Circular Letter No. 1/2026/CVM/SNC/GNA

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Sete de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686 Rua Teixeira da Silva, nº 217, 8th and 9th floors - Paraíso - São Paulo/SP - ZIP Code: 04002-905 SCN Q.02 – Bl. A – Ed. Corporate Financial Center, 4th Floor, S.404, Brasília/DF – ZIP Code: 70712-900 – Brazil - Tel.: (61) 3327-2030/2031 Circular Letter No. 1/2026/CVM/SNC/GNA Rio de Janeiro, September 2, 2026. To Independent Auditors and their respective Technical Managers Subject: Clarifications related to the performance of the independent accounting auditor within the securities market.

Dear Auditors and Technical Managers,

As a direct result of the supervision and inspection actions regarding the auditing activity within the securities market, we list below some points related to registration with the CVM, performance in the securities market, and the application of professional standards for independent accounting auditing in the execution of work, for which we request special attention from the independent auditor registered with this Commission. In this sense, it is important to recall the fundamentals that guide the actions of the Securities and Exchange Commission (CVM) regarding independent auditing within the securities market:
the importance of an independent auditing system as an indispensable support for the regulatory body; the figure of the independent auditor as an essential element for market credibility and as an instrument of inestimable value in investor protection, insofar as its function is to ensure the fidelity and reliability of the audited entity's financial statements; the accuracy and clarity of the financial statements, including the disclosure in explanatory notes of information essential to understanding the audited entity's assets and liabilities and results, depend on an effective auditing system and the auditor's awareness of their role and responsibility in this context; and the need for the market to have highly qualified independent auditors who, at the same time, enjoy a high degree of independence in the exercise of their activity

Circular Letter 1 (2813608) SEI 19957.014750/2026-35 / pg. 1

Sincerely,
Document electronically signed by Madson Vasconcelos, Manager, on 09/02/2026, at 10:16, based on art. 6 of Decree No. 8.539, of October 8, 2015.
Document electronically signed by Vinicius Tertuliano dos Santos, Division Chief, on 09/02/2026, at 10:19, based on art. 6 of Decree No. 8.539, of October 8, 2015.
Document electronically signed by Fabio Pinto Coelho, Superintendent, on 09/02/2026, at 10:36, based on art. 6 of Decree No. 8.539, of October 8, 2015.
The authenticity of the document can be verified on the site https://sei.cvm.gov.br/conferir_autenticidade, informing the verification code 2813608 and the CRC code 863B9C65.
The authenticity of this document can be verified by accessing https://sei.cvm.gov.br/conferir_autenticidade, and typing the "Verification Code" 2813608 and the "CRC Code" 863B9C65.
Reference: Process No. 19957.014750/2026-35 SEI Document No. 2813608 Circular Letter 1 (2813608) SEI 19957.014750/2026-35 / pg. 2

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Sete de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686 INDEX 1 TOPICS RELATED TO THE REGISTRATION, UPDATE AND MAINTENANCE OF THE
INDEPENDENT AUDITOR'S REGISTRATION WITH THE CVM................................................ 7
1.1 Registration as an Independent Auditor (Art. 1 to 4 of CVM Resolution No.
23/2021) .................................................................................................................. 7
1.1.1 Forms of registration as an Independent Auditor.................................. 7
1.1.2 Obtaining and maintaining registration as an Independent Auditor ......... 7
1.1.3 Payment of the Inspection Fee....................................................... 8
1.2 INFOAUDI ........................................................................................................ 8
1.2.1 Access to the system and delegation to agents .......................................... 8
1.2.2 Administration and maintenance of registration in the system........................... 9
1.2.3 Access to quick manuals for registration and update requests
cadastral................................................................................................................. 9
1.2.4 Issuance of the Registration Confirmation Certificate and history as
independent auditor with the CVM........................................................................ 10
1.2.5 Characteristics of files sent with the system ........... 11
1.2.6 Inclusion of partners and technical managers and other contractual changes
contratuais ........................................................................................................... 11
1.2.6.1 Indication of representatives of the company and the director responsible
for CVM Resolution No. 50/2021.......................................................................13
1.2.7 Cancellation of registration or exclusion of technical manager....... 13
1.3 Proof of exercise of auditing activity, as provided for in
art. 7 (item V, art. 5; item XI, art. 6; item IV, art. 6-A of CVM Resolution No.
23/2021) ................................................................................................................ 13
1.4 Professional identity card for accountants, or equivalent certificate,
issued by the Regional Council of Accounting (item II, art. 5; item IX, art.
6; item III, art. 6-A of CVM Resolution No. 23/2021).......................................... 15
1.5 Location and Operation License, or equivalent competent document
(item IV, art. 5; item V, art. 6 of CVM Resolution No. 23/2021) ..... 16
1.6 Certificate of approval in technical qualification exam (specific test –
CVM), provided for in art. 30 (item VI, art. 5; item XII, art. 6; item V, art. 6-A of the
CVM Resolution No. 23/2021) ................................................................................... 16
1.6.1 Need to carry out the technical qualification exam.............. 16
1.6.2 Change of category or transfer of registration........................... 17
1.6.3 Approval in the technical qualification exam by members of the
auditing teams ............................................................................................. 18
1.7 Annual Periodic Information (Art. 16 – CVM Resolution No. 23/2021) ........ 18
1.8 Single registration (art. 11, sole paragraph, CVM Resolution No. 23/2021) ........ 19
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 3

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Sete de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686
1.9 Cases of suspension and cancellation ex officio (Art. 15 – CVM Resolution No.
23/2021) ................................................................................................................ 20
1.10 External Quality Review Program (Art. 33 – CVM Resolution No. 23/2021) ................................................................................................................ 20
1.10.1 Submission of external quality review by peers..................... 20
1.10.2 Role of the reviewing auditor.................................................................. 21
1.10.3 Suspension of the auditor's registration with the CVM.................................... 21
1.10.4 Ways to infringe compliance with the External Quality Review Program
Quality ............................................................................................................. 21
1.10.5 Reactivation of the registration suspended due to non-compliance with the External Quality Review Program
External Quality Review.................................................................................................... 22
1.11 Continuing Professional Education Program (Art. 34 – CVM Resolution No. 23/2021) ................................................................................................................ 22
1.11.1 Non-compliance with the Continuing Education Program and suspension
of registration............................................................................................................ 22
1.11.2 Presentation of the annual report of activities related to Continuing
Education ........................................................................................................... 23
1.12 Registration Update and Electronic Declaration of Compliance (art. 2,
items I and II of CVM Resolution No. 51/2021)......................................................... 23
1.12.1 Registration update .......................................................................... 23
1.12.2 Issuance of the Electronic Declaration of Compliance ........................... 24
1.12.3 Coercive fine for failure to deliver or delay in presenting the
Electronic Declaration of Compliance................................................................ 24
1.13 Independent Auditor – Legal Entity: corporate types and liability
of partners................................................................................................................ 24
2 TOPICS RELATED TO THE EXECUTION OF WORKS AND DOCUMENTATION OF
AUDITING ................................................................................................................ 25
2.1 CVM Resolution No. 23/2021 ........................................................................... 25
2.1.1 Hypotheses of impediment and incompatibility (Art. 22 to 24 -
CVM Resolution No. 23/2021) ................................................................................ 25
2.1.2 Issuance of Circumstantial Report (art. 25, item II, CVM Resolution
No. 23/2021) ........................................................................................................ 26
2.1.3 Composition of auditing teams (art. 25, item VII, CVM Resolution
No. 23/2021) ........................................................................................................ 29
2.1.4 Auditor Rotation (Art. 31 to 31A – CVM Resolution No. 23/2021) 29
2.1.4.1 Rehire of the Auditor .................................................................30
2.1.4.2 Possibility of extending the service provision period for
Companies with Statutory Audit Committee (CAE) ...................................30
2.1.4.3 Documentation of the installation, composition and
operation requirements of the CAE .....................................................................................31
2.1.4.4 Re-election of CAE members by re-election ................................31
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 4

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Sete de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686
2.1.4.5 Use of a single CAE for the Group ..........................................31
2.1.4.6 Hiring for internal auditing during the cooling-off period and
risks to independence .....................................................................................33
2.1.5 Independence: Auditor's close relationship with members of the
administration and governance of the audited entity .......................................... 34
2.1.6 Published summary statements (in printed newspaper) ................... 35
2.1.7 Relevant aspects to be observed in the review of Explanatory Notes
and in the evaluation of other information contained in the Financial Statements
audited.............................................................................................................. 36
2.2 Auditing Standards ...................................................................................... 37
2.2.1 Audit Report and Key Audit Matters........................ 37
2.2.2 Preparation of audit reports – modification of opinion............... 38
2.2.3 Criteria for sample selection in auditing ........................................... 41
2.2.4 Professional judgment and transparency in the audit report........... 42
2.2.5 Immaterial distortions with significant potential to become
relevant in the future ............................................................................................. 44
2.2.6 Auditing of accounting estimates and related disclosures - NBC TA
540 (R2)............................................................................................................... 45
2.2.7 Quality Internal Control - implementation of NBC PA 01 - Quality Management for Firms
(Legal and Physical Entities) of Independent Auditors
(corresponding to International Standard on Quality Management – ISQM 1) .... 46
2.2.7.1 Acceptance and continuity of clients and specific works:
minimum procedures and AML/CFT check..............................................47
2.2.8 Quality Internal Control - recommendations on the performance of the reviewer
of the quality of the work ...................................................................................... 49
2.2.9 Disclaimer of Opinion and Assessment of Renunciation to Auditing Work 50
2.3 Investment Funds ...................................................................................... 52
2.3.1 Auditing of financial statements of Investment Funds in
Credit Rights - FIDC, Certificates of Real Estate Receivables - CRI and Certificates of Agricultural Receivables - CRA: existence, backing and measurement
of credit rights and related assets........................................................... 52
2.3.2 Evaluation of qualification as an investment entity – Investment
Funds in Participations ............................................................................ 53
2.3.3 Evaluation of classification, existence and measurement of financial assets
(FIIs and FIP-EI)...................................................................................................... 54
2.3.4 Weaknesses in proving ownership of real estate assets and the
need for updated RGI ............................................................................. 55
2.4 Sustainability ............................................................................................ 56
2.4.1 CVM RESOLUTION NO. 193, OF OCTOBER 20, 2023 - preparation and
disclosure of the report on financial information related to sustainability, based on the international standard issued by the International
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 5

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Sete de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686
Sustainability Standards Board - ISSB.................................................................. 56
2.4.2 Assurance of the Report on Financial Information Related to
Sustainability – Normative and Application Aspects. ..................................... 58
3 OTHER RELEVANT TOPICS ............................................................................ 59
3.1 Digital Protocol ............................................................................................ 59
3.2 Communications related to art. 24 of CVM Resolution No. 50/2021 ................ 60
3.3 Main issues pointed out in recent years by IFIAR.......................... 60
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 6

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Sete de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686 1 TOPICS RELATED TO THE REGISTRATION, UPDATE AND MAINTENANCE OF THE INDEPENDENT AUDITOR'S REGISTRATION WITH THE CVM
1.1 Registration as an Independent Auditor (Art. 1 to 4 of
CVM Resolution No. 23/2021)
1.1.1 Forms of registration as an Independent Auditor
The activity of independent auditing is the prerogative of the accountant legally qualified and registered with the Regional Council of Accounting (CRC). Thus, registration with the CVM does not characterize a limitation or a new professional category. Therefore, there are no incompatibilities between the norms issued by the CVM and the disciplinary regime of the CRC. CVM Resolution No. 23/2021 maintains two forms of registration:

Independent Auditor – Natural Person (AIPN), granted to the accountant
legally qualified and who meets the other requirements established in arts.
3, 5 and 7; and
Independent Auditor – Legal Entity (AIPJ), granted to the society
integrated exclusively by accountants, registered with the Regional Council of Accounting and who meets the other requirements established in arts. 4, 6 and 7.
At this opportunity, it is important to highlight that it is not allowed for legal entities registered as accounting organizations with the respective Regional Council of Accounting to integrate the corporate structure of auditing societies registered with the CVM as Independent Auditor – Legal Entity (AIPJ). For partners or other accountants who maintain a professional link of any nature with the AIPJ registered with the CVM to be able to issue and sign assurance reports, reasonable (audit) or limited (review of interim information), or of external review of quality control in the name of the society, it becomes mandatory to be registered as a technical manager with the CVM. In this sense, it is important to remember that the technical manager with the CVM is the professional to whom the responsibility for planning, conducting, executing and issuing the audit report in auditing work within the MVM and, consequently, the burden of any deviations linked, as well as the responsibility of the auditing society itself registered as an independent auditor with the CVM.
1.1.2 Obtaining and maintaining registration as an Independent Auditor
To obtain or maintain registration with the CVM, the corporate object of auditing societies must be exclusively focused on the provision of professional auditing services and other services inherent to the accounting profession, as established in item I of art. 4
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 7

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Sete de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686 of CVM Resolution No. 23/2021, which does not include participation/investment in other entities and sale of training and preparatory courses, among others. It is required that at least half of the partners of the AIPJ be constituted as technical managers before the CVM to exercise the auditing activity, within the scope of the securities market, in the name of the society 1 . If, after obtaining the registration of the society, there is a change in the corporate structure, whether by exclusion or admission of partners, or by change in the partners' participation in the share capital, even if the same members of the society are maintained, it is imperative that the requirements remain met for the maintenance of the registration, including the aforementioned minimum proportion, and the corresponding contractual change must be communicated to the CVM in the form and within the regulatory period, under penalty of suspension or even cancellation of the respective registration until the situation is regularized 2 .
1.1.3 Payment of the Inspection Fee
Since 01/01/2022, for registration as an independent auditor, it is mandatory proof of payment of the Inspection Fee for the exercise of the police power legally attributed to the CVM under Law 7.940/1989 and its amendments 3 . The payment is annual and must be in full, prorate payment not admitted, it being noted, furthermore, that the inspection fee has a tax nature, and in case of default, it may be registered in the Federal Active Debt with the additions provided for in art. 5 of the aforementioned Law 7.940/1989. More information about the inspection fee can be obtained at https://www.gov.br/cvm/ptbr/assuntos/regulados/taxa-de-fiscalizacao.
1.2 INFOAUDI
1.2.1 Access to the system and delegation to agents
The new auditor registration and information system - "INFOAUDI" was made available to all AIPN and AIPJ Representatives in June/2024, for users who already had registration in the CVMWEB system (used for sending Annual Information and Declaration Electronic Declaration of Compliance). To use INFOAUDI, it is mandatory to have an account created on GOV.BR, as it is necessary to log in to that environment to access the system. Once logged in to GOV.BR, simply access the option "PARTICIPANT REGISTRATION UPDATE" > "INFOAUDI - Auditor Management" or access directly (always requiring login in GOV.BR) the link: https://cvmweb.cvm.gov.br/swb/default.asp?sg_sistema=sic. To delegate access to new agents, it is necessary that the AIPJ Representatives, or AIPN, make the delegation after the 1 CVM Resolution No. 23, final part of item II of art. 4°. 2 CVM Resolution No. 23, art. 15, II. 3 Article 4°, items III and V as amended by MP 1.072/2021 converted into Law 14.317/2022.
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 8

COMMISSION OF SECURITIES AND EXCHANGES
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 access to CVMWEB. Access for delegation is done on the CVMWEB home screen, under "SERVICES TO CVM PARTICIPANT" > "ACCOUNT ADMINISTRATION" > "TASK DELEGATION", selecting the "INFOAUDI" (Auditors) option.
1.2.2 On the administration and maintenance of the registry in the system
INFOAUDI represents an advance in the administration and maintenance of the registry and the information related to auditors registered with CVM, where the auditors themselves and their proxies (delegated via the system) can interact more quickly and practically in the maintenance and update of their registration data. When registering a new request in INFOAUDI, an electronic administrative process (SEI) is generated automatically, whose data will be confirmed and validated by the Audit Standards Management (GNA) of the Superintendence of Accounting and Audit Standards (SNC) of CVM, which may approve, disapprove, or request compliance with some requirement. The progress of the analysis can be followed within the INFOAUDI system itself. Initially, the request registered in INFOAUDI is in a pending situation, which means that it is under analysis - with GNA. If in the evaluation of the process by the Management it is identified the need for adjustment or complement of information/documentation, it will remain in requirement - with the Auditor (necessitating, obligatorily, action by the applicant, via INFOAUDI). When the request is updated by the auditor, the process returns again to the analysis by GNA.
1.2.3 On access to the quick manuals for registration and update requests
To facilitate the use of the new system, the following is available on its home screen: “Quick Manual for Access to InfoAudi for Registration Request” and “Quick Manual for Access to InfoAudi for Registry Update (independent auditors already registered with CVM)”, with guidelines for applicants for new registrations and with the main system functionalities to be used by independent auditors already registered with CVM, respectively. Among the functionalities contained in the Manual for Registry Update, we highlight:

Address (Change/Inclusion/Exclusion): Allows changing some data of an
address already registered, including a new type of address or excluding one already provided, upon presentation of supporting documentation that will be evaluated by GNA with subsequent approval or disapproval of the request.
Social Name/Name: Allows changing the Social Name (in the case of
AIPJ) or the Name (in the case of AIPN), upon presentation of supporting documentation that will be evaluated by GNA with subsequent approval or disapproval of the request.
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 9

COMMISSION OF SECURITIES AND EXCHANGES
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686

Professional Council (available only for AIPN): Allows changing the type of CRC
from provisional to ordinary or from ordinary to transferred - upon
presentation of supporting documentation, which will be evaluated by GNA with subsequent approval or disapproval of the request.
Partner/Representative/Responsible Director (available only for AIPJ): Allows
changing, including, or excluding any data related to Partners, Representatives or Responsible Director of an AIPJ, whether regarding the insertion of a new type of responsible person, exclusion or alteration of one already registered (change of type, name, transfer of professional council (CRC), email). Such alteration may be implemented upon presentation of supporting documentation, which will be evaluated by GNA, with subsequent approval or disapproval of the request. In the case of the responsible director by CVM Resolution No. 50/2021, the indication must observe the correspondence with one of the representatives of the AIPJ registered with CVM, in accordance with the applicable regulations.
Contractual Change (Others) (available only for AIPJ): Allows including a
new contractual change registered in the Civil Registry of Legal Entities.
We remind you that, according to article 17 of CVM Resolution No. 23/2021, contractual changes must be presented within 30 days of their occurrence (considered the date of registration in the RCPJ, due to the publicity of the act) and, considering that the cost for registration in the respective instances is the same (for each registered change), there is no reason for such registrations to be made in batches. Thus, we recommend that companies carry out the respective registrations as the contractual changes are carried out, promoting greater speed in this procedure for CVM and, consequently, in the registry update.
Movement (Inclusion/Exclusion) (available only for AIPJ): Allows including
or excluding a professional as Technical Manager in an AIPJ. Upon presentation of supporting documentation that will be evaluated by GNA with subsequent approval or disapproval of the request.
Data Update (available only for AIPJ): Allows changing, including, or
excluding any data related to Technical Managers already registered in an AIPJ (change of name, transfer of professional council (CRC) and email).
1.2.4 On the issuance of the Registration Confirmation Certificate and the history as
independent auditor with CVM
It is also possible, using INFOAUDI, for the auditor themselves to issue their Registration Confirmation Certificate, previously requested by independent auditors via Digital Protocol and issued in the format of a Letter. With this, certificates can be issued, through the system, as many as necessary, and they can be validated and confirmed directly on the internet by the recipient, assisting in case of eventual professional hiring.
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 10

COMMISSION OF SECURITIES AND EXCHANGES
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Furthermore, the history of the independent auditor at CVM, previously exclusive to the regulator, is also available in INFOAUDI. The registration form, with all the management of information of the independent auditor at CVM, can be accessed by the user themselves in the system. There it is possible to consult the updated list with the technical managers authorized to issue and sign audit and review reports on behalf of the audit firm.
1.2.5 On the characteristics of the files sent along with the system
It is also important to highlight some relevant information for the use of INFOAUDI:

Only files in PDF format should be attached to the System.
The maximum size of each transmitted file is 20MB.
Each document must be scanned individually, resulting in a PDF file per document. For example: The auditor needs to send 3 documents to CVM: 1) professional identity card - CRC of the partner; 2) Change of Social Contract of the audit firm; and 3) Certificate of Technical Qualification Exam. Then he must create 3 separate files, each containing only 1 scanned document.
Each scanned file must be saved with a descriptive name of the content of the
document, which does not exceed 100 characters (including spaces). For example:
In the situation above the files could be named as: CART CRC PARTNER [NAME]; [XNºX] ALT CONT SOC; CERT EQT PARTNER/RT [NAME].
Each attached file must have a specific name and different from the others. If it is
necessary to send more than one file for a certain type of document, some difference can be used at the end of the file name to individualize it.
For example: AUDIT REPORT YEAR 2024; AUDIT REPORT YEAR 2024 PART 1; AUDIT REPORT YEAR 2024 PART 2.
It is possible to use the same "document type" for several files. For example:
5 files of the type "Proof of exercise of audit activity".
1.2.6 On the inclusion of partners and technical managers and other contractual changes
All requests for inclusion of new partners or new technical managers
must inform the individual professional email of the said partner/technical manager, including, in the Registry Information file.
We clarify that contractual changes that modify the
participation of partners in the social capital are also classified as relevant contractual changes, even if there is no entry or withdrawal of partners. In these cases, the change must be reflected in INFOAUDI,
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 11

COMMISSION OF SECURITIES AND EXCHANGES
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 by opening the "Contractual Change (Others)" process, with the presentation of the respective contractual change duly registered, without prejudice to the opening of other specific processes eventually applicable, according to the nature of the effects produced by the corporate change.

The presentation of a new contractual change, by itself, already gives rise to the generation of a process of the type "Contractual Change (Others)". However, it is mandatory to also register the specific processes, if the said change also deals with (or among other subjects) partner/representative/responsible director/technical manager, address and/or social name,
thus encompassing each of the situations individually. For example: 1 process for inclusion of partner [XXX], 1 process for exclusion of partner [YYY], 1 process for change of address of branch [ZZZ], in addition to the "Contractual Change (Others)" process. That is, it is essential to open all other specific processes simultaneously with the opening of the Contractual Change process, and vice versa, under penalty of disapproval of those that are in the queue for analysis by GNA. Remembering that: (i) the opening of additional processes does not exclude the possibility of complementary requests to the Contractual Change process or even other processes derived from the definitive analysis; and (ii) the contractual change process (Contractual Change - Others), which we call primary, will only be processed after all analyses, requirements, pending items, and associated processes are resolved.
The request for inclusion of a new Technical Manager linked to an AIPJ with
active registration, whether he is a partner already registered, incoming (needs first to exist a request - approved - for inclusion as a partner) or accountant with professional link (needs to present CTPS), must be made in the option "Audit Management - Registry Update => Technical Manager - Movement (Inclusion/Exclusion)". The option "Audit Management - Request Registration" should only be used by the professional if there is the intention to act as AIPN; that is, without link with Legal Entity. This option also requires, in addition, the prior payment of a specific supervision fee.
When a process is evaluated with requirements, an automatic email from the System
is sent to the auditor, with the Letter attached, in which the analysis of GNA is detailed, informing about the need for complementation of documents and/or information within a period of 15 (fifteen) business days.
The System also sends automatic daily reminder emails continuously, when the process has not yet had its requirements met.
In this context, the auditor must necessarily take measures, within the
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 12

COMMISSION OF SECURITIES AND EXCHANGES
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 INFOAUDI, in the original process itself - see item "2.3 Complement information/documentation (Requirements)" of the Manual, even if it has been indicated in the evaluation the opening of an additional process. That is, the original process must always be updated so that a new analysis can proceed.
1.2.6.1 On the designation of representatives of the firm and the responsible director by CVM Resolution No. 50/2021
In accordance with art. 6, item VIII, of CVM Resolution No. 23/2021, the Independent Auditor – Legal Entity may indicate up to two partners as representatives of the firm before CVM.
We clarify that, for the purpose of compliance with CVM Resolution No. 50/2021, the responsible director for the obligations provided therein must, necessarily, be one of the representatives indicated by the firm in the manner of CVM Resolution No. 23/2021, not being admitted the designation of a responsible director who has not been previously registered as a representative of the AIPJ before CVM. If the firm indicates two representatives, only one of them should be designated as responsible director by CVM Resolution No. 50/2021. Thus, the designation of a responsible director that does not coincide with at least one of the registered representatives of the firm before CVM is not considered regular.
1.2.7 On the cancellation of registration or the exclusion of technical manager
The cancellation of registration as AIPN or AIPJ or the exclusion of technical managers can be done through a declaration signed and dated by the representative in the case of Legal Entity or by the auditor themselves in the case of Natural Person, attached to the specific request in INFOAUDI. The declaration must indicate the awareness of the professionals about the exclusion of the registry of technical managers and the need for compliance with the requirements of CVM Resolution No. 23/2021, if they do not maintain their registries active at CVM, including new approval in the Technical Qualification Exam of CVM for future registrations as AIPN or inclusions as technical manager of AIPJ, even if it is from the same firm from which they were excluded. The list of technical managers authorized to sign audit reports can be consulted on the CVM website, by accessing the link http://sistemas.cvm.gov.br/?CadGeral and typing the corporate name or the CNPJ number of the respective audit firm.
1.3 Proof of the exercise of audit activity,
according to the provisions of art. 7º (item V, art. 5º; item XI, art. 6º; item IV, art. 6º-A of CVM Resolution No. 23/2021) Among the other conditions for obtaining registration, it is fundamental that the exercise of audit activity be proven, which basically comprises, the issuance and signing of opinions or audit reports, for a minimum period of 05 (five) years, consecutive or not. This period is counted from the registration of the interested party in the CRC, in the category of accountant. The exercise of audit activity prior to this registration in the accountant category constitutes non-compliance with professional standards and will not be considered in the analysis of the registration request, being subject, furthermore, to communication to the CFC/CRCs system due to the irregular exercise of the profession.
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 13

COMMISSION OF SECURITIES AND EXCHANGES
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 This proof must be met, exclusively, in the following manner:
a) Published Audit Reports: The accountant must present audit reports (reasonable assurance) signed and published in a newspaper, specialized magazine or on the internet, with at least one publication per year. The publication must include the report, financial statements and explanatory notes, and be carried out in accordance with the standards of the Federal Council of Accounting (CFC). The name of the newspaper/magazine or the address of the site must be provided, in the case of publications on specific pages, and the date of publication. b) Acting as an Employee of an Audit Firm: The accountant must prove that they exercised the audit activity in an audit firm registered with CVM, with the registration date as an accountant being the starting point for the calculation of experience. The proof can be made by means of a copy of the individual employee registration or a declaration from the firm, detailing the admission, exit, positions and changes in function. For registration as AIPN, it is necessary to prove that the accountant is no longer part of the firm. To prove the exercise of audit activity in the manner indicated in item “b” above, it is necessary:

Present the supporting documentation:
o copy of the individual employee registration of the accountant in the audit firm employer, containing all the information required by specific regulation.
A declaration signed by a partner representative of the employer audit firm will also be admitted, in which the qualification of the accountant must necessarily appear; the dates of admission and exit from employment (if applicable); the position or function in which he was admitted and the dates on which changes in positions or functions occurred. o copy of the work and social security card (CTPS) of the interested accountant, comprising the pages that contain: the number and series of the CTPS; the qualification of the holder; the annotations regarding the employment contracts and the changes in salaries, vacations, positions or functions performed. Copies of the CTPS pages that are blank, i.e., in which no annotations have been made, do not need to be presented.
Prove acting in a management or supervisory position: It is necessary to prove
that the accountant exercised, for five years, positions of direction, management or supervision in the audit of financial statements. The experience period in these positions can be counted based on partial periods, consecutive or not, as long as the sum is not less than five years. CVM may also, at its exclusive discretion, accept the proof of the exercise of the
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 14

COMMISSION OF SECURITIES AND EXCHANGES
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 audit activity through the presentation of unpublished works 4, containing the respective reasonable assurance report (audit), the corresponding detailed report (final report, which encompasses the entire audited period) and the respective audited financial statements. To guarantee professional secrecy and authenticity, the audited entity must authenticate the documents and authorize their presentation to CVM, exclusively to prove the exercise of the audit. The authentication must include the signature of the legal representative of the audited entity on each page, with the indication that the copy matches the original. This proof will also be subject to the evaluation of the quality of the work, which may include the request to make the working papers available to CVM. The detailed report must contain, at minimum, the following information: the name or denomination of the audited entity; the period covered by the examination; description of the deficiencies and ineffectiveness of the internal controls and accounting procedures adopted by the audited entity followed by recommendations for the required corrections; and the date of issuance, the identification and signature of the responsible auditor.
1.4 Professional identity card of accountant, or equivalent certificate,
issued by a Regional Council of Accounting (item II, art. 5º; item IX, art. 6º; item III, art. 6º-A of CVM Resolution No. 23/2021) The interested party must present a copy of the accountant identity card, in the category of accountant, or an equivalent registration certificate issued by the CRC, if the date of registration is not on their card. This is because, in the absence of the said date, for the purpose of the initial term of the calculation of the time of exercise of the audit activity in the manner of art. 7º, the date of issuance of the presented card will be considered. Then, when there is a new issuance of the card, it is recommended that the previous copies also be sent, so that the oldest issuance date can be considered as the initial term of the calculation of the time of exercise of audit activity. Although it is possible to deliver only the “equivalent certificate, issued by the Regional Council of Accounting” according to norm 5, it is also recommended the presentation of the digital file of the professional identity card generated from the CRCDigital application (Professional Card – Export) or the printout of the query of registration data (including registration date and current status) of the accounting professional in the registry of the respective CRC, if the physical professional identity card or the professional qualification certificate do not indicate the date of registration of the professional, hindering the verification of compliance with art. 7º of the same resolution. Thus, for the purpose of compliance with the aforementioned provisions, the professional qualification certificate that does not contain the date of registration of the professional in the category of accountant is not considered an equivalent certificate to the professional identity card of 4 CVM Resolution No. 23, art. 7°, §1º. 5 CVM Resolution No. 23, art. 5°, II, art. 6°, IX and art. 6°-A, III.
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 15

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 accountant.
1.5 Location and Operation License, or
equivalent competent document (item IV, art. 5º; item V, art.
6º of CVM Resolution No. 23/2021)
Regarding the proof of a legalized office in the professional's own name, the Location and Operation License or equivalent competent document issued by the City Hall of the municipality where the professional exercises their activity must be submitted. The following cases will not be accepted:

AIPN – document issued in the name of a possible partnership of which the
interested party is a member; and
AIPJ – document issued in the name of an individual, even if they are part of the
shareholder structure of the requesting audit firm, nor document issued in the name of another partnership.
In the event that the activity exercised by the AIPN or AIPJ is exempt from or exempt from a location and operation license by the City Hall of the municipality where the activity is exercised, the respective reference indicating the municipal regulation that supports the mentioned exemption or waiver must be submitted, as well as the equivalent document, which among others, may be:
the municipal taxpayer registration form or the registration data form of the
AIPN or AIPJ at the respective municipal city hall;
the specific inquiry regarding exemption or waiver of the AIPN or AIPJ license on the
website of the respective municipal city hall on the worldwide web;
the specific declaration of exemption or waiver of the AIPN or AIPJ license
issued by the respective municipal city hall;
if provided for in the municipality's regulations, the self-declaration presented
by the AIPN or AIPJ to the respective municipal city hall regarding their classification in a scenario of exemption or waiver of the location and operation license.
1.6 Certificate of approval in technical qualification exam
(specific test – CVM), provided for in art. 30 (item VI, art.
5º; item XII, art. 6º; item V, art. 6º-A of CVM Resolution No. 23/2021)
1.6.1 On the need to take the technical qualification exam
NBC PA 13 (R3), which deals with the Technical Qualification Exam, established by the CFC, created a specific test for acting in entities regulated by the CVM, according to article 30, of CVM Resolution No. 23/2021. NBC PA 13 (R3) determines that the Technical Qualification
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 16

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Technique will be held for the authorization to exercise the activity of auditing financial statements for all entities included in the securities market. Therefore, for the registration of Independent Auditor (AIPN or AIPJ) at the CVM, it is necessary to present the certificate of approval in the specific (CVM) exam of technical qualification 6. The Certificate of Registration in the CNAI is not sufficient because it only proves that the accountant is registered as an independent auditor, but does not attest that he passed the specific technical qualification exam required by the CVM to act as technical manager in audit firms. As is well known, many professionals included in the CNAI were migrated to the CVM registry without approval in the exam, as they already had registration prior to the creation of the specific test. The certificate can be obtained on the website of the Federal Council of Accounting (CFC) on the worldwide web (https://cfc.org.br/desenvolvimento-profissional-einstitucional/exames/certificados/).
1.6.2 On the change of category or transfer of registration
Accountants already registered at the CVM as technical managers or AIPN who wish to change category or transfer to the registry of another AIPJ do not need to present the certificate of approval in the technical qualification exam, provided that the change occurs simultaneously, i.e., without discontinuity of the professional's registration with the CVM. For purposes of compliance with this requirement of maintaining the link and to avoid any undue discontinuity in acting as technical manager before the CVM, the relevant benchmark is considered the date of protocol of the new audit firm's registration request at the CVM, carried out through the INFOAUDI system, simultaneously with the request for disassociation from the previous audit firm. Thus, the date of signing the instrument of exit from the current partnership, although it constitutes a relevant internal event between the parties, is not the determining benchmark for the CVM, since the priority of the Autarchy is the continuity of the professional registration in its system, without interruptions. On the other hand, the date of protocol of the contract termination or contractual amendment with the competent authority is fundamental for the formalization of the partnership and its amendments vis-à-vis third parties, being this date that marks the beginning of the counting of the regulatory period of 30 days for the respective communication to the CVM. It is emphasized, however, that, specifically for purposes of maintaining the registration of the Technical Manager, the criterion adopted by the CVM is the management of the link simultaneously in the INFOAUDI system. In this way, professionals who have already been registered at the CVM as technical managers of an audit firm will be subject to proof of approval in the technical qualification exam (Technical Qualification – CVM) only if the request for inclusion in another auditor, or in an audit firm of which they have already been technical managers, occurs after the cancellation of their registration as technical manager in the Items VI of art. 5º, XII of art. 6º and V of art. 6º-A of CVM Resolution No. 23/2021.
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 17

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 previous auditor or in that firm where they exercised this function. To avoid such situation, the Technical Manager must ensure that the registration request in the new audit firm and the disassociation from the previous firm are processed in a coordinated and simultaneous manner in INFOAUDI, maintaining the active link until the moment of the effective transition. After approval in the contest and until the effective confirmation of their registration or registry at the CVM, the professional interested in obtaining such prerogative must remain up to date with the requirements of the Continuing Professional Education Program, proving their regularity through a specific certificate issued by the CFC. Otherwise, the applicant must obtain approval in the specific technical qualification exam again for the CVM.
1.6.3 On approval in the technical qualification exam by members of the
audit teams
All members of the audit teams who exercise managerial functions must also be approved in the aforementioned exam.
In the event that the audit report issued within the scope of the securities market contains signatures of other accountants not registered as technical managers (RT) at the CVM, they also need to have been previously approved in a specific technical qualification exam “CVM”, under penalty of the respective audit firm and its technical manager (RT), registered in this autarchy and also signatory of the audit report, infringing item VII of art. 25 of CVM Resolution No. 23/2021.
1.7 Annual Periodic Information (Art. 16 – CVM Resolution No.
23/2021)
Independent auditors must send to the CVM, by the last business day of the month of April of each year, information related to their activity in the securities market, according to Annex D to CVM Resolution No. 23/2021 7.
These information are important subsidies for the CVM to evaluate the auditors' capacity to adequately serve their clients.
Such information must be submitted via the internet, on the CVM page. The submission must be made through the option “REGULATED (https://www.gov.br/cvm/ptbr/assuntos/regulados)”, selecting next the option “DOCUMENT SUBMISSION – CVMWEB (https://cvmweb.cvm.gov.br/swb/default.asp?sg_sistema=scw)” and , finally, the option “DOCUMENT SUBMISSION”. With the aim of facilitating the presentation of the Electronic Conformity Declaration, avoiding delays or non-presentation, since 2020, upon accessing the CVMWEB system to present the Annual Periodic Information, the auditor is directed 7 CVM Resolution No. 23, art. 16.
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 18

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 automatically to the verification of their registration data. After validation of the registration data, or their update, the auditor must issue the Electronic Conformity Declaration and, only then, is redirected to the presentation of the Annual Periodic Information. At this stage, there are two options for submitting the information: i) Submission of documents via form and ii) Upload of documents. Finally, the option “Annual Report of Independent Auditor” must be selected. The option “upload of documents” should be used only by those auditors who have more than 10 (ten) clients that are open companies (or part of the securities market or incentivized companies), since, in this case, it is necessary to create a file (XML standard) to submit the required information. Additionally, from the effectiveness of CVM Resolution No. 23/2021, Annex D presents in item 4.A the request for presentation of the accounting statements of the audit firm (only legal entity) referring to the social exercise that serves as the basis for the annual information being presented, if the period provided by law for its elaboration has already elapsed; or to the penultimate closed social exercise, in the other cases. The file containing the accounting statements must be in “PDF” format, and must be submitted together with the Annual Information through the document upload option made available. Failure to observe the deadline for sending the information treated in this topic entails the charge of a daily coercive fine of R$ 200.00 (two hundred reais) 8. There is no longer a need to inform about the courses and training carried out in the year of competence of the report, since this information is sent directly by the CFC to the CVM.
1.8 Unique registry (art. 11, sole paragraph, CVM Resolution No.
23/2021)
The sole paragraph of art. 11 of CVM Resolution No. 23/2021 seeks to guarantee equity between the treatment given to the AIPN and the AIPJ and their technical managers. The rule does not allow the registration in the AIPN category of an accountant who is a partner, director or technical manager or who has a professional link of any nature with an AIPJ. In this way, an asymmetric situation was corrected that allowed partners or technical managers of AIPJ registered at the CVM to act in another audit firm also registered at the CVM. It is worth mentioning that the limitation of participation of a partner in only one audit firm registered at the CVM does not violate the constitutional right of free association. The professional can have as many associations and participations as desired, even within 8 Provided for in CVM Resolution No. 23, art. 1, in light of CVM Resolution No. 47/2021.
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 19

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 the same economic group. However, participation in an AIPJ registered at the CVM will be limited to only 01 (one) audit firm. Therefore, requests for new registrations or inclusion of technical managers that are out of compliance with this determination will be promptly denied.
1.9 Cases of suspension and cancellation ex officio (Art. 15 –
CVM Resolution No. 23/2021)
Art. 15 of CVM Resolution No. 23/2021 provides for the cases in which the Independent Auditor

Natural Person, the Independent Auditor – Legal Entity and their technical managers
can have, respectively, the registration and registry at the Securities and Exchange Commission suspended or cancelled. Item II of the same article provides as a hypothesis of suspension or cancellation the non-compliance with any of the conditions necessary for the granting or maintenance of the registration or registry, adding also the case of supervening of a disabling situation. In this line of thought, it is important to reinforce that both the AIPN and the AIPJ are categories applicable to professional accountants, being one of the requirements for acquisition and maintenance of AIPJ registration that the professional partnership is formed by partner accountants with at least half represented by technical managers regularly registered (art. 4º, items II and III, CVM Resolution No. 23/2021). Thus, the prevailing understanding is that the Audit Firm is a partnership formed by professionals who exercise the intellectual activity of providing audit services and other services inherent to the profession of accountant. In this way, it is prohibited for audit firms operating in the Brazilian capital market to receive any external investment, such as those coming from “Private Equity”, or to possess a corporate structure divergent from that provided for in CVM Resolution No. 23/2021, under penalty of having their registration and registry suspended or cancelled ex officio by the Securities and Exchange Commission.
1.10 External Quality Review Program (Art. 33 –
CVM Resolution No. 23/2021)
1.10.1 On the submission of external quality review by peers
Independent auditors must submit to the external quality review performed by another auditor registered at the CVM 9 , in consonance with technical and professional standards, especially NBC PA 11 issued by the CFC.
The review must be performed by another independent auditor also registered at the CVM with structure compatible with the work to be developed, even for AIPN or AIPJ constituted as a Single-Person Limited Liability Company (SLU). The external review report of quality control must be signed by a technical manager registered at the CVM or AIPN registered in this autarchy, as the case may be. 9 CVM Resolution No. 23/2021, art.33.
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 20

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 registered at the CVM or AIPN registered in this autarchy, as the case may be.
1.10.2 On the acting of the reviewing auditor
Specifically regarding the acting of the reviewing auditor, within the scope of the Risk-Based Supervision Program (SBR) adopted by the CVM in recent years, recurrent problems have been observed in peer reviews, mostly related to the depth of examinations and the obtaining of appropriate and sufficient audit evidence to support the opinion. As a result, the Autarchy adopted complementary administrative procedures, including, with the instigation of sanctioning processes (Term of Accusation). In this sense, it is worth highlighting that the reviewing auditor must verify especially if the reviewed complies with the Continuing Professional Education Program (NBC PG 12 R4) and the procedures to be observed by professionals and accounting organizations to comply with the obligations provided for in Law No. 9.613/1998 (CFC Resolution 1530/2017), in addition to the requirements of the external quality review questionnaire.
1.10.3 On the suspension of the auditor's registration with the CVM
Non-compliance with the review program in at least 2 (two) of the last 5 (five) years leads to the suspension of the auditor's registration until a new review is presented and approved 10.
Since 2018, auditors who repeat non-compliance with the External Quality Review Program have their registrations suspended at the CVM. If they wish to reactivate their registration, they must, by their own act and without the need for prior indication by the External Quality Review Committee – CRE, indicate their reviewing auditor to the CRE, submitting themselves to the external quality review, within the deadlines and procedures defined by the CFC norm that governs the Program. At the end of the review, its result, conclusions and recommendations must be presented to the CRE so that it is possible to evaluate the review performed, approving it or not.
1.10.4 On the forms of infringing the compliance with the External Quality Review
Program
In some cases, an attempt to infringe the compliance with the External Quality Review Program is observed, notably in two ways:
a) Independent auditors indicated by the CFC for the External Quality Review Program that cancel their registration with the CVM and request new registration, in the same exercise or in the following, to avoid the review. Even in these cases, according to CVM and CFC regulations, the auditor must submit to the Program in the next exercise (starting from the new registration). However, some do not comply with this requirement upon return. The SNC understands that even in this case these auditors 10 CVM Resolution No. 23, art. 33, §4º.
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 21

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 discomply with external quality control for two exercises 11. Thus, in the cases identified and future, the SNC will adopt the suspension provided for in the norm. b) Some independent auditors, although they submit to the External Quality Review Program when indicated annually by the CFC, present recurrent problems in their reviews, making the approval of the review by the CRE-CFC impossible, being automatically indicated for the following year. It is understood that the recurrence of this practice, year after year, characterizes an attempt to circumvent the compliance with the external quality review. In this way, we emphasize that such auditors are subject to suspension of registration, in addition to the adoption of other administrative measures applicable to the case.
1.10.5 On the reactivation of the registration suspended for non-compliance with the
External Quality Review Program
The reactivation of the registration suspended for non-compliance with the External Quality Review Program will occur only if the process is approved by the CRE/CFC without any deficiency pointed out (review report of the quality system adequate, i.e., “without deficiencies”). Reports with any other opinion, even in compliance with the norm and approved by the CRE/CFC, will not be considered valid for the reactivation of the registration of independent auditor at the CVM. The submission to the External Quality Review Program for these suspended auditors is voluntary, at the request of the auditor themselves, being mandatory only for active auditors in the CVM registry and indicated by the CRE/CFC. We emphasize that this reactivation of registration is not automatic, and it is up to the suspended auditor to make the request to the CVM.
1.11 Continuing Professional Education Program (Art. 34 –
CVM Resolution No. 23/2021)
1.11.1 On the non-compliance with the Continuing Education Program and the
suspension of registration
Aiming to maintain a high standard of technical qualification and constant update regarding professional standards, accounting and audit procedures and standards related to the exercise of their activity in the securities market, independent auditors registered at the CVM must maintain, for themselves and for their technical staff, a continuing education program consistent with the guidelines approved by the CFC, contained in NBC PG 12 (R4). Non-compliance with the Continuing Professional Education Program in at least 2 (two) of the last 5 (five) years by the AIPN and AIPJ, as well as by their partners and/or technical managers, entails the immediate suspension of registration until a new certificate of approval in the Technical Qualification Exam is presented 12.
1.11.2 On the presentation of the annual report of activities related to
Continuing Education
Due to the joint action of this Autarchy with the Continuing Professional Education Commission – CEPC, established by the CFC for management and monitoring of the Program, it is not necessary for independent auditors to present the annual report of activities related to Continuing Education to the CVM. This report should be delivered annually to the respective Regional Council of Accounting – CRC, as defined in NBC PG 12 (R4). The proof of compliance with the Continuing Professional Education Program is homologated by the CFC/CRCs system. We remind you that, regardless of participation in external courses and activities, the independent auditors must have mechanisms for timely monitoring of changes in the professional standards of independent audit emanating from the CFC and, when applicable, from the Institute of Independent Auditors of Brazil - IBRACON, and the standards that regulate the activity of independent audit within the scope of the securities market. At the request of the CFC, we also inform that, considering the control of the covid19 pandemic and the resumption of in-person activities, the minimum score required for the professionals obliged to comply with the Program returned, starting from 2022, to its normative condition, that is, 40 (forty) points – with, at least, 12 (twelve) points to be fulfilled with knowledge acquisition activities, contained in
Table I of Annex II, as provided for in item 7 of NBC PG 12 (R4).
1.12 Registry Update and Electronic Conformity Declaration (art. 2º, items I and II of CVM Resolution No.
51/2021)
1.12.1 On the registry update
Regardless of the presentation of periodic information, it is also necessary that independent auditors keep their registry updated, observing the deadline of up to 07 (seven) business days counted from the date of the fact that caused the alteration. For this, it is necessary that independent auditors access their registration data on the CVM page. In addition to on-demand update, annually until the 30th day of the month of April 13, the Independent Auditor must confirm that their registration data remain valid, with the issuance of the Electronic Conformity Declaration. Opportunistically, considering that all communications from the CVM with the independent auditors are carried out through electronic messages 12 CVM Resolution No. 23, art. 34, § 2º. 13 CVM Resolution No. 51/2021, art. 2º, II.
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 23

COMMISSION OF SECURITIES AND EXCHANGE
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 (e-mail), we reinforce the need for such addresses to be updated.

On this same topic, we remind you that the email informed as the link of communication with the CVM should not be protected by message barriers (anti-spam), as such functionality prevents the reception of forwarded messages. Unfortunately, we have received several message bounces due to this tool. We highlight that such addresses are freely updated by independent auditors, characterizing the primary source of communication with the CVM. Thus, the existence of these control tools is the sole responsibility of the independent auditors, who assume the risk of their maintenance.

1.12.2 On the Issuance of the Electronic Compliance Declaration
The Electronic Compliance Declaration must be issued via access to the option “REGULATED (https://www.gov.br/cvm/pt-br/assuntos/regulados)”, selecting the option “SERVICES TO CVM PARTICIPANT” and then the option “PARTICIPANT REGISTRATION UPDATE”, followed by “ELECTRONIC COMPLIANCE DECLARATION”, on the CVM page. It is important to emphasize that, even in cases where there are no changes to the data on the website, the Electronic Compliance Declaration must be issued.

For the issuance of the Electronic Compliance Declaration, the independent auditor must be selected (click the box before the auditor's name), confirming the registration data, or altering it if necessary, and then activating the “SEND FORM” option. After sending the Electronic Compliance Declaration, the information “Form already sent? YES” will appear.

1.12.3 On the coercive fine for failure to deliver or delay in presenting the Electronic Compliance Declaration
Finally, we emphasize that the failure to present the Electronic Compliance Declaration, or its late presentation, subjects the participant to a daily coercive fine 14 in the amount of R$ 200.00 (two hundred reais) for the participant legal entity and R$ 100.00 (one hundred reais) for the participant natural person.

1.13 Independent Auditor – Legal Entity: corporate types and liability of partners
Regarding the corporate type, based on the Civil Code (CC), the single-professional accounting society is of a simple nature 15, not business. Thus, their registration must be made in the Civil Registry of Legal Entities (RCPJ), even if they adopt corporate types of business societies 17.

14 CVM Resolution No. 51/2021, art. 6°.
15 Article 966 of the CC.
16 Final part of article 1.150 of the CC.
17 Final part of article 983 of the CC.
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 24

COMMISSION OF SECURITIES AND EXCHANGE
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 Enunciation No. 57, of the I Civil Law Day, confirms that the choice for the business type does not alter the simple nature of the society, and Enunciation No. 382, of the IV Civil Law Day, explains that registration follows the nature of the activity (business or not) and the other issues follow the rules of the adopted corporate type.

CVM Resolution No. 23/2021 changed the permitted corporate types for audit societies registered with the CVM and eliminated the requirement of joint and several and unlimited liability among partners, dispensing with the need to constitute as a pure simple society and specific clauses in the articles of association.

In this sense, the normative changes do not require adjustments to the articles of association of audit societies to comply with CVM Resolution No. 23/2021; therefore, current contracts remain valid for the maintenance of registration. Any contractual changes, which reflect the partners' desire to adopt the possibilities introduced by the normative changes, can be made at any time and must be sent to the CVM for registration update, according to art. 17 of the resolution.

Still on the theme, it is opportune to highlight that the Specialized Federal Prosecutor’s Office attached to the Securities and Exchange Commission (PFE) expressed the understanding that “no legal or regulatory foundation is envisioned to prohibit audit societies from adopting as a corporate type the single-member limited liability company (SLU), provided for in §1 of art. 1.052 of the Civil Code [...] If the independent auditor adopts the form of a single-member society, it must register in the category of independent auditor legal entity.”

Finally, in light of the above, it is important to clarify that the copy of the National Registry of Legal Entities of the Ministry of Finance of the headquarters and offices, presented to comply with the requirement established in item VI of art. 6 of CVM Resolution No. 23/2021, must identify the audit society, in the field code and description of the legal nature, with code 223-2 for the Pure Simple Society or with code 224-0 for the Simple Limited Society and for the Single-Member Simple Limited Society, as the case may be and according to the current table used by the CNPJ program for entities, available at https://www.gov.br/receitafederal/pt-br/assuntos/orientacaotributaria/cadastros/cnpj/tabelas-utilizadas-pelo-programa-cnpj.

2 TOPICS RELATED TO THE EXECUTION OF WORKS AND AUDIT DOCUMENTATION
2.1 CVM Resolution No. 23/2021
2.1.1 Hypotheses of impediment and incompatibility (Art. 22 to 24 - CVM Resolution No. 23/2021)
The SNC understands that independence is an essential factor in differentiating the accounting professional who works within the company from that who provides independent audit services. Technical competence, responsibility, integrity, objectivity, and ethics are elements common to both. The great differentiator is the degree of independence inherent to both. Moreover, independence must be exercised in its entirety, insofar as it involves two complementary aspects: the auditor must in fact exercise his activities independently and must also appear to be independent. Thus, it is essential that the people who are supposedly the beneficiaries of the auditor's work have the perception that it is an independent person or society, without conflicts of interest, potential or real, that could call into question the fairness of his performance and the objectives of independent audit. This is fundamental for the maintenance of credibility related to independent audit activities and, consequently, in investor confidence regarding the audited financial statements.

Considering mainly this last aspect, CVM Resolution No. 23/2021 prohibits the provision of certain consulting services to audit client companies, such as: corporate restructuring, company valuation, asset revaluation, determination of the values of provisions or technical reserves and provisions for contingencies, tax planning, topics related to the issuance of sustainability financial reports, and remodeling of accounting, information, and internal control systems.

At this opportunity, it is worth clarifying that the restriction imposed by item II of art. 23 of CVM Resolution No. 23/2021 does not constitute an obstacle to the exercise of the professional activity, since it does not establish an absolute prohibition on the provision of the audit service nor the consulting service, but merely prevents both services from being provided, simultaneously, by the same independent auditor to the same client, within the securities market.

Additionally, CVM Resolution No. 23/2021 prohibits the independent auditor and persons linked to him from acquiring or maintaining securities or financial instruments of the audited entity.

Persons linked to the independent auditor are those with whom he maintains a bond, relationship, participation, or has an interest, as defined by the Federal Council of Accounting (CFC) in the professional independence standards and which prevent him from executing audit services.

2.1.2 Issuance of Circumstantial Report (art. 25, item II, CVM Resolution No. 23/2021)
Art. 25, item II, of CVM Resolution No. 23/2021 provides that the independent auditor must “prepare and send to the management and the Fiscal Council, a circumstantial report containing his observations regarding the internal controls and accounting procedures of the audited entity, describing, furthermore, any deficiencies or inefficiencies identified during the course of the work.”

In this sense, ratifying the provisions in the cited normative text, we clarify that the issuance of the said circumstantial report is expressly mandatory at the end of the work, in any hypothesis, regardless of whether deficiencies or inefficiencies were, or were not, identified in the examined environment. That is, although the independent audit professional standard dealing with the theme (NBC TA 265) determines the mention in the report only of significant deficiencies, if they exist, the circumstantial report required by CVM Resolution No. 23/2021 is more comprehensive, requiring the issuance of the report at the end of each work.

We reinforce that the circumstantial report must contain, at a minimum, among other information, the description of the deficiencies and inefficiencies of the internal controls and the accounting procedures adopted by the audited entity, accompanied by the recommendations of the independent auditors and the comments of the management for the corrections that may be necessary. As can be seen, such points integrate the minimum set of information that the circumstantial report must contain. However, they do not exhaust the content of the said report.

Furthermore, it is important to emphasize that the said report, in consonance with the cited professional standard, must segregate significant deficiencies from those that are not significant. In those extremely rare situations, in which the independent auditor concludes that there is no identification of internal control deficiencies (significant or not), the report to be issued will be affirmative, that is, it must affirm the non-identification of internal control deficiencies, whether significant or not, during the performance of the work.

Such procedure allows minimal proof that the independent auditor executed the evaluation of internal controls and accounting procedures provided for in the standard issued by the CVM and by the independent audit professional standards. It is always important to remember that it is the responsibility of the management of the audited entity to adapt the internal controls determined as necessary to allow the preparation of financial statements free of material misstatement. In addition, it is up to the auditor to consider the structure and functioning of internal control to plan the audit procedures that are appropriate in the circumstances.

However, it is important to note that, in this specific case, the work of the independent auditor does not have as its express purpose to express an opinion on the effectiveness of internal control, as provided for in the audit standards issued by the CFC applicable to this context.

In this perspective, we reinforce that the auditor must, furthermore, during the course of audit work in subsequent years, establish specific monitoring of those deficiencies pointed out in the previous report, as well as their outcome in relation to management's actions, to determine whether such deficiencies should continue to be communicated in the circumstantial report or, still, if those initially considered as “not significant” altered their status due to their recurrence, without actions by the
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 27

COMMISSION OF SECURITIES AND EXCHANGE
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 management of the audited entity over the periods examined. Thus, it is expected that the auditor considers in the monitoring of deficiencies factors such as the probability of new occurrence, the magnitude of the misstatement, and the possibility of evolving into a significant deficiency, keeping the records of the analysis of each of these factors and the respective conclusion of the auditor duly documented in the working papers. Additionally, the auditor must evaluate whether the set of deficiencies individually not significant can, when analyzed together, represent a significant deficiency, considering their relevance in the context of the internal controls of the audited entity.

In complement, it is opportune to highlight that, according to NBC TA 265 – Communication of Internal Control Deficiencies, the deadline for issuing written communication is detailed in item A13, as follows:

When determining when to issue written communication, the auditor may consider whether the receipt of this communication would be an important factor to allow those responsible for governance to perform their general supervision responsibilities. In addition, for entities listed on stock exchanges in certain jurisdictions, those responsible for governance may have to receive written communication from the auditor before the date of approval of the financial statements to perform specific responsibilities regarding internal control, for regulatory purposes or to meet other purposes. For other entities, the auditor may issue the written communication at a later date. However, in the latter case, considering that the written communication from the auditor on significant deficiencies is part of the final audit file, the written communication is subject to the requirement of item 14 of NBC TA 230, which requires the auditor to timely assemble the final audit file.

NBC TA 230 establishes that the adequate time limit for the completion of the assembly of the final audit file is normally no more than 60 days after the date of the report of the independent auditor (NBC TA 230, item A21). (underlines ours)

Therefore, the independent auditor must receive management's comments within a period of up to 60 (sixty) days after the date of the respective audit report. In cases where, despite the efforts made by the auditor, there is no response from management, the fact must appear in that final audit file, along with the version for discussion sent, being considered “final” from that moment.

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 28

COMMISSION OF SECURITIES AND EXCHANGE
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686
2.1.3 Composition of audit teams (art. 25, item VII, CVM Resolution No. 23/2021)
Item VII, art. 25, of CVM Resolution No. 23/2021 determines that the auditor must:
VII – ensure that all partners, directors, managers, supervisors or any other members, with a management function, in the team designated for the exercise of the activity of audit in entities regulated by the CVM, have been approved in a Specific Technical Qualification Exam for the CVM.

Thus, when planning audit teams, auditors must pay attention to the fact that all those components who exercise a management function, such as, partners, directors, managers or supervisors, among other possible positions, have been approved in the Specific Technical Qualification Exam for the CVM.

It is important to note that item VII of art. 25, combined with the provisions in the caput and in §1 of art. 34, all of the cited CVM Resolution No. 23/2021, ratifies the obligation that such professionals pay attention to the annual compliance with the Continuing Professional Education Program, after their approval in the said exam. Non-compliance with the guidelines imposed by the Federal Council of Accounting regarding the Professional Education Program by the cited professionals may lead to the adoption of administrative measures against non-compliant independent auditors.

Regarding specifically the accountants already registered as technical managers authorized to issue and sign audit reports on behalf of each audit society, within the securities market, it should be noted that, at the time of their applications for inclusion in the technical managers registry, these complied with all the requirements that enabled the approval of their registration requests by the CVM. Consequently, the current understanding of the SNC is that technical managers already registered in this autarchy, and while maintaining their current active registration, do not need to be approved in the Specific Technical Qualification Exam for the CVM. Without prejudice to such understanding, the SNC emphasizes that the voluntary performance of the said exam is a technically recommended condition, given the need for continuous technical updating and improvement of professionals who work in the securities market.

2.1.4 Auditor Rotation (Art. 31 to 31A – CVM Resolution No. 23/2021)
According to art. 31 of CVM Resolution No. 23/2021, the Independent Auditor – Natural Person and the Independent Auditor – Legal Entity cannot provide services to the same client for a period longer than five consecutive fiscal years, requiring a minimum interval of three fiscal years for re-hiring.

In other words, the rule of mandatory rotation of independent auditors is
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 29

COMMISSION OF SECURITIES AND EXCHANGE
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 composed of the conjunction of the maximum linkage period and the minimum interval of absence, both necessary to achieve the objective sought by the normative activity in establishing the aforementioned rule.

There is no hypothesis provided for in CVM Resolution No. 23/2021 that contemplates the reduction of the minimum interval established. There is no proportionality relationship between the linkage period and the minimum interval of absence. Thus, regardless of the duration of the linkage period of the independent auditor with the audited entity, before the start of a new linkage period, the minimum interval of three fiscal years must be respected.

It is opportune to emphasize that it is the primary responsibility of the auditor to comply with the rotation requirement, renouncing the client in case of non-compliance with the standard. Notwithstanding, as provided in art. 27 of the said standard, the administrators of the audited entity must be held responsible for the eventual hiring and maintenance of independent auditors who do not meet the conditions provided for in the Resolution.

No less relevant, rotation cannot be carried out with another audit society with which the replaced auditor has common interests, nor that uses the same physical and operational structure as the previous auditors. Examples of situations that may characterize non-observance of the auditor rotation rule include:
a) use of the same address (headquarters and offices, if any); b) direct kinship relationship between partners and technical managers of the audit societies (replaced and current); c) creation of “new” audit societies for service provision, with partners and/or technical managers previously linked to the replaced auditor.

2.1.4.1 Re-hiring of the Auditor
We draw attention to the eventual re-hiring of the replaced auditor.
Regardless of whether or not the period defined in the standard for the provision of consecutive audit services to the same client is reached, re-hiring can only occur after a period of three fiscal years. For example, if AUDITOR “A”, after two fiscal years of service provision to the audited, was replaced by AUDITOR “B”, AUDITOR “A” can only return to provide audit services after three fiscal years of his replacement.

2.1.4.2 Possibility of extension of the service provision period for
Companies with Statutory Audit Committee (CAE) Art. 31-A of CVM Resolution No. 23/2021 establishes an exception regarding the maximum linkage period, allowing its extension to up to ten years, if the
Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 30

SECURITY AND EXCHANGE COMMISSION OF BRAZIL
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 audited entity must have an Audit Committee installed and fully operational until the date of closing of the third fiscal year following the hiring of the independent auditor, and that it remains operational after that date while utilizing the prerogative. Furthermore, the auditor must be a legal entity and meet the requirements of arts. 31-B to 31-F of the aforementioned resolution.

2.1.4.3 Documentation of the installation, composition, and
functioning requirements of the Audit Committee We emphasize that the independent auditor must evaluate and document in their work papers the compliance with the installation, composition, and functioning requirements of the Audit Committee provided for in arts. 31-A, 31-B, and 31-C of Resolution CVM No. 23/2021. It should be noted that, according to NBC TA 230 (R1), audit documentation is the record of the audit procedures performed, the relevant evidence obtained, and the conclusions reached by the auditor. This includes documents and notes crafted during the course of the work or obtained from other sources, which record the evidence of the work performed by the auditor and support their opinion and comments, and not merely copies of documents. We remind you that the auditor must prepare audit documentation sufficiently complete and detailed to allow an experienced auditor, without any prior involvement with the audit, to understand the work performed. The audit evidence is fundamental, as it comprises the information used by the auditor to reach the conclusions that form the basis of their opinion recorded in the respective audit report, as defined by NBC TA 500 (R1). Therefore, the mere attachment of meeting minutes, internal regulations, or citations regarding the assessment of the personal condition of an Audit Committee member, without an objective analysis and distinct presentation of the content of the discussions, functioning, determinations, and requirements for compliance with the standard's requirements, does not meet these objectives. Similarly, analyses performed without formal documents that substantiate subjective conclusions incur the same deficiency.

2.1.4.4 Re-election of Audit Committee members
It is understood that the re-election of Audit Committee members is possible, without an interregnum between mandates. However, in the event of any gap between the mandates, the Audit Committee members may only return to integrate such body, in the same company, after at least three years have elapsed from the end of the mandate (as specified in § 4 of art. 31-C of Resolution CVM No. 23/21).

2.1.4.5 Use of a single Audit Committee for the Group
Finally, we emphasize that there is no regulatory impediment to the use of a single Audit Committee for a parent company and its wholly-owned subsidiaries and other listed companies of the Group. However, to ensure full compliance with Resolution CVM No. 23/2021, individualized actions are necessary for each company. Below,
Annex Circular-Office No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 31

SECURITY AND EXCHANGE COMMISSION OF BRAZIL
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 some of these actions are exemplified:

provision of the Audit Committee in the Bylaws of each company;
direct link of the Audit Committee to the Board of Directors of each company or direct link of the Audit Committee to the Board of Directors of the parent company, provided that the attributes of said committee regarding wholly-owned subsidiaries are
properly formalized in the bylaws, internal regulations, and other relevant documents of the parent company and the other companies;
coordination of meeting dates, so that, in addition to occurring at least
bimonthly, it is possible to review the financial statements of each company in the Group before their disclosure;
the Audit Committee of each company must have its own internal regulations approved by the respective board of directors, detailing its functions,
as well as its operational procedures;
the Audit Committee must have means to receive and control separately the complaints of each company;
the Audit Committee must have operational autonomy and budget allocation, within the limits
approved by each board of directors;
the Audit Committee coordinator must attend the ordinary general assembly of each company;
the Audit Committee must supervise the activities of the internal controls area, internal audit, and the area responsible for preparing the financial statements of each company;
the Audit Committee must, for each company, monitor the quality and integrity: a) of the internal controls mechanisms; b) of the quarterly information,
interim financial statements, and financial statements of the company; and c) of the information and measurements disclosed based on adjusted accounting data and on non-accounting data that add elements not foreseen in the structure of the usual financial reporting;
the Audit Committee must evaluate and monitor the risk exposures of each company
separately;
the Audit Committee must evaluate and monitor, together with the management and the internal audit area of each company, the adequacy of transactions with related parties carried out by the companies and their respective disclosures;
the Audit Committee must prepare a summarized annual report, to be presented together with
Annex Circular-Office No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 32

SECURITY AND EXCHANGE COMMISSION OF BRAZIL
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 the financial statements, with the required content, for each company.

2.1.4.6 Hiring for internal audit during the cooling-off period and
risks to independence
The mandatory rotation rule, established in the caput of art. 31 of Resolution CVM No. 23/2021, determines that the independent auditor cannot provide services to the same client for a period exceeding five consecutive fiscal years, requiring a minimum interval of three fiscal years for their rehiring. Although the literal text of art. 31 is restricted to the activity of auditing financial statements and reviewing interim information, the maintenance of a contractual link for non-audit services requires extreme caution regarding ethical and professional principles. The hiring of internal audit by a company that has provided independent audit services to the same entity less than three years ago is classified by Resolution CVM No. 80/2022 18 as a non-recommended governance practice. Such a situation subjects the issuer to the "comply or explain" regime, as the continuity of the commercial relationship during the mandatory absence interval may create significant threats to the independence and objectivity of the auditor. The auditor must assess whether this proximity compromises their ability to exercise impartial judgments, as advocated by NBC PG 100 (R1) 19. The provision of internal audit services by the former external auditor, especially when accompanied by the manifest intention of rehiring for accounting audit after the end of the cooling-off period, constitutes a grave threat of familiarity. This prolonged and close relationship may lead the professional to become excessively sympathetic to the client's interests or to accept their work without the due professional skepticism, prejudicing the essence of rotation, which aims precisely to refresh the relationship between auditor and audited. Additionally, an unequivocal threat of self-review is identified if the professional returns to the role of independent auditor after having acted in internal audit. In this case, the auditor would be reviewing and testing internal controls that they themselves helped to implement, adjust, or validate in the previous role. The exchange of internal teams in the audit firm is not sufficient to remove this reality, maintaining the firm's commitment to the results of its own previous judgments. It is fundamental to emphasize that independence must be maintained both in terms of the aspect of thought and in terms of the appearance of independence. According to NBC PA 400 20, the audit firm must avoid facts and circumstances that lead a 18 Resolution CVM No. 80/2022 item 24, a, i. 19 NBC PG 100 (R1) Item 120.6A3 and Principles of Objectivity, Integrity, and Identification of threats. 20 NBC PA 400 Items 400.5 (a) and (b), 400.6
Annex Circular-Office No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 33

SECURITY AND EXCHANGE COMMISSION OF BRAZIL
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 well-informed third party to conclude that integrity or professional skepticism have been compromised. The advance planning of rehiring for external audit, enabled by a contractual bridge via internal audit, reveals a link that transcends the independence expected in the securities market. In light of this scenario, the SNC advises that the use of such hiring structures will be subject to rigorous supervision. If the loss of independence on the part of the auditors is evidenced due to the continuity of the link during the cooling-off period of art. 31 of Resolution CVM No. 23/2021, the Agency will adopt the appropriate administrative measures for the investigation of responsibility for non-compliance with professional and regulatory standards. Professional skepticism and the effective alternation of teams are non-negotiable pillars for the credibility of the independent audit system.

2.1.5 Independence: Close relationship of the auditor with members of the
management and governance of the audited entity It has been observed, in recent years, the growing participation of professionals with previous experience in audit firms, especially those who acted as audit partners and technical managers, in the composition of the governance bodies of listed companies, notably in audit committees. In these circumstances, when a member of a governance body of a listed company maintained a link with the audit firm hired by the same company, it imposes the need for heightened attention to issues related to the independence of the auditor. Such risks must be properly assessed by the listed company and the audit firm, both during the course of the execution of the work and, in an even more relevant manner, in the processes of hiring, as well as of acceptance and continuity of audit work, respectively. NBC PA 400 – Independence for Audit and Review Engagements establishes specific requirements and addresses threats to the independence of the auditor in cases where there is or has been an employment or professional association relationship between the auditor (or the audit firm) and administrators, governance members, or employees of the audited entity who exert significant influence over the preparation or supervision of the accounting records. Threats to independence can manifest, among other situations, due to the nature and extent of the existing relationship between the auditor and the professional who holds a relevant position in the audited entity, including, by way of example:
participation in pension plans funded, directly or indirectly, by the audit firm; payments or post-employment benefits of any nature; funding, by the audit firm, of relevant expenses for the benefit of the professional; receipt of values as payment for the provision of
Annex Circular-Office No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 34

SECURITY AND EXCHANGE COMMISSION OF BRAZIL
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 services of any nature; remaining financial obligations; or any other links that characterize a continuous benefit or obligation still in effect, whether they are of a contractual, financial, commercial, or social security nature. This relationship is not exhaustive and has a merely illustrative character, limited to exemplifying situations that may generate threats to independence or conflicts of interest. In these cases, the audit firm and the listed company must formally assess such circumstances and document their conclusions, ensuring that the independence of the auditor is not compromised, including from the perspective of the appearance of independence, a factor essential for the preservation of the confidence of users of the financial statements. Such assessments must be documented and constitute the work papers related to client acceptance, in a specific item of independence assessment by the auditor. Additionally, situations involving employment negotiations between professionals of the audit firm and audited entities must be considered, to the extent that such circumstances may compromise the objectivity and impartiality required in the exercise of the independent audit activity. In this context, it is expected that the audit firms maintain effective policies and procedures that require their professionals to timely communicate the start of discussions or negotiations of employment with audit clients, in order to allow the adoption of appropriate safeguards.

2.1.6 Published summarized financial statements (in printed newspaper)
Guidance Opinion 39 published by the CVM on December 20, 2021, addresses the requirements to be observed in the publication of summarized financial statements, according to the new wording of art. 289, I and II, of Law 6.404/76:
https://www.gov.br/cvm/pt-br/assuntos/noticias/cvm-divulga-parecer-de-orientacaosobre-demonstracoes-financeiras-resumidas.
We emphasize that the summarized report of the independent auditor, when published, must be prepared from the complete independent auditor's report, which must be duly disclosed on an electronic address clearly referenced in the summarized publication. In our monitoring activities, it has already been possible to observe that some important information recorded in the audit report is being omitted in the final summarized form (“excerpt of the relevant information from the report”). We remind you that item 4 of CVM Guidance Opinion No. 39 defines the minimum content that the summarized report of the independent auditor must contain. However, this minimum content does not limit its application, nor does it exclude the need for disclosure of other relevant information existing in the audit report. Thus, the understanding of the SNC is that, when recording emphasis paragraphs in their report, the
Annex Circular-Office No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 35

SECURITY AND EXCHANGE COMMISSION OF BRAZIL
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 auditor discloses a matter presented or disclosed in the financial statements that, in their judgment, is of such importance that it is fundamental for the understanding by users of the financial statements. Thus, it is not acceptable that such information be omitted from the summarized audit report, given the inherent relevance of the information contained in the emphasis of the report, as previously recognized by the independent auditor themselves. This understanding applies to any emphasis paragraph in the auditor's report and, in an even more substantial manner, to those related to the risk of continuity of the audited entity. We therefore reaffirm that it is the responsibility of the independent auditor to verify if the information published in condensed form is in consonance with the complete audited financial statements and with the report issued by the independent auditor on these complete financial statements, in line with the disposed in article 25, I of Resolution CVM 23/2021. We also clarify, as also disclosed in Circular No. 01/2022 issued by Ibracon, that the publication of summarized financial statements cannot be accompanied by the publication of the auditor's report on the complete financial statements, issued under NBC TA 700. The publication of an “excerpt of the relevant information from the report” does not coincide with the publication of parts of the report nor does it constitute an opinion on the referenced summarized financial statements.

2.1.7 Relevant aspects to be observed in the review of the Notes to the Financial Statements
and in the evaluation of the other information contained in the audited Financial Statements As informed by the Department of Corporate Relations - SEP, in the results of its actions related to registration requests of listed companies, various requirements related to the disclosure of financial information were identified. Among the requirements informed by SEP, it was possible to identify that the 5 (five) most frequent requirements are related to:
a) deficient disclosure of accounting policies applied to the Company, notably when it is verified that the Company mostly held itself to transcribing or paraphrasing accounting standards, thus without compliance with OCPC 07 (R1); b) deficient disclosure of information on Related Parties, without compliance with CPC 05 (R1), notably regarding the disclosure of rates and terms of loans between related parties; c) absence of disclosure of information on the Relationship with Independent Auditors, contrary to Resolution CVM No. 80/2022 (Annex C – Item 9); d) failures in the disclosure of the reconciliation of non-accounting nature information
Annex Circular-Office No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 36

SECURITY AND EXCHANGE COMMISSION OF BRAZIL
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686 (LAJIDA/EBTIDA or LAJIDA/EBTIDA adjusted) with accounting information, thus without compliance with Resolution CVM No. 156/2022; and e) deficient disclosure of premises in impairment tests, thus without compliance with CPC 01 (R1), mainly regarding the disclosure of discount rates and rates and premises of growth. This information is under the primary responsibility of the management of the companies, with administrators having the duty to diligence on what is pertinent regarding the standards applicable to the preparation of the Financial Statements and the Interim Statements linked to the aforementioned themes, as well as to the orientations contained in OFFICE-CIRCULAR/CVM/SNC/SEP No. 01/2025 (and office circulars of previous years). On the other hand, it is the responsibility of the independent auditor to make efforts in the analysis of the content of that information presented together with the respective audited financial statements, recommending adjustments and improvements necessary, in order to allow a better understanding by the various users and, mainly, their adequacy to the applicable financial reporting structure. Still in this sense, depending on the type, the relevance of the inadequately disclosed information and its possible effects on the degree of understanding by its users of those financial statements, it is up to the auditor to assess, in light of the provision in the independent audit professional standards, the need to cite the fact in their audit report, considering, including, the possibility of issuing a modified opinion. Finally, it is highlighted that, in initial registration requests of listed companies, the auditor will be held responsible for the opinion issued in the respective audit report, as well as for the conduct of the work and audit procedures that served as the basis for their opinion, if there are deviations related to the applicable financial reporting structure and disclosures of information associated with it.

2.2 Audit Standards
2.2.1 Audit Report and Key Audit Matters
After a few years of adaptation to the determinations contained in the NBC TA 701 standard, we understand that its informational objectives have been achieved. However, it is relevant to emphasize that, in order to achieve such objectives, it is essential that the description of the procedures performed by the auditor and the results achieved present relevant informational content for users, not restricting to generic presentations of what was done and vague statements regarding the adequacy of the subject matter as a whole to the financial statements. Regarding the content of the Key Audit Matters section, the SNC understands as important the following improvements upon the preparation of the report
Annex Circular-Office No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 37

COMMISSION OF SECURITIES AND EXCHANGE
7 de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686

audit procedures:

specific audit procedures adopted for the risk under discussion;
information regarding the use of the work of specialists and/or internal auditors;
specific audit procedures related to applicable internal controls, as well as whether, as a result of the application of the procedures performed by the auditor, possible deficiencies in their effectiveness were detected;
any difficulties in applying the prescribed procedures;
changes in the planning of procedures executed, in the scope or depth of audit testing;
whether, during the execution of audit procedures, adjustments by the entity's management were identified, even if not recorded, even if they are not considered material by the auditor.

Additionally, considering the dynamics of the economic and business environment, as well as the particularities of the activities, processes, and systems of the audited entities, it is expected that audit reports be effectively individualized, not being mere repetitions of the main audit matters of the previous year, nor composed of standardized Main Audit Matters (PAMs) established internally by the audit firm, for the firm as a whole or by the sector of activity of the audited entities.

In this regard, with respect to the financial statements of separate estates and the provisions of item VIII, art. 25, of CVM Resolution No. 23/2021, which deals with Main Audit Matters, we remind you that each separate estate is considered an entity that reports information for the purpose of preparing individual financial statements. Therefore, professional standards for independent auditing must be observed when issuing the respective audit report, including NBC TA 701, which deals with the subject.

2.2.2 Preparation of audit reports – modification of opinion

It is common to detect the issuance of some audit (or review) reports of annual and interim financial statements that, in the judgment of the SNC, are out of compliance with the professional standards for independent auditing. Such reports are often related to companies undergoing criminal investigation processes, including those of their directors and managers.

Although we understand that this is a complex theme involving professional judgment, we have verified that some auditors opt to issue their opinion in a manner inconsistent with the guidelines contained in the professional standards of auditing, more precisely, NBC TA 700, NBC TA 705, and NBC TA 706. In this sense, we remind you that the auditor must modify the opinion in their report when:
a) they conclude, based on the audit evidence obtained, that the financial statements as a whole present material misstatements; or b) they are unable to obtain appropriate and sufficient audit evidence to conclude that the financial statements as a whole do not present material misstatements.

Timely, we emphasize that NBC TA 705, the professional standard dealing with modification of opinion, is clear in defining the situations in which modifications are required:

Qualified Opinion
7. The auditor must express a “Qualified Opinion” when:
(a) having obtained appropriate and sufficient audit evidence, they conclude that the misstatements, individually or in aggregate, are material but not pervasive in the financial statements; or (b) it is not possible for them to obtain appropriate and sufficient audit evidence to support their opinion, but they conclude that the possible effects of undetected misstatements on the financial statements, if any, could be material but not pervasive.

Adverse Opinion
8. The auditor must express an “Adverse Opinion” when, having obtained appropriate and sufficient audit evidence, they conclude that the misstatements, individually or in aggregate, are material and pervasive to the financial statements.

Disclaimer of Opinion
9. The auditor must disclaim an opinion when they are unable to obtain appropriate and sufficient audit evidence to support their opinion and they conclude that the possible effects of undetected misstatements on the financial statements, if any, could be material and pervasive.
10. The auditor must disclaim an opinion when, in extremely rare circumstances involving multiple uncertainties, they conclude that, regardless of having obtained appropriate and sufficient audit evidence on each of the uncertainties, it is not possible to express an opinion on the financial statements due to the possible interaction of the uncertainties and their possible cumulative effect on these financial statements.

Still on the subject, it is necessary to remember that CVM Resolution No. 23/2021, in its article 25, item IV, clearly defines the need to measure the impact on the audited financial statements when issuing the respective audit report, in cases of modification of opinion (qualified or adverse), as follows:

Art. 25. In the exercise of its activities within the scope of the securities market, the independent auditor must, additionally:
...
IV - clearly indicate, and by how much, the accounts or subgroups of assets, liabilities, results, and equity that are affected by the adoption of accounting procedures conflicting with the Fundamental Accounting Principles, as well as the effects on mandatory dividends and earnings or loss per share, as applicable, whenever issuing a review report on interim information or an adverse or qualified audit report.

Still on the subject, we remind you that after the issuance of several alert letters by the SNC, and concomitant interaction with Ibracon, the Federal Council of Accounting (CFC) published, in 2021, the Audit Technical Communication (CTA) 30, which standardizes and guides independent auditors on the impacts on auditing, measurement, and assessment arising from these situations. The Technical Communication also guides on the possible reflections in the opinion contained in the audit reports of the financial statements of entities involved in matters related to non-compliance with laws and regulations, illegal acts, or fraud, and therefore must be consulted in the occurrence of such situations.

In complement, it is important to highlight the provisions of NBC TA 240 - Fraud, which establishes as the auditor's objective, among other points, the identification and assessment of risks of material misstatement in the financial statements resulting from fraud, as well as responding adequately to fraud or suspected frauds identified during the audit.

2.2.3 Criteria for sample selection in auditing

NBC TA 500 (R1) – Audit Evidence deals with the auditor's responsibility in defining and executing audit procedures aimed at obtaining appropriate and sufficient audit evidence to support their audit opinion. In this context, the aforementioned standard establishes that, when defining tests of controls and tests of details, the auditor must determine effective means to select the items to be tested.

In this sense, its item A63 clarifies:
An effective test provides appropriate audit evidence to the extent that, considered with other audit evidence obtained or to be obtained, it will be sufficient for the auditor's purposes. When selecting items to be tested, item 7 requires the auditor to determine the relevance and reliability of the information to be used as audit evidence; another aspect of effectiveness (sufficiency) is an important consideration in the selection of items to be tested. The means available to the auditor for selecting items to be tested are:
(a) selection of all items (examination of 100%); (b) selection of specific items; and (c) audit sampling.

The application of any of these means or a combination of them may be appropriate depending on the specific circumstances, for example, the risks of material misstatement related to the assertion being tested, and the practicality and efficiency of the different means.

It is emphasized that tests performed on a selection of specific items do not provide audit evidence regarding the rest of the population. Thus, the audit conclusion obtained is limited to the selected items, which implies additional audit procedures for the rest of the population.

When the selection is by sampling, the auditor must fully observe the requirements of NBC TA 530 – Sampling in Auditing. The sample must be defined in consonance with the purpose of the procedure and with the characteristics of the population (item 6), possess sufficient size to reduce sampling risk to an acceptable level (item 7), and be selected in such a way that all units of the population have an equal probability of inclusion, avoiding bias (item 8). Non-representative samples break the relationship between sample and population and prevent the results obtained from providing a reasonable basis for conclusion on the tested universe (item 15(b)).

On this occasion, it is important to remember that item A12 of NBC TA 530 – “Sampling in Auditing” guides that, as the purpose of sampling is to provide a reasonable basis for the auditor to conclude regarding the population from which the sample is selected, it is important that the auditor selects a representative sample, in order to avoid bias through the choice of sample items that have characteristics typical of the population.

For this purpose, the audit population must correspond to the integral set of items that make up the account balance or class of transactions subject to the test. The application of procedures to less than 100% of this population through sampling requires the proper definition of the sampling unit. This unit must be consistent with the accounting unit adopted by the entity and with the form of measurement of the balance in the population. The selection of items at a level different from that in which the balance is recognized accounting-wise compromises the correspondence between sample and population and, consequently, the representativeness of the results.

For example, in substantive tests on the balance of investment properties of a real estate investment fund, the auditor must verify what is the accounting unit adopted (building, block, set, or autonomous unit), which, as a rule, must be aligned with the respective real estate registration and the level of aggregation considered in the fair value appraisal report, as the value of the real estate complex is not equivalent to the mere sum of the autonomous units that compose it. Thus, if the fund accounts for its assets by building, it is not appropriate to apply procedures only on specific internal units, as these sub-units do not correspond to the sampling unit defined in the population. In this circumstance, the test ceases to be representative of the accounted balance, increases the sampling risk, and harms the formation of a reasonable basis for the auditor's conclusion.

Finally, the size and composition of the sample cannot be considered representative based solely on a generic statement of professional judgment. The auditor must clearly, technically, and specifically document the criteria for defining the population, the sampling unit, the selection method, the sample size, as well as the technical and statistical foundations that support, respectively, their sufficiency and representativeness. Generic or merely conclusive references do not meet the evidence and documentation requirements of the applicable professional standards.

2.2.4 Professional judgment and transparency in the audit report

It is essential for the fulfillment of the role of the independent auditor that their opinion be expressed clearly through a written report. This involves, among other information, transparency in the communication of main audit matters, the preparation of emphasis paragraphs, when applicable, and the description of the matters that gave rise to the modification of opinion. These items require additional attention from the auditor, considering the needs of users of the financial statements, and must be written in a way that allows users to fully understand the information transmitted.

As described in NBC TA 701, the communication of main audit matters aims to make the audit report more informative, providing greater transparency about the audit performed and providing additional information to users, to assist them in understanding the matters that, according to the auditor's professional judgment, were the most important in the audit of the financial statements of the current period. In addition, it can assist in understanding the entity and the themes involving significant management judgment.

In complement, NBC TA 706, in items 8, A1, and A2, defines that, if the auditor considers it necessary to draw users' attention to a matter presented or disclosed in the financial statements that, in their judgment, is fundamental for understanding, they must include an emphasis paragraph in their report. This is valid provided that, when NBC TA 701 applies, the matter has not been determined as a Main Audit Matter. If the matter is defined as a Main Audit Matter and the auditor considers it relevant to draw more attention to its relative importance, there are other ways to highlight it, such as (i) presenting it more prominently in the “Main Audit Matters” section, or (ii) inserting additional information about the theme in the description of this main audit matter. In this way, the provisions of the standard will be met, conferring greater transparency and significant informational content for users.

For the sensitive themes identified during audit work, which have been the object of professional judgment, both by preparers of financial statements and by independent auditors, the technical areas of CVM recommend adopting the following steps, extracted from a conceptual framework for professional judgment, also reported in Circular Letter CVM/SNC/SEP 01/23:

Elucidate the problem and the informational objectives to be achieved;
Consider the alternatives and available choices;
Gather and evaluate the necessary information;
Reach a conclusion; and
Articulate and document the rationale for the decision.

It is important to avoid “mental traps” in the professional judgment process, which can arise from informational constraints, influences, preconceived ideas, and biases. Teams of experienced professionals in the subject help to mitigate these risks, but do not exempt the auditor from their responsibility for their independent opinion and the application of the requirements of the applicable professional standards. The auditor must be attentive to signs of management bias, as described in item 2.2.6 of this Circular Letter. To achieve the intended degree of transparency, such communications must not be standardized; they must be drafted specifically for the subject and for the entity to which they refer.

Finally, item A30 of NBC TA 200 (R1) warns that professional judgment needs to be adequately documented and must not be used as justification for decisions that, otherwise, are not supported by the facts and circumstances of the work nor by appropriate and sufficient audit evidence.

Finally, professional judgment must not be used as a means to evade the execution of minimum audit procedures prescribed in standards, and must be exercised by the auditor with due professional skepticism and ethical conduct.

2.2.5 Immaterial misstatements with significant potential to become material in the future

As a basis for the auditor's opinion, NBC TAs require obtaining reasonable assurance that the financial statements as a whole are free from material misstatement, regardless of whether caused by fraud or error.

In this context, the concept of materiality is applied by the auditor in planning, executing the audit, and evaluating the effect of identified misstatements on the financial statements. In general, misstatements, including omissions, are considered material if it is reasonable to expect that they may influence, individually or jointly, the economic decisions of users taken based on the financial statements.

Judgments about materiality are made in light of the circumstances and the needs of users of the financial statements and are affected by both the magnitude and the nature of the misstatements, or by the combination of both. Thus, when evaluating the impact of identified misstatements, the auditor must consider not only their current value but also their potential for growth or recurrence in the long term, that is, their potential to become material in the future.

The materiality defined in planning does not imply that misstatements below this threshold are automatically immaterial. The auditor must evaluate them cumulatively regarding magnitude, nature, and circumstances (NBC TA 320, items 2 and 6).

Misstatements can be material by their nature—for example, when they affect significant line items, critical estimates, performance indicators, or distribution bases—or by the circumstances of their occurrence, such as recurrence, origin in prior periods, or regulatory or contractual repercussions.

Upon detecting non-trivial misstatements, the definition of materiality must be reviewed in light of the entity's actual results (NBC TA 450, item 10). The auditor must identify, qualify, accumulate, and evaluate all misstatements not clearly trivial, including those from prior periods, classifying them, when applicable, as factual, judgmental, or projected, and conclude whether they are material, individually or in aggregate, to the financial statements as a whole. Differences exceeding the triviality threshold require documented and reasoned critical evaluation regarding their acceptability and cumulative effects.

Identified misstatements must be communicated timely to management at an appropriate level, with a request for correction and obtaining reasons for any non-correction, as well as communicated to those responsible for governance, according to NBC TA 260. The auditor must document the professional judgment exercised—including the review of materiality and the qualitative evaluation of misstatements—ensuring appropriate and sufficient evidence and adequate documentation, in accordance with NBC TAs 500 and 230.

The absence of analysis and documentation of the qualitative aspects of misstatements, including their potential to become material in the future, compromises the exercise of professional skepticism and the formation of a reasonable basis for the auditor's conclusion on whether the financial statements are free from material misstatement.

2.2.6 Audit of accounting estimates and related disclosures - NBC TA 540 (R2)

We have verified, in recent years, recurrent failures by auditors in meeting the requirements of NBC TA 540 (R1) / NBC TA 540 (R2), in the audit of accounting estimates, including, but not limited to, the audit of impairment tests, fair value, and related disclosures.

Thus, follow our considerations on the main non-compliances verified:

as part of the validation of the calculation methodology used, it is expected that the auditor, among other procedures, verify the comparison of historically calculated estimates with what was actually realized, analyzing the reasons for the discrepancies found, and also whether the methodology needs any adjustment to be used again in the audited period;
when planning the use of independent calculations (including sensitivity analyses), the auditor must establish an expectation, formalizing in their working papers the acceptable limits of difference in relation to management's calculations and what their objective is with that work;
it is essential that the auditor validate the premises and data (including historical data) used for the calculation of the estimate;

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 38

COMMISSION OF SECURITIES AND EXCHANGE
7 de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 39

COMMISSION OF SECURITIES AND EXCHANGE
7 de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 40

COMMISSION OF SECURITIES AND EXCHANGE
7 de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 41

COMMISSION OF SECURITIES AND EXCHANGE
7 de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 42

COMMISSION OF SECURITIES AND EXCHANGE
7 de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 43

COMMISSION OF SECURITIES AND EXCHANGE
7 de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 44

COMMISSION OF SECURITIES AND EXCHANGE
7 de Setembro Street, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 45

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686

it is the auditor's responsibility to verify whether the required disclosures are being made, requesting adjustments from management as necessary;
evaluate possible impacts on their audit report or the inclusion of the subject in the detailed report, where applicable;
the value of the estimate reflected in the financial statements (appraisal reports, mainly) having been calculated by independent experts hired by the audit client does not exempt the auditor from the procedures described above, nor from the other requirements of auditing standards, including the verification and review of the reasonableness of premises and projections used, as well as full adherence to the relevant accounting standards; and
management's judgment must present neutrality, and the auditor must evaluate possible biases of management.

2.2.7 Internal Quality Control - implementation of NBC PA 01 - Quality Management for Firms (Legal and Natural Persons) of Independent Auditors (corresponding to International Standard on Quality Management – ISQM 1)

In 2021, the Federal Council of Accountancy (CFC) altered the standard dealing with the quality control process of audit firms (NBC PA 01), previously denominated Quality Control for Firms (Legal and Natural Persons) of Independent Auditors (corresponding to International Standards on Quality Control – ISQC 1), giving new wording to the standard which became denominated NBC PA 01 – Quality Management for Firms (Legal and Natural Persons) of Independent Auditors (corresponding to International Standard on Quality Management – ISQM 1).

NBC PA 01 (ISQM 1) deals with the responsibilities of the audit firm for the development (design), implementation, and operation of a quality management system for audits and for reviews of financial statements, as well as for other assurance work and related services. As with its predecessor, NBC PA 01 (ISQM 1) applies to audit and review work of financial statements, other assurance work, and related services, performed in accordance with NBC TA, NBC TR, NBC TO, and NBC TSC standards.

NBC PA 01 establishes that the adoption of the quality management system must be done in two stages. The first, which should have been concluded by the end of 2022, with the planning and implementation of quality management systems; and the second with the evaluation of the quality management system – which should be carried out within one year from December 31, 2022, that is, by December 31, 2023.

In this sense, we highlight that the execution of the activities proposed in the standard, as well as compliance with its schedule by auditors registered with CVM is mandatory, with each stage subject to specific procedures by this agency for verification of compliance. It is important to remember that non-compliance with the aforementioned standard, in those terms, may lead to the adoption of administrative sanctions by this Superintendency regarding auditors who incur in irregularity, given the provisions of articles 20 and 32 (§§ 1, 2, and 3) of CVM Resolution No. 23/21.

Still on the subject, it is important to establish that the quality reviewer of audit work of financial statements, review of interim information, or other applicable assurance work, whether he is an individual internal to the audit firm or an external professional hired by it (NBC PA 02), as well as the person responsible for such work and signatory of the respective reports, must be registered with CVM as a technical manager authorized to issue and sign audit and review reports, on behalf of the respective audit firm, within the scope of the securities market.

2.2.7.1 Acceptance and continuity of clients and specific work: minimum procedures and PLD/FTP check

The acceptance of new clients and new work, as well as the continuity of existing professional relationships, must observe a formal, documented, and risk-proportional process, in line with the audit firm's quality management system and with the responsibilities of the engagement partner. In this context, it is not acceptable that the acceptance or continuity of the client be based solely on commercial assessment or prior informal knowledge of its managers, controllers, or representatives. The auditor must obtain and evaluate, in advance, sufficient information to conclude, at a minimum, that: (i) it has the technical competence, time, and appropriate resources to perform the work; (ii) it can comply with applicable ethical requirements, including those related to independence; and (iii) it has not identified elements that compromise the integrity of the client or the work to be contracted.

Within the scope of the securities market, this prior assessment must necessarily contemplate, expressly, PLD/FTP check procedures, compatible with the nature, size, complexity, control structure, and risk profile of the client and the intended service. Such diligence must consider, among other relevant factors: the identification of the contracting party and its representatives; the verification of the corporate structure and control chain; the identification of the beneficial owner, where applicable and possible; the eventual condition of politically exposed person; the existence of jurisdictions, structures, or operations that elevate risk; and the economic coherence between the client's profile, its activities, and the professional work requested. The approach must be risk-based, avoiding both the adoption of merely formal procedures and the omission of minimum diligence in situations of greater exposure.

Specifically regarding professionals and accounting organizations subject to the obligations provided for in the legislation and regulation applicable to the subject, we remind you that CFC Resolution No. 1.721/2024, currently in force, requires the maintenance of an updated register of contracting parties and their representatives, contemplating, as the case may be, identification of partners, managers, attorneys, eventual classification as politically exposed person, and identification of the beneficial owner, when possible. The aforementioned standard applies, inclusive, to audit services of an accounting nature related to the operations described therein.

Thus, it is expected that the auditor maintains, in its working papers and internal records of acceptance and continuity, sufficient documentation to demonstrate: (a) who approved the acceptance or continuity; (b) what information was obtained and evaluated; (c) what PLD/FTP diligence was performed; (d) what risks were identified; (e) what safeguards, restrictions, or conditions were established; and (f) the conclusion reached, including regarding the viability of acceptance, continuity, refusal, or resignation. The generic record that "no restrictions were identified" or that "the client is known to the firm" does not meet the requirement for adequate documentation.

The analysis of client integrity must encompass not only the contracting legal entity, but also, to the extent applicable, its controllers, managers, principal related parties, and, when relevant, the apparent economic origin of operations or structures that bear relation to the object of the work. Warning signs, inconsistencies in registration, unjustified refusal to provide information, use of excessively complex or opaque structures, incompatibility between declared activity and observed operations, or any other factor that aggravates the risk of improper use of the firm's professional services, must lead to deepening of diligence, internal escalation, and reevaluation of the acceptability of the professional relationship.

If, in the acceptance or continuity process, situations are identified that indicate unmitigable risk, absence of minimum transparency, impossibility of adequate identification of the contracting party or essential elements of its structure, or circumstances that may compromise the integrity of the work, the auditor must evaluate, in a reasoned manner, the non-acceptance, discontinuation, or resignation from the work, as the case may be. When there are facts that, under the legislation and regulation applicable, require communication to competent authorities, the professional or accounting organization must strictly observe the relevant channels, deadlines, and duties of confidentiality, without prejudice to the preservation of documentation supporting the decision taken.

We also emphasize that the continuity assessment is not exhausted in the initial acceptance of the client. It must be updated periodically and, especially, when there is a relevant change in corporate control, management, nature of operations, scope of contracted services, exposure to higher-risk jurisdictions, transactional profile, investigations or relevant negative news, or in the perception of risk arising from the execution of the work. In these cases, the Audit Firm must reevaluate, with professional skepticism, whether the premises of integrity, independence, operational capacity, and adherence to PLD/FTP requirements remain met.

SNC/GNA highlights that weaknesses in client acceptance and continuity procedures, especially when associated with the absence of minimum PLD/FTP diligence, compromise the effectiveness of the firm's quality management system, the adequate assessment of work risk, and the very credibility of the independent auditor's performance in the securities market. It is therefore expected that such procedures integrate effectively — and not merely formally — the governance of audit firms and their respective working papers.

2.2.8 Internal Quality Control - recommendations on the performance of the work quality reviewer

In the context of implementing the quality management system, NBC PA 02 establishes that work quality review is an objective assessment of the significant judgments made by the work team and the conclusions reached to support the report. The reviewer, who must not be a member of the work team, acts on behalf of the audit firm to ensure that issued reports are appropriate to the circumstances. We emphasize that, for work within the scope of the securities market, both the engagement partner and the quality reviewer must be duly registered with CVM as technical managers.

To fulfill its role, the reviewer must read and obtain an understanding of the information communicated by the team regarding the nature and circumstances of the work and the entity. In addition, it must consider the firm's information about its monitoring and remediation process, focusing on identified deficiencies that may affect areas involving significant judgments. This understanding serves as the basis for mandatory discussions with the engagement partner on significant issues arising in planning, execution, and report preparation.

The standard requires that the reviewer evaluate the basis of significant judgments made, including the exercise of professional skepticism by the work team. The reviewer must review selected documentation to verify if it supports the conclusions reached and if these are appropriate. Additionally, it must evaluate the engagement partner's determination regarding compliance with ethical requirements of independence, as well as whether the partner's involvement was sufficient and appropriate throughout the audit process.

The reviewer's role also encompasses the evaluation of consultations made on difficult, controversial, or opinion-differing subjects. It must review the financial statements and the respective auditor's report, considering whether the presentation of issues related to significant judgments is consistent with its understanding of the work. In review work of interim information or other assurance services, the reviewer must perform similar assessments on the report and the subject information.

Whenever the reviewer has concerns that judgments or conclusions are not appropriate, it must notify the engagement partner. If these points are not resolved satisfactorily, the reviewer is obliged to notify the appropriate individuals in the firm that the quality review cannot be completed. This communication is an essential safeguard, as the engagement partner is prohibited from dating the audit report until receiving formal notification that the quality review has been completed.

Concluding the process, the reviewer must determine if all requirements of NBC PA 02 have been met and notify the engagement partner of the completion of the procedure. The entire review must be documented sufficiently to allow an experienced auditor to understand the nature, timing, and extent of procedures performed, as well as the conclusions reached. Compliance with these requirements is fundamental to ensure the soundness of audit work and the protection of investors in the capital market.

However, we must highlight that, from the accumulated experience in our supervision and inspection processes of audit procedures, it is extremely rare, to say nonexistent, for us to identify notifications, recommendations, comments, requests for deepening the formalization of evidence, or adjustments of any nature in the conduct of work, issuance of opinion, or audit documentation, from the work quality reviewers.

With such factual bases, it is possible to deduce that, currently, the performance of the work quality reviewer within audit firms tends to be merely formal. The action of this reviewer seems to be limited to the recording of "signatures" and review passwords without the inherent professional skepticism, expected and necessary for its function, basing its review on the professional judgment of the technical manager who conducted the work.

Acting in this way, the reviewer does not effectively and appropriately exercise its own professional judgment, being restricted to a function of simple formalization of a procedure required by standards, without any increment in the quality of the work under its review. In this context, besides the eventual non-compliance with normative obligations subject to administrative liability, opportunities are lost and efforts are wasted, both by the reviewer and the reviewed, to effectively promote the improvement of the quality of work and independent audit services in the securities market.

2.2.9 Disclaimer of Opinion and Evaluation of Resignation from Audit Work

The repeated issuance of disclaimers of opinion in consecutive years is not compatible with the logic and guidelines established by NBC TA 705. In accordance with item 9 of the aforementioned standard, a disclaimer of opinion is applicable when the auditor is unable to obtain appropriate and sufficient audit evidence and concludes that the possible effects of undetected misstatements could be material and pervasive.

When this impossibility arises from a limitation imposed by management, the standard itself establishes a set of measures that the auditor must adopt. According to item 11 of NBC TA 705, upon learning of a limitation that may result in a modified opinion or disclaimer, the auditor must request that management remove such limitation.

If management refuses to remove the limitation, item 12 determines that the auditor communicate the fact to those charged with governance and evaluate the possibility of performing alternative procedures to obtain appropriate and sufficient audit evidence.

If the impossibility of obtaining evidence persists, item 13(b) of the standard establishes that, when the possible effects of undetected misstatements are material and pervasive, the auditor must resign from the audit work, when practicable and permitted by applicable laws or regulations. Only in situations where resignation is not possible, the auditor shall disclaim an opinion on the financial statements.

Item A13 reinforces this guideline by clarifying that, in the face of scope limitation imposed by management, resignation from the audit work constitutes an alternative provided for by the standard, especially when the limitation compromises the adequate execution of the work.

Thus, the normative framework shows that the disclaimer of opinion was not conceived as a permanent or repeated solution for the same entity, but as an exceptional measure in the face of specific circumstances. When the conditions that prevent the obtaining of audit evidence persist over time, in light of NBC TA 705, the auditor must evaluate the viability of resigning from the work, in order to preserve the integrity of the audit process and the proper functioning of the financial reporting environment.

Thus, the issuance of a disclaimer of opinion for successive years, without resolution of scope limitations or reconsideration of the continuity of the professional relationship, contradicts what is established in NBC TA 705, which expressly provides for resignation from the audit work as an appropriate measure in the face of persistence of limitations that make obtaining sufficient and appropriate audit evidence unfeasible.

2.3 Investment Funds

2.3.1 Audit of financial statements of Credit Rights Funds - FIDC, Real Estate Receivables Certificates - CRI, and Agricultural Receivables Certificates - CRA: existence, backing, and measurement of credit rights and related assets.

CIRCULAR LETTER/CVM/SIN/SNC/No. 01/2012 guides independent auditors acting in FIDC regarding certain procedures that must be executed regarding the credit rights held by the funds, including regarding their classification, existence, and adequate measurement. We reinforce that such guidelines remain relevant in the current context and must be observed with special attention also in work related to separate estates of CRI and CRA, to the extent applicable to them.

In this context, we highlight that the verification of the existence of credit rights and their respective related assets cannot be limited to the analysis of merely formal or accessory documents. The backing documentation must be able to demonstrate, consistently, the origin, economic substance, enforceability, and essential elements of the underlying obligational relationship of the credit. Thus, the mere presentation of a sales invoice, accompanied by complementary documentation that proves the effective constitution of the credit and the debtor's obligation, should not be considered, in isolation, sufficient evidence of the existence of the credit right. The auditor must, with professional skepticism, evaluate the coherence, integrity, and sufficiency of the supporting documentation, as well as the adherence of the asset to the investment policy and applicable regulation.

Beyond the verification of backing, it is expected that independent auditors obtain adequate understanding and critically evaluate the controls implemented by the manager and other service providers of the fund regarding the continuous monitoring of portfolio risk, including regarding the debtors' payment capacity, monitoring of defaults, renegotiations, buybacks, subordination recompositions, concentration by debtor, assignor, debtor, or economic group, and the timeliness of identifying events that may affect the recoverable value of credits. The mere existence of contractual credit enhancement mechanisms, risk retention by the assignor, or subordination does not, by itself, rule out the need for substantive assessment of loss risk and adequate measurement of credit rights.

Regarding the provision for losses on credit rights, we reiterate the importance of observing the guidelines contained in CIRCULAR LETTER/CVM/SIN/SNC/No. 02/2015. The applicable model is the expected loss model, aimed at estimating the amount of future cash flows that the fund's management expects not to realize. In this assessment, factors to be considered, among others, include the debtor's payment capacity, the quality and liquidity of guarantees,

Anexo Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 46

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686

Anexo Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 47

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686

Anexo Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 48

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686

Anexo Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 49

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686

Anexo Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 50

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686

Anexo Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 51

COMMISSION OF SECURITIES AND EXCHANGE COMMISSION Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP Code: 20050-901 – Brazil - Tel.: (21) 3554-8686

Anexo Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 52

COMMISSION OF SECURITIES AND EXCHANGE
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 the historical performance of the portfolio, the events of default, renegotiation or restructuring, and any new facts that affect the expectation of recovery of the assets. The auditor must critically evaluate the methodology adopted, the assumptions used, the consistency of the input data, and the reasonableness of the conclusions reached, including when management sustains the non-formation or reduced formation of provisions based on subordination or risk retention mechanisms.

Specific attention must also be given to assets or values related to lawsuits in the context of FIDCs. In these cases, the auditor must evaluate, in light of the applicable accounting standards, whether the requirements for accounting recognition are present and what the appropriate measurement criterion is. If the invoked right falls under the concept of a contingent asset, it should not be recognized in the financial statements, in accordance with CPC 25, with only appropriate disclosure being admitted, when applicable. Thus, the accounting recognition of an expectation of judicial or extrajudicial gain is not acceptable without meeting the requirements of the applicable accounting structure, and the auditor must critically evaluate the classification attributed by management and its effects on the financial statements.

2.3.2 Evaluation of qualification as an investment entity – Investment Funds in Participations
It is part of the auditor's obligations to confirm that the audited entity that reports as an investment entity actually qualifies as such, in accordance with the applicable accounting standards.

However, it was verified, throughout 2022, 2023, and 2024, audit work on investment funds in participations (FIP), where the auditor did not perform audit procedures to confirm the qualification of the audited fund as an investment entity, in accordance with the provisions of Articles 4 and 5 of CVM Instruction No. 579/2016.

It is important to clarify that said Article 4 sets forth four conditions for the qualification of a FIP as an investment entity, which must be met cumulatively. In this regard, we draw attention to its item III, which requires that the fund substantially measure and evaluate the performance of its investments, for management model purposes, based on fair value. We also remind, in line with what is described in item B85-F of CPC 36 (R3), that, for qualification as an investment entity, the entity/fund must not hold its investments indefinitely.

It is necessary for the investment entity to have clearly defined an exit strategy, documenting how it plans to realize the capital appreciation of all its investments, including a concrete deadline for divesting said assets.

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 53

COMMISSION OF SECURITIES AND EXCHANGE
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686
2.3.3 Evaluation of classification, existence, and measurement of financial assets (REITs and FIP-EI)
In the case of FIP-EI, the independent auditor must pay attention not only to the correct accounting classification of financial assets but also to their existence and measurement in conformity with the applicable financial reporting structure.

Considering that Normative Annex IV of CVM Resolution No. 175 disciplines the assets eligible for acquisition by classes of FIP shares and that the measurement of these assets, in many cases, involves a high degree of judgment, low liquidity, and dependence on information produced by the investees themselves or by third parties contracted, it is essential that the auditor obtains appropriate and sufficient evidence regarding the nature of the instrument, ownership, associated economic and political rights, relevant contractual conditions, and the investment's adherence to the fund's policy and applicable regulation.

In this context, it is not sufficient for the auditor to limit themselves to the existence of formal documents of subscription, acquisition, or transfer. It is necessary to evaluate, as appropriate, the effective existence of the financial asset or the underlying corporate participation, the consistency of corporate and contractual documents, the compatibility between accounting records and supporting documentation, the existence of any encumbrances, restrictions, suspensive or resolutive conditions, as well as the adequate formalization of instruments such as shares, convertible debentures, commercial notes, AFAC, loans, and other titles or securities representing credit or participation.

Regarding the measurement/pricing of these assets, the auditor must critically evaluate the methodology adopted by management, the consistency with the applicable accounting standards, the coherence of the data and premises used, and the reasonableness of the conclusions reached. Whenever applicable, this analysis should include, among other aspects, the business model, the characteristics of contractual cash flows, the existence of market events or observable transactions, the use of multiples, discounted cash flows, appraisals or independent valuations, as well as the sensitivity of the assigned value to the premises adopted. The use of third-party appraisals or valuations does not absolve the auditor of the responsibility to critically test the relevant assumptions and the adequacy of the recognized value in the financial statements.

In structures of greater complexity, low liquidity, or with a pronounced degree of subjectivity, it is expected that the auditor robustly documents the procedures performed, the evidence obtained, and the rationale for their conclusion, including regarding the need for the involvement of specialists, the performance of independent analyses, or the expansion of the scope of tests. The absence of adequate procedures regarding the existence and measurement of financial assets directly compromises the reliability of the financial statements of FIP-EI and may result in relevant distortions regarding shareholders' equity, the share value, and the associated disclosures.

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 54

COMMISSION OF SECURITIES AND EXCHANGE
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686
2.3.4 Weaknesses in proving ownership of real estate assets and the need for updated RGI
Within the scope of supervisory activities, the SNC/GNA has identified deficiencies in obtaining appropriate and sufficient audit evidence to support the assertion of rights and obligations regarding investment properties. It was observed that some auditors have based their opinion on the ownership of real estate assets on outdated registrations or accessory documents, such as IPTU guides and lease contracts, which compromises the probative force necessary for materially relevant assets. We emphasize that, in accordance with NBC TA 500 (R1) 21, the reliability of evidence is affected by its origin and nature, with external and independent evidence being more reliable than that obtained from internal sources.

From the perspective of the Brazilian legal system, the proof of real estate ownership finds direct foundation in the Civil Code 22 and the Public Records Law (Law No. 6.015/1973) 23, which establish that ownership is only constituted and proven through the registration of the title in the General Real Estate Registry (RGI). The updated registration is the only document endowed with public faith and erga omnes opposability, being the "faithful portrait" of the legal situation of the asset. Accessory documents or private declarations do not have legal force to remedy the absence of registration, which is the constitutive act of the real right.

The consolidated jurisprudence of the Superior Courts, notably the STJ 24, reinforces that the acquisition of real estate property is only perfected with registration, and that unregistered contractual instruments generate only obligatory rights, not effecting the transfer of ownership. The principle of concentration of acts in the registration requires that any encumbrance, lien, attachment, or alienation be reflected in the RGI to have validity against third parties. Thus, the absence of an updated certificate prevents the auditor from verifying the existence of relevant legal facts that occurred during the period, such as unavailability or judicial decisions.

Although the analysis of lease contracts and cash flows is useful to validate the economic existence and measurement of the asset, such elements are not sufficient to attest to the nature and extent of real rights over the asset (e.g., ownership and possession), as well as the absence of real encumbrances on the reporting date. Exclusive dependence on indirect evidence constitutes a substantive limitation to the assurance process. Therefore, the auditor must design procedures that include the obtaining of independent and recent documentation to mitigate the risk of material misstatement.

21 NBC TA 500 (R1), items 4 and A35.
22 Law 10.406/2002 Art. 1.227, 1.245 and 1.247 sole paragraph.
23 Law No. 6.015/1973 Art. 172.
24 Special Appeal No. 2.141.417/SC – Rel. Min. Antônio Carlos Ferreira; Special Appeal 1.743.088/PR – Third Chamber – Rel. Min. Marco Aurélio Bellizze; principle of concentration of acts in the registration (modern jurisprudence of State Courts and STJ).

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 55

COMMISSION OF SECURITIES AND EXCHANGE
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 relevant in accounts of such materiality.

Additionally, it is necessary to clarify that the obtaining of a Management Representation Letter, in accordance with NBC TA 580 (R1) 25, is necessary evidence, but does not fully meet the sufficiency requirements for the assertion of rights and obligations when primary external evidence (RGI) is not obtained. The formal representation reinforces management's declaration but does not eliminate the material audit risk arising from the lack of registration updates. The auditor must exercise professional skepticism, seeking independent sources to validate the information provided by the entity.

In light of the above, we advise that independent auditors ensure the custody and inclusion, in their working papers, of updated and valid RGI certificates for all relevant real estate assets of the audited entities. The failure to document this primary evidence constitutes a violation of professional standards, notably NBC TA 500 (R1) 26 and NBC TA 230 27, as well as a violation of the documentary support maintenance obligations provided for in CVM Resolution No. 23/2021 28. The compliance of the audit process requires that legal ownership be proven by means that offer the legal security required by the capital market.

2.4 Sustainability
2.4.1 CVM RESOLUTION NO. 193, OF OCTOBER 20, 2023 - preparation and disclosure of the report on financial information related to sustainability, based on the international standard issued by the International Sustainability Standards Board - ISSB.

CVM Resolution No. 193/23, and its amendments promoted by CVM Resolution No. 219, of October 29, 2024, CVM Resolution No. 227, of March 31, 2025, and CVM Resolution No. 244, of May 29, 2026, deals with the preparation and disclosure of the report on financial information related to sustainability.

With the revocation of the obligation to prepare and disclose the report on financial information related to sustainability, promoted by CVM Resolution No. 244, of May 29, 2026, the entity that chooses to publish such information must do so for at least three consecutive fiscal years and explicitly and unreservedly declare adherence to the technical pronouncements issued by the Brazilian Sustainability Pronouncements Committee – CBPS, which internalize the international standards IFRS S1 and IFRS S2, issued by the International Sustainability Standards Board – ISSB, in accordance with CVM Resolutions No. 217 and No. 218, both of October 29, 2024.

On the other hand, if the publicly held company chooses not to publish the report on financial information related to sustainability, it must justify the option through a market communication, disclosed by the date of filing the annual financial statements with the CVM, describing the Management's reasons for its choice.

The currently voluntary regime was preceded by a period of voluntary adoption, applicable to fiscal years starting on or after January 1, 2024, and those starting in the year 2025, optional for publicly held companies, investment funds, and securitization companies to prepare and disclose the report on financial information related to sustainability, observing the provisions of CVM Resolution No. 193/23.

During the voluntary adoption period, if the entity opted for the preparation and disclosure of the report in the manner established by the standard, it should use the financial information disclosure standards related to sustainability, observing the internalization of these standards in the Brazilian legal order through the CBPS Technical Pronouncements No. 01 – General Requirements for Disclosure of Financial Information Related to Sustainability and No. 02 – Disclosures Related to Climate, which must be applied jointly.

The aforementioned CVM Resolution No. 193/23 further determines that entities must archive the report on financial information related to sustainability through an electronic system available on the CVM's website on the world wide web, observing the following deadlines:

in the first fiscal year of archiving: on the same date of delivery of the Reference Form – FRE; and
from the second fiscal year of archiving: within three months counted from the end of the fiscal year or on the same date of sending the financial statements, whichever occurs first.

The report on financial information related to sustainability must be subject to assurance by an independent auditor registered with the CVM, in accordance with the standards issued by the Federal Accounting Council – CFC, observing that those issued for information related up to the fiscal year of 2025 must receive limited assurance; and for those issued for information related to fiscal years starting on or after January 1, 2026, a reasonable assurance must be issued.

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 57

COMMISSION OF SECURITIES AND EXCHANGE
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686
2.4.2 Assurance of the Report on Financial Information Related to Sustainability – Normative and Application Aspects.

Entities that choose to disclose the report on financial information related to sustainability, relating to fiscal years starting on or after January 1, 2026, must obtain reasonable assurance, to be issued by an independent auditor registered with the CVM, in accordance with the standards issued by the Federal Accounting Council – CFC, in accordance with CVM Resolution No. 193, of October 20, 2023, and its subsequent amendments, especially CVM Resolution No. 244, of May 29, 2026.

It is observed that there are still reports relating to the fiscal year of 2025, whose disclosures may occur throughout 2026 and which remain subject to the requirement of limited assurance.

The Brazilian Accounting Standard regarding sustainability information assurance engagements (NBC TA 5000 – Assurance of Sustainability Reports, Integrated Reports, and related), issued by the Federal Accounting Council, is applicable to sustainability information assurance engagements relating to periods starting on or after January 1, 2027, with early application admitted, as established in item 15 of NBC TA 5000.

Until NBC TA 5000 enters into force, assurance engagements, both limited and reasonable, must fully follow the requirements of NBC TO 3000 – Assurance Engagements Other Than Audits and Reviews, with early application of NBC TA 5000 permitted. Thus, this transitional rule applies to assurance engagements relating to the fiscal year of 2025, subject to limited assurance, and to the fiscal year of 2026, subject to reasonable assurance. In the event of non-early adoption of NBC TA 5000, the engagements conducted based on NBC TO 3000 must observe, in a compatible and integrated manner, the provisions of CVM Resolution No. 193/23 and CVM Resolutions No. 217/24 and No. 218/24.

In this context, the assurance of financial information related to sustainability, regardless of its level, presupposes the evaluation of the report on financial information related to sustainability in its entirety, encompassing the complete set of disclosures required by the referenced technical sustainability standards. Thus, audit work that is limited to verifying isolated information or sections of the report cannot be characterized as work to assure financial information on sustainability. The difference between reasonable and limited assurance lies in the level of assurance achieved, impacting the extent of procedures applied, and not in the scope of adherence to the requirements of CVM Resolutions No. 217/24 and No. 218/24. It is emphasized that CVM Resolution No. 193/23 does not provide for the discretionary delimitation of the scope of assurance, and the work must cover, in a consistent and comprehensive manner, the compliance of the report with the applicable normative requirements.

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 58

COMMISSION OF SECURITIES AND EXCHANGE
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – CEP: 20050-901 – Brazil - Tel.: (21) 3554-8686 3 OTHER RELEVANT TOPICS
3.1 Digital Protocol
The objective of the Digital Protocol system is to allow the complete automation of the flow of receipt, distribution, and routing of documents received by the Authority, which are not covered by INFOAUDI, making this service more agile and efficient.

Independent auditors may perform the protocol directly with the Audit Standards Management, which may redirect the request in case of errors.

Among the benefits of automating this service are the reduction in document delivery time and the increase in transparency in this routing, as the auditor can follow it from start to finish of their request. We highlight that documents must be preceded by an introductory letter signed by the representative of the audit firm, describing the objective of the documented protocol.

Documents delivered in person or received via Mail will continue to be handled by the area responsible for receiving these documents, which will register and digitize them in the new Digital Protocol, provided they do not refer to processes/operations handled via INFOAUDI.

The Digital Protocol does not exclude the other CVM service channels, such as, for example, Public Hearings, Process Review, CVMWEB, among others. On the CVM portal, on the SERVICE page, the auditor can consult which channel is most appropriate for their request. However, presentation of documents, requests for information, and inquiries of any kind will no longer be accepted via email or by phone, and under no circumstances will requests/documentation inherent to INFOAUDI be received.

We reinforce that to use the new Digital Protocol, the independent auditor must access the Federal Government Service Portal (https://www.gov.br/ptbr/servicos/protocolar-documentos-junto-a-cvm) and register. For more information, access (https://www.gov.br/cvm/pt-br/canais_atendimento/protocolodigital) In case of doubt, contact the Information Management Division (DINF/SAD) by email at dinf@cvm.gov.br or by phone at (21) 3554-8677.

Finally, we highlight the relevance of the guidelines contained in the latest Joint Circular Letters, issued by the Superintendence of Accounting and Audit Standards – SNC and the Superintendence of Corporate Relations - SEP, all available on our internet page (http://www.cvm.gov.br/legislacao/index.html?buscado=true&contCategoriasCheck=1&vimDaCategoria=/legislacao/oficioscirculares/snc-sep/).

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 59

SECURITY AND COMMODITIES COMMISSION
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686

3.2 Communications regarding Article 24 of CVM Resolution No. 50/2021

With a view to the faithful compliance with CVM Resolution No. 50/2021, particularly as provided for in Article 24, we reiterate that, for the purposes of the provision of item I of Article 11 of Law No. 9,613 of 1998, independent auditors must carry out monitoring, analysis, and communication related to considering, at a minimum, the application of the procedures provided for in specific regulation issued by the CFC.

As a result of the agreement signed with the Federal Council of Accounting - CFC, the negative declaration (if applicable) must be made in the CFC environment of SISCOAF. Nothing prevents the auditor registered with the CVM from spontaneously, and in a supplementary capacity, also sending suspicious communications or negative declarations to the CVM segment of SISCOAF.

3.3 Main issues pointed out in recent years by IFIAR

We list below the themes of the main findings in auditor inspections in recent years, pointed out by regulators associated with IFIAR, and consistent with those also verified in our supervisory work and inspections, for which we recommend attention on the part of auditors:

Accounting estimates, including fair value measurement:

reasonableness of assumptions – when testing an accounting estimate, failure to assess the reasonableness of the assumptions, including consideration of contradictory or inconsistent evidence;
failure in the sufficiency of tests of data accuracy;
failure to perform sufficient risk assessment procedures;
failure in the adequate consideration of indicators of bias;
failure to consider relevant variables;
failure to assess how management considered alternative assumptions.

Internal control tests:

failure to obtain sufficient persuasive evidence to support confidence in manual internal controls;

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 60

SECURITY AND COMMODITIES COMMISSION
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686

failure to sufficiently test controls over, or the accuracy and completeness of, data or reports produced by management;
failure to sufficiently test general information technology controls;
failure to sufficiently assess the severity of control deficiencies;
failure to adequately adjust tests as a result of ineffective controls;
failure to adequately assess the appropriateness of reliance on the work of others.

Revenue Recognition:

failure to sufficiently understand the terms and conditions of complex agreements and their impact on accounting;
failure in procedures to determine whether revenue was recognized in the correct period;
failure to appropriately assess and respond to fraud risks in revenue recognition.

Appropriateness of presentation and disclosure in financial statements:

failure to sufficiently consider the adequacy of disclosures in notes (excluding segment information)
failure to identify or assess the appropriateness of classifications and presentations of financial statements, including Cash Flow Statements;
failure to evaluate and test segment information

Audit sampling:

insufficient sample to reduce sampling risk to an acceptable low level;
selected sample for testing is biased and/or not representative of the population;

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 61

SECURITY AND COMMODITIES COMMISSION
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686

failure to identify the nature and cause of any deviation and to project errors for the population;
failure to design appropriate procedures to achieve the test objective and/or to perform adequate alternative procedures when necessary.

Group audit:

failure to sufficiently consider the nature, timing, and extent of involvement with the work of component auditors, including evidence of reviews performed;
failure to develop a group audit plan and/or appropriately communicate instructions to the component auditor;
failure to appropriately calculate materiality for the group and for related audit components;
failure to appropriately resolve points identified by the component auditor.

Use of technology (Artificial Intelligence - AI) in audits:

failure in the assessment and monitoring of the impact of technological resources on audit quality, including the lack of clear processes to measure their effectiveness;
failure in defining responsibilities between global networks and local firms for monitoring and supervision of the use of technological tools;
failure in the governance of the use of Generative Artificial Intelligence (“GenAI”), including the absence of robust policies to mitigate risks such as bias, loss of confidentiality, and unethical use;
failure to ensure that auditors maintain control over technological tools, applying adequate professional judgment in their use;
failure to implement effective training so that auditors understand and correctly interpret the results of AI/GenAI-based tools;
failure in the supervision and continuous certification of technological tools to ensure quality, reliability, and compliance with regulatory standards;

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 62

SECURITY AND COMMODITIES COMMISSION
Rua Sete de Setembro, 111/2-5th and 23-34th Floors, Center, Rio de Janeiro/RJ – ZIP: 20050-901 – Brazil - Tel.: (21) 3554-8686

failure in transparency regarding the use of GenAI in critical areas of the audit, hindering internal monitoring and regulatory inspections;
failure to consider the impacts of AI/GenAI on the reliability of the financial reports of the audited entities, including risks of bias and lack of explainability.

Annex Circular Letter No. 1/2026/CVM/SNC/GNA (2815580) SEI 19957.014750/2026-35 / pg. 63

Circular Letter No. 1/2026/CVM/SNC/GNA

Lineage: In force