INSTRUCTION NORMATIVE BCB NO. 686, OF DECEMBER 8, 2025

Discloses the models for the reports of the Internal Capital Adequacy Assessment Process (ICAAP) and the Simplified Internal Capital Adequacy Assessment Process (ICAAPSimp), as provided for in Circular No. 3,846, of September 13, 2017.

The Chief of the Strategic Management and Specialized Supervision Department - Degef, substitute, the Chief of the Banking Supervision Department - Desup, and the Chief of the Cooperatives and Non-Bank Institutions Supervision Department - Desuc, in the exercise of the authority conferred upon them by art. 23, item I, letter “a” of the Internal Regulations of the Central Bank of Brazil, published through Resolution BCB No. 340, of September 21, 2023, based on arts. 82, item III, letter “b”, 88, item I, and 91, item I, letter “a” of said Regulations, and considering the provisions of Resolutions Nos. 4,553, of January 30, 2017, and 4,557, of February 23, 2017, Resolution CMN No. 5,223, of May 30, 2025, Circular No. 3,846, of September 13, 2017, and BCB Resolutions Nos. 265, of November 25, 2022, 436, of November 28, 2024, and 527, of December 3, 2025,

RESOLVE:

Art. 1º The information that must be included in the reports of the Internal Capital Adequacy Assessment Process - ICAAP and the Simplified Internal Capital Adequacy Assessment Process - ICAAPSimp, as provided for in art. 5º of Circular No. 3,846, of September 13, 2017, is detailed in the annex of this Instruction Normative.

§ 1º The aforementioned reports must be prepared and made available on the date set forth in art. 5º, item III, of Circular No. 3,846, of 2017. (Transformed into § 1º, effective from July 1, 2026, by Instruction Normative BCB No. 731, of April 30, 2026.)

§ 2º The provisions of this Instruction Normative do not apply to the ICAAPSimp referred to in art. 40, § 2º, letter b, of CMN Resolution No. 4,557, of February 23, 2017, when carried out for the purposes of the provisions of art. 4º, § 1º, item III, of CMN Resolution No. 5,223, of May 30, 2025. (Included, effective from July 1, 2026, by Instruction Normative BCB No. 731, of April 30, 2026.)

Art. 2º The institution subject to the Simplified Internal Capital Adequacy Assessment Process - ICAAPSimp is exempt from presenting in the ICAAP report the information described in the following items of the Annex of this Instruction Normative:

I - Chapter II - ICAAP Governance;

II - Chapter IV, Section I - Risk Governance;

III - Chapter IV, Section II - Relevant Risks, sub-items “a”, “b”, “c” and “d”, relating to the risks of item 1;

IV - Chapter IV, Section III - Risk Aggregation; and

V - Chapter IV, Section V - Considering Risk Management as a Whole.

Art. 3º Instruction Normative BCB No. 322, of November 11, 2022, is revoked.

Art. 4º This Instruction Normative enters into force on the date of its publication.

MARCELO COLLI INGLEZ
Chief of Degef substitute

BELLINE SANTANA
Chief of Desup

ADALBERTO FELINTO DA CRUZ JUNIOR
Chief of Desuc

ANNEX TO INSTRUCTION NORMATIVE BCB NO. 686, OF DECEMBER 8, 2025

1. The ICAAP* comprises the identification, management, and measurement of risks, including the measurement of the need for capital to cover losses in a severe crisis scenario. The capital plan must be compatible with the institution's strategic planning.

*In this text, the term ICAAP refers to the process unless it is explicitly stated that it refers to the report.

2. The information to be presented is defined in the report model containing the self-assessment result, and its format is free, provided that all information required here is presented. It is fundamental that due references be made to the institution's internal documents that address each topic.

3. The qualitative analyses presented in this report must be consistent with the submission of quantitative information defined in BCB Resolution No. 527, of December 3, 2025, and BCB Instruction Normative No. 685, of December 5, 2025.

ICAAP REPORT MODEL

CHAPTER I

SUMMARY

Section I

General Data of the Institution

1. Name of the institution (the term institution denotes either the financial institution alone or the prudential conglomerate presenting the ICAAP report).

2. Name of the director responsible for the capital management structure, as per art. 47 of Resolution No. 4,557, of February 23, 2017.

3. Name of the Risk Management Director (CRO), as per art. 44 of Resolution No. 4,557, of 2017.

4. Department (or area) responsible for preparing the document and contact data.

5. Description of the organizational structure (functional chart) involved in the ICAAP.

6. Scope of the ICAAP - individual or prudential conglomerate, presenting, if applicable, the list of all entities (companies and investment funds) that make up the conglomerate covered by the ICAAP.

Section II

Strategy

1. Brief description of the corporate strategy.

Section III

Institution's Risk Profile

1. Brief description of the institution's risk appetite and its metrics and limits, analyzing its relationship with the strategies established by senior management. Risk appetite: refers to the level of risk that the institution proposes to assume, as described in the RAS (art. 5º of CMN Resolution No. 4,557, of 2017 and art. 3º of BCB Resolution No. 265, of 2022). Attach the most recent Risk Appetite Statement (RAS).

Section IV

Relevant Risks

1. At a minimum, the risks cited in art. 3º, items I and II of Circular No. 3,846, of September 13, 2017, must be considered. For each of them:

1.1. Brief comment on the exposure to each of the relevant risks, quantifying them, or assessing their level when quantification is not possible. Clarify whether the risk levels are acceptable or not, considering the institution's risk appetite. If not, explain the measures being implemented to reduce them; and

1.2. Brief comment on the assessment of the adequacy of internal governance and risk management, control, and monitoring, pointing out any deficiencies with their respective corrections and/or proposed plans to resolve them.

Section V

Capital

1. Brief analysis of the quantitative results of the capital need measured by the institution, broken down by risk categories and considering diversification effects (if any). A brief comparison of the current results against the capital needs measured in the previous ICAAP Report must be presented.

If the institution calculates and incorporates any diversification effect, conservatism must be exercised in the measurement.

2. Brief comparative analysis between the quantitative results of the capital need and the capital effectively maintained by the institution, considering Core Capital, Tier I (Core + Supplementary) and Reference Equity (Tier I + Tier II).

Section VI

Capital Planning

1. Brief analysis of the capital plan, considering the dividend distribution and capitalization policy, for a three-year horizon and aligned with the institution's strategic objectives.

2. Brief comment on the capital contingency plan.

Section VII

Conclusions and Action Plans

1. Summary of the main conclusions obtained regarding the self-assessment of capital adequacy and the adequacy of the internal governance of the institution involved in the ICAAP.

If deficiencies or inadequacies have been identified, make the observations, indicating corrections and/or proposed plans to remedy them.

Section VIII

General Considerations

1. Summary of the main difficulties faced in the ICAAP, challenges, and other relevant considerations.

2. Description of the main changes in the risk and capital management process over the last 12 months.

CHAPTER II

ICAAP GOVERNANCE

Section I

General Provisions

1. Description of the responsibilities and evidence of commitment of the board of directors (if any) and senior management (represented by the main executives of the institution or main decision-makers: president, vice-presidents, and directors) regarding the assessment of capital adequacy against the risks to which the institution is exposed.

2. Identification of the general mechanisms used by the institution to ensure the adherence of its processes to the internal governance principles involved in conducting the ICAAP.

3. Description of the internal flow of information related to the ICAAP, including the types of management reports reported to senior management and the board of directors (if any).

CHAPTER III

CORPORATE STRATEGY

Section I

General Provisions

1. Description of the corporate strategy, demonstrating how the institution will be able to generate results that ensure capital sustainability, always respecting the declared risk appetite, and paying attention to new risks that may arise from it. It should be highlighted that the demonstration must be compatible with the institution's budget. Results targets and capital indices must be highlighted.

2. Presentation of the following elements:

2.1 Strategic Analysis

2.1.1 relevant facts (positive/negative); and

2.1.2 threats and opportunities (economic, competitive, and regulatory scenario).

2.2 Strategic Macro-direction

2.2.1 description of the institution's mission, vision, culture, and values.

2.3 Description of the Business Model

2.3.1 business lines targeted by the institution and products intended for each of them;

2.3.2 growth and market share targets;

2.3.3 critical success factors and competitive advantages in the main business lines targeted by the institution;

2.3.4 most relevant strategic initiatives adopted for the maintenance or acquisition of competitive advantages in the main business lines targeted by the institution; and

2.3.5 qualitative analysis of projections for assets/liabilities/equity, revenues/expenses, and macroeconomic indicators.

3. Description of the budget preparation process.

4. Presentation of the list of internal documents that support the above items and their respective update dates.

CHAPTER IV

RISK MANAGEMENT AND MEASUREMENT

Section I

Risk Governance

1. Description of the institution's risk appetite, aligned with its strategic objectives. Presentation of its relationship with the capital plan and with the stress testing exercises provided for in Section II of Chapter III of Resolution No. 4,557, of 2017. Description of the metrics used to monitor risk appetite.

2. Description of the process for defining the risk policy in the institution.

3. Description of the corporate risk management structure and its main activities, functions, and responsibilities, focusing on the processes and systems used in the identification and aggregated assessment of risks incurred by the institution.

4. Description of the manner in which the institution's risk policies are disseminated.

5. Brief description of the process for collecting and consolidating risk information, including the process for evaluating, validating, and approving reports before their presentation to senior management.

6. Description of the structure and procedures for identifying and monitoring idiosyncratic risks and those arising from participating companies not part of the prudential conglomerate.

Section II

Relevant Risks

As a general rule, all risks identified in the ICAAP must be measured or assessed. In the description and self-assessment of each risk category described in items 1, 2, and 3 of this section, consider the following sub-items:

a) adequacy of the risk management structure (hierarchical structure, functions, and responsibilities);

b) adequacy of risk policies (limits, diversification, mitigation, capital, etc.);

c) adequacy of the use of risk management processes and tools (systems and measurement methodologies used, control and monitoring, recovery, reporting structure, etc.) in decision-making;

d) tables and graphs presenting the evolution of risk exposure compared to the previous year, with comments related to the most relevant variations;

e) methodologies used for risk assessment and measurement and the assumptions made in quantifying the institution's capital need, considering possible mitigations. In an exceptional manner, if quantitative measurement of a risk is not feasible (for example, strategic risk and reputation risk), mention the qualitative methodologies and control and mitigation instruments used. Highlight the main methodological changes that occurred in the last year;

f) main assumptions and limitations of the models and available data for risk measurement; and

g) self-assessment of the adequacy of the methodologies used for risk quantification, considering the institution's profile and identifying any needs for improvements.

1. Description and self-assessment of Pillar 1 Risks:

1.1 credit risk (art. 6º, item I of CMN Resolution No. 4,557, of 2017 and art. 4º, item I of BCB Resolution No. 265, of 2022);

1.2 market risk (art. 6º, item II of CMN Resolution No. 4,557, of 2017 and art. 4º, item II of BCB Resolution No. 265, of 2022); and

1.3 operational risk (art. 6º, item IV of CMN Resolution No. 4,557, of 2017 and art. 4º, item IV of BCB Resolution No. 265, of 2022).

In addition to items “a” to “g” described in the introduction of this section, include the following item for this risk:

h) present a summary of the historical operational losses, segregated by event types, highlighting the largest losses.*

• Operational risk management, the internal control system, and the effects of the compliance function may be included in annexes to the ICAAP, consisting of the reports provided for respectively in CMN Resolutions No. 4,557, of 2017, 4,968, of November 25, 2021, 4,595, of August 28, 2017, and BCB Resolution No. 265, of 2022.

2. Description and self-assessment of Pillar 1 Risks that have not been fully covered in the Pillar 1 capital measurement, such as:

2.1 residual risks arising from credit risk mitigation techniques;

2.2 residual risks arising from asset securitization or complex derivative products;

2.3 boundary risks between operational and credit, such as credit fraud; and

2.4 other residual risks.

3. Description and self-assessment of other risks, such as:

3.1 interest rate risk for instruments classified in the banking book - IRRBB (art. 6º, item III of CMN Resolution No. 4,557, of 2017 and art. 4º, item III of BCB Resolution No. 265, of 2022).

In addition to items “a” to “g” described in the introduction of this section, include the following items for this risk:

h) description of the main determinants of IRRBB, including the mismatch between assets and liabilities, regarding terms, rates, indexers, and currencies;

i) assumptions used in modeling embedded options, changes in the temporal structure of cash flows of deposits without defined contractual maturity, and currency aggregation;

j) the result and description of the IRRBB measurement using the financial intermediation result approach (ΔNII and earnings at risk, for example) and the economic value approach (ΔEVE, for example); and

k) the result and description of the measurement of embedded gains & losses of banking book instruments sensitive to interest rate variations that are not marked to market.

3.2 counterparty credit risk (art. 21, § 3º, item I of Resolution No. 4,557, of 2017 and art. 19, § 3º, item I of BCB Resolution No. 265, of 2022).

3.3 credit concentration risk (art. 21, § 3º, item VI of Resolution No. 4,557, of 2017 and art. 19, § 3º, item VI of BCB Resolution No. 265, of 2022), paying attention to the following points:

1.1.

1.2.

3.3.1 at a minimum, concentration by name, economic sector, and type of risk mitigator must be considered;

3.3.2 capital for credit concentration risk must be quantified; simple mitigation of the risk through a structure of limits or monitoring of indicators, such as the Herfindahl-Hirschman Index (HHI), is not sufficient;

3.3.3 if the concentration risk is fully captured by the economic capital model for credit risk, a theoretical justification regarding the treatment given by the model must be presented.

3.4 liquidity risk (art. 6º, item V of Resolution No. 4,557, of 2017 and art. 4º, item V of BCB Resolution No. 265, of 2022).

In addition to items “a” to “g” described in the introduction of this section, include the following item for this risk:

h) briefly describe the process for managing the institution's structural liquidity mismatch.

3.5 social risk (art. 6º, item VI of Resolution No. 4,557, of 2017 and art. 4º, item VI of BCB Resolution No. 265, of 2022).

In addition to items “a” to “g” described in the introduction of this section, include the following item for this risk:

h) describe the economic activities with the greatest potential to cause social damage.

3.6 environmental risk (art. 6º, item VII of Resolution No. 4,557, of 2017 and art. 4º, item VII of BCB Resolution No. 265, of 2022).

In addition to items “a” to “g” described in the introduction of this section, include the following item for this risk:

h) describe the economic activities with the greatest potential to cause environmental damage.

3.7 climate risk (art. 6º, item VIII of Resolution No. 4,557, of 2017 and art. 4º, item VIII of BCB Resolution No. 265, of 2022).

In addition to items “a” to “g” described in the introduction of this section, include the following item for this risk:

h) describe the economic activities with the greatest potential to suffer damage from physical climate events and transition climate events.

3.8 strategic risk.

3.9 reputation risk.

3.10 contagion risk.

Note that the risk management of the prudential conglomerate must consider, at a minimum:

3.10.1 the risks associated with other entities controlled by its members or in which they participate (art. 53 of Resolution No. 4,557, of 2017 and art. 61 of BCB Resolution No. 265, of 2022); and

3.10.2 the risk of the institution providing financial support to a financial or non-financial entity that is not part of its conglomerate - step-in risk (art. 15, item V of Resolution No. 4,557, of 2017 and art. 13, item V of BCB Resolution No. 265, of 2022).

3.11 pension fund risk.

In addition to items “a” to “g” described in the introduction of this section, include the following items for this risk:

h) at a minimum, list the defined benefit plans sponsored by the institution, deficit/surplus status per plan, and assumptions used in measurement, general characteristics of the plan, actuarial liability value and associated characteristics (applied mortality table, discount rate), actuarial asset value, and profile of the plan's investments, calculation of the capital (economic) value necessary to cover risks arising from potential mismatches between actuarial assets and liabilities;

3.12 insurance, pension, and capitalization risk.

In addition to items “a” to “g” described in the introduction of this section, include the following item for this risk:

h) at a minimum, describe the material risks associated, how these risks are treated, and consider any impacts on the institution's capital; report the capital required by Susep.

3.13 other relevant risks.

Section III

Risk Aggregation

1. Description of the methodologies and assumptions made for adjustments related to risk aggregation. Detail the diversification effects considered and other adjustments (including assets and/or companies not covered in the ICAAP), if any.

Section IV

Stress Testing

1. Description of stress testing methodologies, specifying the assumptions considered. Stress tests must be performed for adverse scenarios, considering the institution's specific risks, including credit risk, credit concentration risk, market risk, IRRBB, operational risk, liquidity risk, and other relevant risks.

2. Presentation of the methodological framework, governance, and documentation (in the form of annexes referenced in the report).

3. Description of the process for preparing stress test scenarios, including the scenarios of the integrated stress test provided for in art. 14 of Resolution No. 4,557, of 2017 and art. 12 of BCB Resolution No. 265, of 2022. Present the definition of each adverse scenario and the base scenario, in qualitative and quantitative terms. It is not permitted that the stress test scenarios proposed by the institution constitute replicas of scenarios built externally to the institution, nor even of scenarios formulated by the BCB. The reflection and debate inherent in the process of constructing stress test scenarios and identifying the risks underlying them are fundamental elements of the integrated stress testing exercise.

4. Qualitative analysis of the results of the exercises, according to the scenarios considered by the institution, as well as the scenario provided by the BCB as provided for in art. 19, item II of Resolution No. 4,557, of 2017 and art. 17, item II of BCB Resolution 265, of 2022.

5. Presentation of the uses and applications of the stress testing tool in the institution's risk management framework.

Section V

Considering Risk Management as a Whole

1. Brief presentation of the assessment of the technological infrastructure that supports risk management and capital processes. If any, describe projects related to the topic in progress, mentioning the main expected benefits.

2. Description of the objectives and information contained in the main reports produced for senior management that assist in the corporate risk management process.

3. Description of the processes established by the risk director and/or the corporate risk management unit to monitor the effectiveness of corporate risk management.

4. Presentation of the general self-assessment of the adequacy of the institution's risk management. If deficiencies have been identified, make the observations, indicating corrections and/or proposed plans to remedy them.

Section VI

Validation

1. Presentation of the documentation related to the validation and approval process by the institution's board of directors and the board of directors, if any. The validation process must be independent of the ICAAP development and must evaluate the items described in art. 4º, items I to VI of Circular No. 3,846, of 2017.

CHAPTER V

CAPITAL PLANNING

Section I

Capital Plan

1. Description of the capital plan, aligned with the institution's strategic planning, considering, among others, the following aspects:

1.1 future dividend distribution policy and payment of interest on equity;

1.2 main sources of the institution's capital, clarifying, for each, the proportional participation and expansion possibilities; and

1.3 prospective assessment of capital requirements, discriminating each type of risk, the different regulatory buffers, and possible application of additional capital requirements by the Supervisor.

2. Description of the contingency plan for the case where the capital sources foreseen in the capital plan prove unviable or insufficient, or for the occurrence of events not foreseen in the capital plan.

3. Qualitative analysis of the projections of required and available capital, in the base and stress scenarios, as stipulated in the section on stress testing.

4. Description of the monitoring and review processes of the capital plan.

5. Presentation of the overall self-assessment of capital management, the capital plan, and the contingency plan, considering, among other aspects:

5.1 comparison, relative to the previous fiscal year, between the estimated Reference Equity and the effective Reference Equity, commenting on the main reasons for the differences detected;

5.2 comparison between the capital indicators projected in the previous Icaap report with the actual results and description of the main sources of differences; and

5.3 comparison between the planned capital increase (according to the previous report, if applicable) and the actually occurred, explaining the justification for the non-occurrence, if applicable.

6. Presentation of the list of internal documents that support the above items and their respective update dates.

CHAPTER VI

INTERNAL AUDIT

Section I

General Provisions

1. Description of the scope of internal audit, regarding:

1.1 assessment of risks and their internal controls;

1.2 verification of the effective and adequate use of risk management tools (usage testing);

1.3 methodologies used for risk management;

1.4 compliance with internal and regulatory standards;

1.5 adequacy and assessment of systems and the integrity of data bases;

1.6 frequency of work; and

1.7 reporting structure.

If any of the functions mentioned above are assigned to another area, indicate the responsible area.

2. Summary presentation of the main conclusions and findings regarding the review of risk management and the review of the capital adequacy verification process (Icaap), as well as the corrective measures proposed (if any).

3. Presentation of the overall self-assessment regarding the adequacy of the internal audit function and/or other involved areas. If deficiencies have been identified, make the findings, indicating corrections and/or plans proposed to remedy them.

CHAPTER VII

ACTION PLANS

Section I

General Provisions

1. Presentation of the self-assessment of the institution's capital adequacy relative to the capital calculated as necessary against its risks, for the considered base date and also for the following 3 (three) fiscal years. In case of inadequacies, present the measures and action plans necessary to resolve them.

NOTE

1. The regulation of this topic deals with the report models to be prepared for the Internal Capital Adequacy Assessment Process - Icaap and for the Simplified Internal Capital Adequacy Assessment Process - IcaapSimp.

2. In this Normative Instruction BCB, specific spaces are provided for the description of social risk management, environmental risk, and climate risk in the Icaap and IcaapSimp reports, in accordance with the provision of Resolution No. 4,557 of February 23, 2017, from the wording brought by Resolution No. 4,943 of September 15, 2021, and Resolution BCB No. 265 of 2022. Additionally, Resolution BCB No. 251 of October 11, 2022, reformed Circular No. 3,846 of 2017, with the aim of making explicit that both reports should consider aspects related to the mentioned risks. Until then, the Icaap and IcaapSimp reports provided a section dedicated to socio-environmental risk, which is no longer defined in the current regulation. Thus, the Normative Instruction adapts the format of the reports to regulatory demands.

3. Resolution BCB No. 527 of December 3, 2025, provides for the transmission to the Central Bank of Brazil - BCB, of quantitative information related to the Internal Capital Adequacy Assessment Process - Icaap, the Simplified Internal Capital Adequacy Assessment Process - IcaapSimp, and stress tests with scenarios provided by this Autarchy, in accordance with Resolutions Nos. 4,553 of January 30, 2017, and 4,557 of February 23, 2017, and BCB Resolutions Nos. 265 of November 25, 2022, and 436 of November 28, 2024.

4. Decree No. 10,411 of June 30, 2020, regulates the conduct of regulatory impact analysis - AIR as a prerequisite for the issuance of normative acts. However, in its art. 4, the aforementioned decree establishes the hypotheses for dispensation of conducting AIR. This Normative Instruction BCB falls under the hypothesis provided for in item II, normative act intended to regulate rights or obligations defined in a hierarchically superior norm that does not allow, technically or legally, different regulatory alternatives. Thus, based on art. 4, item II of Decree No. 10,411 of 2020, we understand that the issuance of this Normative Instruction BCB is exempt from conducting AIR.

MARCELO COLLI INGLEZ Deputy Head of Degef	BELLINE SANTANA Head of Desup

ADALBERTO FELINTO DA CRUZ JUNIOR
Head of Desuc