Cybersecurity Risk Management and Strategy Disclosure	12 Months Ended
Cybersecurity Risk Management and Strategy Disclosure	Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]	Risk Management Strategy Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to align with best practices as embodied by such frameworks and benchmarks as those published by the National Institute of Standards and Technology the Center for Internet Security, and Mitre Attack, and to guide and provide a solid and resilient framework for identifying and mitigating dealing with cybersecurity risks. Our cybersecurity team is responsible for implementing, maintaining, and evaluating our physical, technical, and administrative security controls as part of the overall cybersecurity risk management program. These functions are primarily performed in-house; we currently engage third parties only for external penetration testing. Additionally, our cybersecurity team provides training to all employees annually. Our cybersecurity controls include monitoring workstations, servers and our network, using tools such as incident detection controls, content filters, behavior detection tools, Antivirus, Antispam, anti-malware, and data loss prevention tools, among others technical controls. Alerts are generated to notify the team to deal with potential incidents to reduce risk that confidential information is lost, stolen, misused or leaked onto the web. We and third parties on our behalf conduct internal and external Intrusion Tests at the network and application layers, which are carried out at least annually. Scans of internal networks are also carried out periodically and if any vulnerability is identified, it is treated and prioritized according to its criticality. We also have in place a written cybersecurity incident response protocol designed to allow us to respond promptly when an incident is detected. There are several other controls to promote security against threats in digital media, including with respect to identity and access controls, application security, privacy, encryption and masking, traceability, network segmentation and backup, and to protect against malicious software. We also address potential risks posed by the use of third-party service providers, including by executing appropriate contractual requirements related to data and cyber security and monitoring of assurance reports (when such reports are available) produced by the supplier’s external auditors. We have been subject to cybersecurity incidents in the past; however, to date, none have had a material impact on our business, operations, or financial condition. For instance, on March 22, 2025, we became aware that an unauthorized third party gained access to a database, hosted by a third-party vendor, containing certain personal and financial information from our clients. We immediately activated our cybersecurity incident response protocol to investigate, contain, and remediate the incident. As of the date of this report, no client accounts, client funds or XP internal systems have been compromised, nor have the systems, or operations of the XP Group been affected as a result of this incident. We have taken necessary measures to resolve the incident promptly and we have remediated the vulnerability that led to the initial unauthorized access. We have provided appropriate notifications to affected individuals, and regulators and competent supervisory authorities have also been notified of the incident, each as required under applicable law. But although we have adopted all necessary steps and actions as per our regulatory obligations and in compliance with our cybersecurity protocols there is no assurance that we will not experience additional negative impacts related to this incident in the future. For more information about these risks, see “Item 3. Key Information—D. Risk Factors." to learn about certain risks related to our business and industry, such as unauthorized disclosure, destruction or modification of data, through cyber security breaches, computer virus or otherwise, or interruption of our services may expose us to protracted and costly liability and litigation and damage our reputation.
Cybersecurity Risk Management Processes Integrated [Flag]	true
Cybersecurity Risk Management Processes Integrated [Text Block]	Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to align with best practices as embodied by such frameworks and benchmarks as those published by the National Institute of Standards and Technology the Center for Internet Security, and Mitre Attack, and to guide and provide a solid and resilient framework for identifying and mitigating dealing with cybersecurity risks. Our cybersecurity team is responsible for implementing, maintaining, and evaluating our physical, technical, and administrative security controls as part of the overall cybersecurity risk management program. These functions are primarily performed in-house; we currently engage third parties only for external penetration testing. Additionally, our cybersecurity team provides training to all employees annually.
Cybersecurity Risk Management Third Party Engaged [Flag]	true
Cybersecurity Risk Board of Directors Oversight [Text Block]	Governance Our board of directors (the “Board”) has overall oversight responsibility for our risk management processes, and is charged with overseeing our cybersecurity risk management program. The Risks, Credit and ESG committee of the Board is responsible for ensuring that management has processes in place designed to identify and assess the cybersecurity risks to which the company is exposed, to implement and maintain processes and programs to manage cybersecurity risks, and to mitigate, remediate, and otherwise respond to cybersecurity incidents. Our cybersecurity programs are under the direction of our Chief Technology Officer (CTO), who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CTO and dedicated staff are certified and experienced information and systems security professionals with many years combined of experience. Management, including the CTO and our cybersecurity team, regularly updates the Risks, Credit and ESG committee of the Board on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies, and it provides cybersecurity reports annually that cover, among other topics, third-party assessments of the company's cybersecurity program, developments in cybersecurity risk and mitigation strategies, and updates to the company's cybersecurity mitigation programs and strategies.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]	board of directors (the “Board”)
Cybersecurity Risk Role of Management [Text Block]	Our cybersecurity programs are under the direction of our Chief Technology Officer (CTO), who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CTO and dedicated staff are certified and experienced information and systems security professionals with many years combined of experience. Management, including the CTO and our cybersecurity team, regularly updates the Risks, Credit and ESG committee of the Board on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies, and it provides cybersecurity reports annually that cover, among other topics, third-party assessments of the company's cybersecurity program, developments in cybersecurity risk and mitigation strategies, and updates to the company's cybersecurity mitigation programs and strategies.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]	The Risks, Credit and ESG committee of the Board is responsible for ensuring that management has processes in place designed to identify and assess the cybersecurity risks to which the company is exposed, to implement and maintain processes and programs to manage cybersecurity risks, and to mitigate, remediate, and otherwise respond to cybersecurity incidents.