Management has overall responsibility for establishing and supervising the risk management structure of the Group. Risk Management is under a separated structure from business areas, reporting directly to senior management, to ensure exemption of conflict of interest, and segregation of functions appropriate to good corporate governance and market practices.

The risk management policies of the Group are established to identify and analyze the risks faced, to set appropriate risk limits and controls, and to monitor risks and adherence to the limits. Risk management policies and systems are reviewed regularly to reflect changes in market conditions and in the activities of the Group. The Group, through its training and management standards and procedures, developed a disciplined and constructive control environment within which all its employees are aware of their duties and obligations.

Regarding the subsidiary XP CCTVM and the other subsidiaries components of XP Prudential Conglomerate (Brazilian Central Bank oversight definition), the organizational structure is based on the recommendations proposed by the Basel Accord, in which procedures, policies and methodology are formalized consistent with risk tolerance and with the business strategy and the various risks inherent to the operations and/or processes, including market, liquidity, credit and operating risks. The Group seeks to follow the same risk management practices as those applying to all companies.

Such risk management processes are also related to going concern management procedures, mainly in terms of formulating impact analyses, business continuity plans, contingency plans, backup plans and crisis management.

Credit risk is defined as the possibility of losses associated with the failure, by the borrower or counterparty, of their respective financial obligations under the agreed terms, the devaluation of the credit agreement resulting from the deterioration in the borrower's risk rating, the reduction gains or remuneration, the advantages granted in the negotiation and the costs of recovery.

The Risk Management document establishes its credit policy based on the composition of the portfolio by security, by internal rating of issuer and/or the issue, by the current economic activity, by the duration of the portfolio, by the macroeconomic variables, among others.

The Credit Analysis department is also actively involved in this process and it is responsible for assessing the credit risk of issues and issuers with which it maintains or intends to maintain credit relationships, also using an internal credit risk allocation methodology (rating) to classify the likelihood of loss of counterparties.

For the loan operations XP Inc uses client’s investments as collaterals to reduce potential losses and protect against credit risk exposure by managing these collaterals so that they are always sufficient, legally enforceable (effective) and viable, XP monitors the value of the collaterals. The Credit Risk Management provides subsidies to define strategies as risk appetite, to establish limits, including exposure analysis and trends as well as the effectiveness of the credit policy.

The loans operations have a high credit quality and the Group often uses risk mitigation measures, primarily through client’s investments as collaterals, which explains the low provision ratio.

The Group's policies regarding obtaining collateral have not significantly changed during the reporting period and there has been no significant change in the overall quality of the collateral held by the Group since the prior period.

Management undertakes credit quality analysis of assets that are not past due or reduced to recoverable value. As of December 31, 2021, and 2020 such assets were substantially represented by Loan operations and Securities purchased under agreements to resell of which the counterparties are Brazilian banks with low credit risk, securities issued by the Brazilian government, as well as derivative financial instruments transactions, which are mostly traded on the stock exchange (B3 S.A. – Brasil, Bolsa, Balcão) and which, therefore, have its guarantee.


	2021	2020

Financial assets
Securities purchased under agreements to resell	8,894,531	6,627,409
Securities	92,751,139	70,457,761
Public securities	48,246,922	51,944,301
Private securities	44,504,217	18,513,460
Derivative financial instruments	10,943,714	7,559,433
Securities trading and intermediation	1,405,651	1,051,566
Accounts receivable	469,086	506,359
Loan operations	12,819,627	3,918,328
Other financial assets	461,515	69,971
Off-balance exposures (credit card limits)	1,367,399	35,810
Total	129,112,662	90,190,827

Liquidity management operates in line with the Group's strategy and business model, being compatible with the nature of operations, the complexity of its products and the relevance of risk exposure. This liquidity management policy establishes actions to be taken in cases of liquidity contingency, and these must be sufficient to generate a new meaning for cash within the required minimum limits.

The group maintains an adequate level of liquidity at all times, always working with a minimum cash limit. This is done through management that is compatible and consistent with your ability obtaining resources in the market, with its budgetary targets for the evolution of the volume of its assets and is based on the management of cash flows, observing the minimum limits of daily cash balances and cash needs projections, in the management of stocks of highly liquid assets and simulations of adverse scenarios.

Risk structure and management are the responsibility of the Risk department, reporting to the Executive Board, thus avoiding any conflict of interest with departments that require liquidity.


						2021
Liabilities	Up to 1 month	From 2 to 3 months	From 3 to 12 months	From 1 to 5 years	Above 5 years	Contractual cash flow

Securities loaned	2,146,398	—	—	—	518,804	2,665,202
Derivative financial instruments	758,821	1,379,092	2,250,942	6,436,008	1,083,320	11,908,183
Securities sold under repurchase agreements	26,281,345	—	—	—	—	26,281,345
Securities trading and intermediation	15,597,555	—	—	—	—	15,597,555
Financing instruments payable	982,877	1,245,279	5,790,698	15,525,061	885,171	24,429,086
Borrowings	—	—	1,661,067	267,715	—	1,928,782
Accounts payables	867,526	—	—	—	—	867,526
Other financial liabilities	5,856,309	—	4,365	1,819,798	—	7,680,472
Total	52,490,831	2,624,371	9,707,072	24,048,582	2,487,295	91,358,151


						2020
Liabilities	Up to 1 month	From 2 to 3 months	From 3 to 12 months	From 1 to 5 years	Above 5 years	Contractual cash flow

Securities loaned	2,237,442	—	—	—	—	2,237,442
Derivative financial instruments	1,572,140	814,220	2,643,065	2,205,410	584,529	7,819,364
Securities sold under repurchase agreements	31,839,344	—	—	—	—	31,839,344
Securities trading and intermediation	20,303,121	—	—	—	—	20,303,121
Financing instruments payable	128,426	58,966	2,356,082	1,685,468	1,322,907	5,551,849
Borrowings	3,535	6,989	7,114	266,449	—	284,087
Accounts payables	859,550	—	—	—	—	859,550
Other financial liabilities	1,038,628	5,721	25,454	571,054	65,375	1,706,232
Total	57,982,186	885,896	5,031,715	4,728,381	1,972,811	70,600,989

Market risk is the risk that the fair value or future cash flows of a financial instrument will fluctuate because of changes in market prices. Market risk comprises mainly three types of risk: foreign exchange variation, interest rates and share prices.

Market risk management for operations is carried out through policies, control procedures and prior identification of risks in new products and activities, with the purpose to maintain market risk exposure at levels considered acceptable by the Group and to meet the business strategy and limits defined by the Risk Committee.

The main tool used to measure and control the exposure risk of the Group to the market, mainly in relation to their trading assets portfolio, is the Maps Luna program, which calculates the capital allocation based on the exposure risk factors in the regulations issued by Brazil Central Bank (“BACEN”) for financial institutions, which are taken as a basis for the verification of the risk exposure of the assets of the Group.

In order to comply with the provisions of the regulatory body, the financial institutions of the Group make daily control of the exposure by calculating the risk portions, recording the results in Document 2011 - Daily Statement of Capital Requirements (DDR) in BACEN Circular Letter No, 3,331/08, submitting it daily to this institution.

With the formalized rules, the Risk Department has the objective of controlling, monitoring and ensuring compliance with the pre-established limits, and may refuse, in whole or in part, to receive and/or execute the requested transactions, upon immediate communication to customers, in addition to intervening in cases of non-compliance and reporting all atypical events to the Committee.

In addition to the control performed by the tool, the Group adopt guidelines to control the risk of the assets that mark the Treasury operations so that the own portfolios of the participating companies are composed of assets that have low volatility and, consequently, less exposure to risk, In the case of non-compliance with the operational limits, the Treasury Manager shall take the necessary measures to reframe as quickly as possible.

The purpose of Company’s management of foreign exchange exposure is to mitigate the effects arising from variation in foreign exchange rates, which may present high- volatility periods.

The currency (or foreign exchange) risk arises from positions that are sensitive to oscillations in foreign exchange rates. These positions may be originated by financial instruments that are denominated in a currency other than the functional currency in which the balance sheet is measured or through positions in derivative instruments (for negotiation or hedge) and investments in subsidiaries abroad.

The Group hold interest in XP Holding International, XP Advisors Inc, and XP Holding UK Ltd, whose equity as of December 31, 2021 was US$52,905 thousand (US$46,534 thousand as of December 31, 2020), US$2,658 thousand (US$801 thousand as of December 31, 2020) and GBP 1,918 thousand (GBP 2,268 thousand as of December 31, 2020) respectively.

The risk of the XP Holding International and XP Advisors Inc, is hedged with the objective of minimizing the volatility of the functional currency (BRL) against the US$ arising from foreign investment abroad (see Note 9).

It arises from the possibility that the Group incurs in gains or losses arising from fluctuations in interest rates on its financial assets and liabilities.

Price risk is the risk arising from the change in the price of the investment fund portfolio and of shares listed on the stock exchange, held in the portfolio of the Group, which may affect its profit or loss. The price risk is controlled by the management of the Group, based on the diversification of its portfolio and/or through the use of derivatives contracts, such as options or futures.

According to the market information, the Group performed the sensitivity analysis by market risk factors considered relevant. The largest losses, by risk factor, in each of the scenarios were presented with an impact on the profit or loss, providing a view of the exposure by risk factor of the Group in exceptional scenarios. The following sensitivity analyzes do not consider the functioning dynamics of risk and treasury areas, since once these losses are detected, risk mitigation measures are quickly triggered, minimizing the possibility of significant losses.


				2021
Trading portfolio	Exposures	Scenarios
Risk factors	Risk of variation in:	I	II	III
Pre-fixed	Pre-fixed interest rate in Reais	(285)	(110,555)	(204,607)
Exchange coupons	Foreign currencies coupon rate	(35)	(5,578)	(11,325)
Foreign currencies	Exchange rates	(364)	177,203	384,340
Price indexes	Inflation coupon rates	(248)	(53,407)	(103,602)
Shares	Shares prices	(1,483)	(131,753)	92,024
Seed Money (i)	Seed Money	(6,203)	(155,068)	(310,136)
		(8,618)	(279,158)	(153,306)


				2020
Trading portfolio	Exposures	Scenarios
Risk factors	Risk of variation in:	I	II	III
Pre-fixed	Pre-fixed interest rate in Reais	(191)	(9,056)	(33,402)
Exchange coupons	Foreign currencies coupon rate	(379)	(5,508)	(11,184)
Foreign currencies	Exchange rates	(1,997)	(169,318)	(373,807)
Price indexes	Inflation coupon rates	(311)	(14,384)	(28,434)
Shares	Shares prices	(4,957)	(107,704)	(167,737)
		(7,835)	(305,970)	(614,564)

Scenario I: Increase of 1 basis point in the rates in the fixed interest rate yield, exchange coupons, inflation and 1 percentage point in the prices of shares and currencies;

Scenario II: Project a variation of 25 percent in the rates of the fixed interest yield, exchange coupons, inflation, both rise and fall, being considered the largest losses resulting by risk factor; and

Scenario III: Project a variation of 50 percent in the rates of the pre-fixed interest yield, exchange coupons, inflation and interest rates, both rise and fall, being considered the largest losses resulting from the risk factor.

Operational risk is characterized by the possibility of losses resulting from external events or failure, deficiency or inadequacy of internal processes, people and systems, including legal risk. Operational risk events include the following categories: internal fraud; external fraud; labor demands and poor workplace safety; inappropriate practices relating to customers, products and services; damage to physical assets owned or used by XP; situations that cause the interruption of XP's activities; and failures in information technology systems, processes or infrastructure.

The Group's main objective is to ensure the identification, classification and monitoring of situations that may generate financial losses, given the companies' reputation, as well as any regulatory assessment due to the occurrence of an operational risk event, XP adopts the model of 3 lines of defense, in which the main responsibility for the development and implementation of controls to deal with operational risks is attributed to the Management within each business unit, seeking to manage mainly:

(v) Requirements of periodic assessment of the operating risks faced and the adequacy of the controls and procedures for dealing with the identified risks;

In addition, the Group's financial institutions, in compliance with the provisions of Article 4, paragraph 2, of Resolution No, 3,380 / 06 of the National Monetary Council (“CMN”) of June 27, 2006, have a process that covers institutional policies, procedures, contingency and business continuity plans and systems for the occurrence of external events, in addition to formalizing the single structure required by the regulatory agency.