024 .

The common equity tier I ratio was 9.25% (compared to 9.69% on December 31, 2024), which is 2.25 pp above the regulatory requirement of 7% (including the conservation buffer of 2.5%), (2.69% above the minimum regulatory requirement including the conservation buffer on December 31, 2024).

The Company monitors and forecasts its capital needs to maintain compliance with regulatory requirements and internal target capital ratios, maintaining constant communication with the relevant stakeholders to ensure timely fulfillment of capital needs. As part of this process, subordinated debts (Tier II) amounting to R$ 501,600 were issued in November 2025.

(1) The Group has not yet issued Additional Tier I capital instruments, so its Common Equity Tier I capital and Tier I capital are identical.

30.6 Fair Value Measurement

Determination of fair value and fair value hierarchy

For assets and liabilities measured at fair value, PicPay measures fair value using the procedures set out below. The objective of the valuation techniques is to arrive at a fair value measurement that reflects the price that would be received to sell the asset or paid to transfer the liability in an orderly transaction between market participants at the measurement date.

The pricing models used to measure fair value are governed by an independent control structure. Fair value estimates from internal valuation techniques are checked, whenever possible, against prices obtained from independent suppliers or brokers. Vendor and broker valuations can be based on a variety of data ranging from observed prices to proprietary valuation models, and the Bank assesses the quality and relevance of this information to determine the fair value estimate.

Financial instruments recorded at fair value

The following is a description of the method for determining the fair value of financial instruments. The valuation techniques incorporate estimates of the assumptions that a market participant would use to value the instruments.

Financial assets

As of December 31, 2025 and 2024, there were no transfers between the fair value measurements of Level I and Level II or between Level II and Level III.

Derivative financial instruments

The fair value of the swaps is calculated considering the projected cash flows of each of their ends, discounted to present value according to their respective yield curves, which are representative of market conditions. The yield curve calculations use models audited and approved internally by PicPay’s risk management department.

Interest rate futures contracts are commitments to buy or sell a financial instrument on a future date, at a contracted price or yield, which can be financially settled. The nominal value represents the face value of the related instrument. This instrument is settled daily in line with changes in market prices.

The main interest rates used in the composition of the yield curves are taken from futures and swaps traded on B3. Adjustments are made to these curves whenever certain points are considered to lack sufficient liquidity to be representative, or, for atypical reasons, do not reasonably represent market conditions.

Credit Risk Adjustment (CVA)

The current standard requires the allocation of Credit Value Adjustment (CVA) and Debit Value Adjustment (DVA) for derivative financial instruments. These adjustments are intended to reflect the counterparty’s credit risk and the entity’s own credit risk in the valuations of these instruments.

However, PicPay does not carry out the allocation as there is no derivative exposure with clients. All current derivatives are contracted exclusively with companies in the same economic group. This factor considerably reduces credit risk, since the relationship between the parties involved is one of common control, mitigating potential losses associated with non-compliance with obligations.

Therefore, considering the absence of exposure to external customers and the low materiality of credit risk in intra-group transactions, we believe that there is no need to allocate CVA and DVA to these derivative financial instruments. This approach is based on the Company’s operational reality and the effective assessment of the risk involved.

Financial assets

Financial liabilities

Financial assets

Financial liabilities

30.6.1 Offsetting of financial instruments

The balances of financial assets and liabilities can be offset ( i.e. recognized by the net amount) if there is a legally enforceable agreement in which the parties agree to offset the recognized amounts and intend to settle on a net basis, or to realize the asset and settle the liability simultaneously. As of December 31, 2025 and 2024, the Group does not have financial instruments that meet the conditions for offsetting.