XML 30 R8.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Abstract]  
Cybersecurity Risk Management Processes Integrated [Text Block] We have security measures in place to mitigate the risk of cybersecurity threats affecting our technology environment and our business. Our cybersecurity policies and programs are based on Santander Spain’s frameworks and policies, which are aligned with the NIST CSF – Cybersecurity Framework, and we have also taken into consideration the practices set forth in the ISO-27002 to assist us in formulating such security measures. These measures include governance, anticipate, protect, detect and respond processes and controls including, but not limited to, a risk management program, a training and awareness program, access and privilege management, segregation of test and production environments, network security analysis, baseline configuration of hardware and software, activity log correlation, malware prevention and remediation, business continuity management, security analysis of third-party operations, and cyber incident management. Our cybersecurity team and committees employ a range of security processes and solutions, and work to disseminate these measures within our organization, including through regular compliance checks and continuous monitoring of network activity by the Santander Group’s Global Security Operations Center (“SOC”) and security tests performed by independent companies.

Risk Management Model

Our operational risk management and control model is based on a continuous process of identifying, evaluating and mitigating sources of risk, regardless of whether they have materialized or not. Throughout the application of this process, risk management priorities are established, and internal controls are defined and executed to manage and mitigate the risk across the organization.

Our operational risk model establishes the items needed to manage and control operational risk properly according to regulatory standards and best management practices. Its phases are: (i) strategic planning; (ii) identification and assessment of risks and internal controls; (iii) ongoing monitoring of the operational risk profile; (iv) implementation of actions to manage the risks, including mitigation measures; and (v) disclosure, reporting and escalation of relevant matters. “Heracles,” which is our internal management and reporting system for operational risk, supports the operational risk program and tools with a Governance, Risk and Compliance (“GRC”) approach. It provides information for management and reporting throughout Santander Brasil. Heracles also facilitates better operational risk management decisions by using a common set of taxonomies and methodological standards to allow information consolidation, duplication prevention and reporting simplification.

Risk Management Process and Tools

Risk Control Self-Assessment (“RCSA”) is a qualitative process that allows us to identify, assess and measure, in a dynamic and proactive way, the material operational risks that could prevent the business or support units from achieving their objectives, as well as the effectiveness of the controls linked to their mitigation. Our RCSA integrates specific reviews that allow us to identify cyber, technology, fraud, third-party supplier and other risk as well as other risk drivers that could lead to operational risk as well as the failure to meet regulatory expectations. In addition, the RCSA incorporates reviews related to regulatory compliance, conduct and financial crime risk.

Other instruments are used to analyze and manage operational risk, such as: (i) metrics, (ii) risk scenarios, (iii) the assessment of new products and services, and transformation initiatives; (iv) business continuity plans (BCP); (v) review of cyber corporate insurance; (vi) review of the management perimeter; (vii) recommendations from internal and external auditors, consultants and supervisors; and (viii) the quality assurance process.

Business Continuity and Crisis Management

Our business continuity management model takes into consideration both local (e.g., Brazilian Central Bank) and international guidelines (e.g., European Central Bank guidelines, CIMA – Cayman Islands Monetary Authority guidelines) for cybersecurity risks and includes plans to deal with severe events. We review the impact these events may have on day-to-day operations and endeavor to mitigate such threats. Our crisis governance mechanisms include our senior management as well as committees formed by previously defined and approved members. We also have mechanisms to trigger business continuity plans in case of cyber, operational and financial crises which involve the departments necessary to act and support our operations in the preparation and implementation of strategies to contain these types of crises.

Training & Awareness (Secure UX)

We also perform cyber awareness campaigns for our employees and customers, including annual and mandatory training for all employees, an annual event for our executive personnel (called Cyber Defenders), security campaigns for our customers and society at large with influencers on social media and increasing information on how to use our products in a safer way. Furthermore, we cooperate and exchange information and experience relating to cybersecurity with local and international security communities, such as local telecommunications companies and other financial institutions and as a member of the Financial Services – Information Sharing and Analysis Center community.

Cybersecurity Team, CISO and Oversight

Our cybersecurity team is composed of dedicated personnel who have experience in cybersecurity in a financial institution context. This team has overall oversight responsibility for our cybersecurity processes and cyber risk management and also relies on the internal controls team, audit team and our risk and compliance committee to ensure oversight and controls effectiveness.

Our local chief information security officer, or “CISO,” has been active in the technology areas of the Santander Group for more than 24 years, including strategic leadership roles for technological integration projects. He has a degree in information systems, and received a master’s degree in strategic information technology management. At Santander Brasil, our local CISO reports directly to our Technology and Operations Vice President.

Cybersecurity Committees

Cybersecurity topics are deliberated in executive committees that have the role of informing and providing supporting materials to our executives and advisors to ensure the best decision-making for the business. Our CISO also regularly updates our audit committee and our risk and compliance committee on Santander Brasil cybersecurity programs, material cybersecurity risks and mitigation strategies, providing periodical reports (annually or ad hoc) that cover, among other topics, our risk exposure, third-party assessment results, maturity of our subsidiaries and incidents that may have happened during the period. Such executive committees support our board of directors.

Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to our risk and compliance committee and to our audit committee. Our audit committee is responsible for providing our board of directors and senior management with an independent assessment of the quality and effectiveness of internal control, cyber risk management and governance of cybersecurity controls. Additionally, our risk and compliance committee is responsible for advising our executive committee as an instrument for effective risk control, ensuring that they are managed according to the level of risk appetite approved by our board of directors.

Senior management’s participation in incident management is documented using a model with three levels of committees—bronze, silver and gold. Each level is based on an incident’s severity, such that members of our management have different roles and responsibilities after our crisis management director disclosures that we are undergoing a special cybersecurity event.

In 2025, we continued to strengthen our cybersecurity and fraud ecosystems, proposing strategies to respond to a constantly changing threat environment, while supporting commercial value and improving the safety environment for clients. In 2026, we will prioritize monitoring the implementation of the technology and operations transformation model, as well as our positioning in cybersecurity, especially to continue maturing, improving, and evolving the cybersecurity defenses, with a special focus on emerging threats.

Cybersecurity Certifications

The Santander Group, which includes Santander Brasil and its subsidiaries, has ISO 27001 certification for the key global cybersecurity processes that support our global services. This external recognition, verified through an onsite inspection, confirms our alignment with industry best practices in terms of information security for the following key processes: (i) security operations center, or SOC alert management, (ii) cyber incident management, (iii) malware protection for endpoint security and (iv) attack surface management. We also hold a Service Organization Controls – SOC 1 Type 2 Report (SSAE 18), which provides an independent external recognition for the design and operating effectiveness of global cybersecurity controls, and focus on global cyber products and controls.

Third-Party Risk Management

Santander Brasil’s external suppliers, who are engaged by Santander Brasil’s various business areas, are subject to our third-party risk management process, aiming to certify and assess the vendor processes, giving us a broader visibility on their safety and improvements needed. To do so, we work together with several departments building a transversal view of risks across the cybersecurity, privacy and data protection and business continuity management functions. The objective is to provide a 360º view of third-party gaps and to support decision-makers in supplier engagement and risk management, improving the quality of the service these suppliers provide to the customers.

Cybersecurity Threats and Incidents

In 2025, we have continued evolving our cyber defenses in line with our cybersecurity strategy and key strategic initiatives. New controls were developed and implemented following a cyber-threat-led approach, covering current areas of risk and new attack methods, notably around supply chain, backup and recovery and fraud prevention measures reinforced by leveraging behavioral biometric solutions and machine learning technology.

To strengthen our response, streamline operations and maximize resources, we continue to operate the Santander Fusion Center, which enables closer collaboration between our various teams involved in cybersecurity. The Fusion Center operates 24 hours a day, 7 days a week, providing services to Santander Brasil and all its subsidiaries, detecting, monitoring, and responding to operational failures and cybersecurity events.

In parallel, we are preparing for the new requirements of upcoming regulations on cybersecurity matters, while assessing the pros and cons derived from emerging technologies, such as AI. Santander Brasil is implementing a Responsible AI framework that involves different areas (Legal, Risks, Chief Privacy Officer, Cyber Security, Architecture, Engineering) to evaluate each use case implementation and mitigate risks.

During the year ended December 31, 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced any undetected cybersecurity incident or that we will not experience cybersecurity incidents in the future.

See also “Item 3. Key Information—D. Risk Factors—Risks Relating to the Brazilian Financial Services Industry and Our Business—Failure to adequately protect ourselves against risks relating to cybersecurity could materially and adversely affect us. We are also subject to increasing scrutiny and regulation governing cybersecurity risks.”
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Board of Directors Oversight [Text Block] Our cybersecurity team is composed of dedicated personnel who have experience in cybersecurity in a financial institution context. This team has overall oversight responsibility for our cybersecurity processes and cyber risk management and also relies on the internal controls team, audit team and our risk and compliance committee to ensure oversight and controls effectiveness.
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true
Cybersecurity Risk Role of Management [Text Block] Cybersecurity topics are deliberated in executive committees that have the role of informing and providing supporting materials to our executives and advisors to ensure the best decision-making for the business. Our CISO also regularly updates our audit committee and our risk and compliance committee on Santander Brasil cybersecurity programs, material cybersecurity risks and mitigation strategies, providing periodical reports (annually or ad hoc) that cover, among other topics, our risk exposure, third-party assessment results, maturity of our subsidiaries and incidents that may have happened during the period. Such executive committees support our board of directors.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to our risk and compliance committee and to our audit committee. Our audit committee is responsible for providing our board of directors and senior management with an independent assessment of the quality and effectiveness of internal control, cyber risk management and governance of cybersecurity controls. Additionally, our risk and compliance committee is responsible for advising our executive committee as an instrument for effective risk control, ensuring that they are managed according to the level of risk appetite approved by our board of directors.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Santander Group, which includes Santander Brasil and its subsidiaries, has ISO 27001 certification for the key global cybersecurity processes that support our global services. This external recognition, verified through an onsite inspection, confirms our alignment with industry best practices in terms of information security for the following key processes: (i) security operations center, or SOC alert management, (ii) cyber incident management, (iii) malware protection for endpoint security and (iv) attack surface management. We also hold a Service Organization Controls – SOC 1 Type 2 Report (SSAE 18), which provides an independent external recognition for the design and operating effectiveness of global cybersecurity controls, and focus on global cyber products and controls.