The Group’s activities are exposed to a variety of financial risks: credit risk, liquidity risk, market risk (including currency risk, interest rate risk and price risk), and operational risk. The Group’s overall risk management structure focuses on the unpredictability of financial markets and seeks to minimize potential adverse effects on the Group’s financial performance. The Group uses derivative financial instruments to mitigate certain risk exposures. It is the Group’s policy that no trading in derivatives for speculative purposes may be undertaken.

Management has overall responsibility for establishing and supervising the risk management structure of the Group. Risk Management is under a separated structure from business areas, reporting directly to the CEO and the Risk Committee, to ensure exemption of conflict of interest, and segregation of functions appropriate to good corporate governance and market practices.

The risk management policies of the Group are established to identify and analyze the risks faced, to set appropriate risk limits and controls, and to monitor risks and adherence to the limits. Risk management policies and systems are reviewed regularly to reflect changes in market conditions and in the activities of the Group. Our risk appetite is defined in our Risk Appetite Statement (RAS) and reviewed on an annual basis. The Group, through its training and management standards and procedures, developed a disciplined and constructive control environment within which all its employees are aware of their duties and obligations.

Regarding the subsidiary Banco XP and the other subsidiaries components of XP Prudential Conglomerate (Brazilian Central Bank oversight definition), the organizational structure is based on the recommendations proposed by the Basel Accord, in which procedures, policies and methodology are formalized consistent with risk tolerance and with the business strategy and the various risks inherent to the operations and/or processes, including market, liquidity, credit and operating risks. The Group seeks to follow the same risk management practices as those applying to all companies.

Such risk management processes are also related to going concern management procedures, mainly in terms of formulating impact analyses, business continuity plans, contingency plans, backup plans and crisis management.

Credit risk is defined as the possibility of losses associated with the failure, by the borrower or counterparty, of their respective financial obligations under the agreed terms, the devaluation of the credit agreement resulting from the deterioration in the borrower's risk rating, the reduction gains or remuneration, the advantages granted in the negotiation and the costs of recovery.

The credit risk department establishes its credit policy based on the composition of the portfolio by security, by internal rating of issuer and/or the issue, by the current economic activity, by the duration of the portfolio, by the macroeconomic variables, among others.

The credit analysis department is also actively involved in this process, and it is responsible for assessing the credit risk of issues and issuers with which it maintains or intends to maintain credit relationships, also using an internal credit risk allocation methodology (rating) to classify the likelihood of loss of counterparties.

For the loan operations, XP Inc uses client’s investments as collaterals to reduce potential losses and protect against credit risk exposure by managing these collaterals so that they are always sufficient, legally enforceable (effective) and viable. XP Inc monitors the value of the collaterals, and the credit risk management provides subsidies to define strategies as risk appetite, to establish limits, including exposure analysis and trends as well as the effectiveness of the credit policy.

The loan operations have a high credit quality, and the Group often uses risk mitigation measures, primarily through client’s investments as collaterals, which explains the low provision ratio.

The Group's policies regarding obtaining collateral have not significantly changed during the reporting period and there has been no significant change in the overall quality of the collateral held by the Group since the prior period.

Management undertakes credit quality analysis of assets that are not past due or reduced to recoverable value. As of December 31, 2024 and 2023 such assets were substantially represented by loan operations and securities purchased under resale agreements, of which the counterparties are Brazilian banks with low credit risk, securities issued by the Brazilian government, as well as derivative financial instruments transactions, which are mostly traded on the stock exchange (B3 S.A. – Brasil, Bolsa, Balcão) and which, therefore, have its guarantee.


	2024	2023

Financial assets
Securities purchased under resale agreements	22,057,137	14,888,978
Securities	203,701,541	154,200,583
Public securities	93,717,168	75,289,433
Private securities	109,984,373	78,911,150
Derivative financial instruments	46,199,796	23,733,466
Securities trading and intermediation	6,499,097	2,932,319
Accounts receivable	778,943	681,190
Loan operations	29,228,463	28,551,935
Other financial assets	13,232,997	4,208,743
Off-balance exposures (credit card limits)	7,873,551	8,912,707
Total	329,571,525	238,109,921

Liquidity management operates in line with the Group's strategy and business model, being compatible with the nature of operations, the complexity of its products and the relevance of risk exposure. This liquidity management policy establishes actions to be taken in cases of liquidity contingency, and these must be sufficient to generate a new meaning for cash within the required minimum limits.

The group maintains an adequate level of liquidity at all times, always working with a minimum cash limit. This is done through management that is compatible and consistent with your ability obtaining resources in the market, with its budgetary targets for the evolution of the volume of its assets and is based on the management of cash flows, observing the minimum limits of daily cash balances and cash needs projections, in the management of stocks of highly liquid assets and simulations of adverse scenarios.

Risk structure and management are the responsibility of the risk department, reporting to the Executive Board, thus avoiding any conflict of interest with departments that require liquidity.


	2024
Liabilities	Up to 1 month	From 2 to 3 months	From 4 to 12 months	From 1 to 5 years	Above 5 years	Contractual cash flow

Securities	14,830,405	—	—	—	422,971	15,253,376
Derivative financial instruments	7,176,746	3,336,329	10,134,377	11,738,481	7,661,754	40,047,687
Securities sold under repurchase agreements	71,779,721	—	—	—	—	71,779,721
Securities trading and intermediation	18,474,978	—	—	—	—	18,474,978
Financing instruments payable	6,140,457	16,786,357	29,109,323	37,796,433	5,415,912	95,248,482
Borrowings	—	—	1,666,432	—	—	1,666,432
Accounts payables	763,465	—	—	—	—	763,465
Other financial liabilities	9,124,704	1,560,439	3,584,285	461,435	—	14,730,863
Total	128,290,476	21,683,125	44,494,417	49,996,349	13,500,637	257,965,004


	2023
Liabilities	Up to 1 month	From 2 to 3 months	From 4 to 12 months	From 1 to 5 years	Above 5 years	Contractual cash flow

Securities	19,949,021	—	—	—	474,053	20,423,074
Derivative financial instruments	5,580,573	2,719,744	6,773,980	7,873,062	1,838,057	24,785,416
Securities sold under repurchase agreements	32,796,941	543,570	—	—	—	33,340,511
Securities trading and intermediation	16,943,539	—	—	—	—	16,943,539
Financing instruments payable	3,812,510	8,383,531	10,690,918	36,648,126	830,505	60,365,590
Borrowings	—	10,796	2,188,626	—	—	2,199,422
Accounts payables	948,218	—	—	—	—	948,218
Other financial liabilities	5,815,141	756,864	4,588,231	1,056,580	14,560	12,231,376
Total	85,845,943	12,414,505	24,241,755	45,577,768	3,157,175	171,237,146

Market risk is the risk that the fair value or future cash flows of a financial instrument will fluctuate because of changes in market prices. Market risk comprises mainly three types of risk: foreign exchange variation, interest rates and share prices.

Market risk management for operations is carried out through policies, control procedures and prior identification of risks in new products and activities, with the purpose to maintain market risk exposure at levels considered acceptable by the Group and to meet the business strategy and limits defined by the Risk Committee.

The main tool used to measure and control the exposure risk of the Group to the market, mainly in relation to their trading assets portfolio, is the Maps Luna program, which calculates the capital allocation based on the exposure risk factors in the regulations issued by Brazilian Central Bank (“BACEN”) for financial institutions, which are taken as a basis for the verification of the risk exposure of the assets of the Group.

In order to comply with the provisions of the regulatory body, the financial institutions of the Group make daily control of the exposure by calculating the risk portions, recording the results in Document 2011 - Daily Statement of Capital Requirements (DDR) in BACEN Circular Letter No, 3,331/08, submitting it daily to this institution.

With the formalized rules, the risk department has the objective of controlling, monitoring and ensuring compliance with the pre-established limits, and may refuse, in whole or in part, to receive and/or execute the requested transactions, upon immediate communication to customers, in addition to intervening in cases of non-compliance and reporting all atypical events to the Risk Committee.

In addition to the control performed by the tool, the Group adopt guidelines to control the risk of the assets that mark the treasury operations so that the own portfolios of the participating companies are composed by assets that have low volatility and, consequently, less exposure to risk. In the case of non-compliance with the operational limits, the treasury manager shall take the necessary measures to reframe as quickly as possible.

The purpose of Group’s management of foreign exchange exposure is to mitigate the effects arising from variation in foreign exchange rates, which may present high volatility periods.

The currency (or foreign exchange) risk arises from positions that are sensitive to oscillations in foreign exchange rates. These positions may be originated by financial instruments that are denominated in a currency other than the functional currency in which the balance sheet is measured or through positions in derivative instruments (for negotiation or hedge) and investments in subsidiaries abroad.

The Group hold interest in XP Holding International LLC, XP Advisory US, and XP Holding UK Ltd, whose equity as of December 31, 2024 was US$96,830 (US$83,991 as of December 31, 2023), US$12,322 (US$8,803 as of December 31, 2023) and GBP 16,511 (GBP 12,861 as of December 31, 2023), respectively (amounts presented in thousands of the respective currencies).

The risk of the XP Holding International LLC and XP Advisors Inc is hedged with the objective of minimizing the volatility of the functional currency (BRL) against the US$ arising from foreign investment abroad (see Note 9). The foreign currency exposure risk of XP Holding UK Ltd is not hedged and is not material for the Group.

It arises from the possibility that the Group incurs in gains or losses arising from fluctuations in interest rates on its financial assets and liabilities.

Price risk is the risk arising from the change in the price of the investment fund portfolio and of shares listed on the stock exchange, held in the portfolio of the Group, which may affect its profit and loss. The price risk is controlled by the management of the Group, based on the diversification of its portfolio and/or through the use of derivatives contracts, such as options or futures.

According to the market information, the Group performed the sensitivity analysis by market risk factors considered relevant. The largest losses, by risk factor, in each of the scenarios were presented with an impact on the profit and loss, providing a view of the exposure by risk factor of the Group in exceptional scenarios. The following sensitivity analyzes do not consider the functioning dynamics of risk and treasury areas, since once these losses are detected, risk mitigation measures are quickly triggered, minimizing the possibility of significant losses.


		2024
Trading portfolio	Exposures	Scenarios
Risk factors	Risk of variation in:	I	II	III

Fixed interest rate	Fixed interest rate in Reais	(117)	(8,285)	50,065
Exchange coupons	Foreign currencies coupon rate	(28)	(6,905)	(15,497)
Foreign currencies	Exchange rates	(124)	64,512	148,169
Price indexes	Inflation coupon rates	(68)	(11,606)	(24,563)
Shares	Shares prices	(5,858)	(162,112)	(458,841)
Commodities	Commodities price	(320)	(4,471)	17,579
		(6,515)	(128,867)	(283,088)


		2023
Trading portfolio	Exposures	Scenarios
Risk factors	Risk of variation in:	I	II	III

Fixed interest rate	Fixed interest rate in Reais	(258)	21,269	22,753
Exchange coupons	Foreign currencies coupon rate	(367)	(18,174)	(36,588)
Foreign currencies	Exchange rates	331	343,440	907,349
Price indexes	Inflation coupon rates	(103)	(12,998)	(24,579)
Shares	Shares prices	(3,472)	(251,572)	(289,613)
Commodities	Commodities price	(2,822)	(70,566)	(141,133)
		(6,691)	11,399	438,189

Scenario I: Increase of 1 basis point in the rates in the fixed interest rate yield, exchange coupons, inflation and 1 percentage point in the prices of shares, commodities and currencies;

Scenario II: Project a variation of 25 percent in the rates of the fixed interest yield, exchange coupons, inflation, prices of shares, commodities and currencies, both rise and fall, being considered the largest losses resulting by risk factor; and

Scenario III: Project a variation of 50 percent in the rates of the fixed interest yield, exchange coupons, inflation, prices of shares, commodities and currencies, both rise and fall, being considered the largest losses resulting from the risk factor.

Operational risk is characterized by the possibility of losses resulting from external events or failure, deficiency or inadequacy of internal processes, people and systems, including legal risk. Operational risk events include the following categories: internal fraud; external fraud; labor demands and poor workplace safety; inappropriate practices relating to customers, products and services; damage to physical assets owned or used by XP; situations that cause the interruption of XP's activities; and failures in information technology systems, processes or infrastructure.

The Group's main objective is to ensure the identification, classification and monitoring of situations that may generate financial losses, given the companies' reputation, as well as any regulatory assessment due to the occurrence of an operational risk event, XP adopts the model of 3 lines of defense, in which the main responsibility for the development and implementation of controls to deal with operational risks is attributed to the Management within each business unit, seeking to manage mainly:

(v) Requirements of periodic assessment of the operating risks faced and the adequacy of the controls and procedures for dealing with the identified risks;

In addition, the Group's financial institutions, in compliance with the provisions of Article 4, paragraph 2, of Resolution No, 3,380/06 of the National Monetary Council (“CMN”) of June 27, 2006, have a process that covers institutional policies, procedures, contingency and business continuity plans and systems for the occurrence of external events, in addition to formalizing the single structure required by the regulatory agency.