Cielo S A : Liquidity Risk Management Report - May 2021

Liquidity Risk Management Structure Public Report | 2021

Liquidity Risk

Management

Report

Risk, Compliance, Prevention and

Security Office

MAY 2021

Liquidity Risk Management Structure Report | 2021

TABLE OF CONTENTS

1	Introduction .........................................................................................	2
2	Liquidity Risk Management Structure ...................................................	2
3	Duties and Responsibilities...................................................................	3
4	Liquidity Contingency Plan ...................................................................	6

1

Liquidity Risk Management Structure Report | 2021

1 Introduction

The objective of this report is to demonstrate the liquidity risk management structure of Cielo S.A. ("Cielo"), as determined in Circular 3.681/2013 of the Central Bank of Brazil, as amended. This report refers to the period between May 2020 and May 2021.

2 Liquidity Risk Management Structure

By definition, pursuant to Circular 3.681/2013 of the Central Bank of Brazil, Liquidity Risk refers to the possibility of a company not being able to efficiently comply with its expected and unexpected, current and future obligations without affecting its daily operations and without incurring significant losses, in addition to not being able to convert electronic currency into physical or book-entry currency upon request by the user.

Cielo adopts the three (3) lines of defense concept to operate its integrated corporate risk management structure, thus ensuring compliance with the defined guidelines.

• 1st Line of Defense: Represented by all business areas and support managers, who must ensure the effective risk management within the scope of their direct organizational responsibilities, including the improvement or implementation of new controls to mitigate identified risks.
• 2nd Line of Defense: Represented by the Risk, Compliance and Prevention Security Office, which works on a consulting and independent basis with business and support areas, assessing and reporting the management of risks, compliance, management of business continuity, crises management, information security, money laundering prevention, fraud prevention, and the quality of the control environment to Cielo's Executive Board and Board of Directors, through the Company's Risk Committee. The activities under the 2nd Line of Defense are separate and independent from the activities and management of the business and support areas and Internal Audit.
• 3rd Line of Defense: Represented by the Internal Audit, which is responsible for providing independent opinions to the Board of Directors, through the Audit Committee, on the risk management process, the effectiveness of internal controls, and corporate governance.

The Liquidity Risk Management structure is comprised by the components described in the organizational chart below:

2

Liquidity Risk Management Structure Report | 2021

Board of Directors

Risks Committee

Board of Executive Officers

Chief Executive Officer

Compliance and Risk	Chief Finance Officer and
Executive Officer	Investor Relations Officer

Executive Superintendence	Executive Treasury
of Risks and Internal
Superintendence
Controls

Organizational Chart for the Liquidity Risk Management Structure

3 Duties and Responsibilities

• Board of Directors:
• • Ensure the segregation and definition of functions, attributions for responsibilities and delegation of authorities that support the effective liquidity risk management;
  • Approve liquidity risk management guidelines, strategies and policies;
  • Approve the liquidity risk limits and levels established in the Statement of Risk Appetite;
  • Authorize, when necessary, exceptions to the strategies, guidelines, policies and liquidity risk levels defined in the Statement of Risk Appetite;
  • Resolve on the assumption of liquidity risk with high or very high impact.
• Executive Board:

3

Liquidity Risk Management Structure Report | 2021

• • Ensure Cielo's compliance with the liquidity risk management strategies, guidelines and policies, as well as the liquidity risk limits and levels established in the Statement of Risk Appetite, approved by the Board of Directors;
  • Resolve on the assumption of liquidity risk with high or very high impact.
  • Ensure that adequate and enough resources are available to carry out liquidity risk management activities.
• Risks Committee:
• • Analyze and issue recommendations on the policies relating to liquidity risk management applicable to payment institutions, as well as oversee compliance and guide the Company on the exceptions identified;
  • Analyze and make recommendations, as applicable, on proposals and adjustments for the statement of risk appetite and tolerance, as well as their management strategies, considering risk on an individual and integrated basis;
  • Monitor the liquidity risk appetite levels set out in the statement of risk appetite and tolerance and their management strategies, considering the risks on an individual and integrated basis, as well as the Executive Board's compliance with these guidelines, as applicable;
  • Oversee the work and performance of the Executive Officer(s) responsible for the Risk Management;
  • Gain awareness and take any appropriate action, if deemed necessary, on the works carried out by the internal and external audits regarding the liquidity risk management applicable to payment institutions with the respective results, issuing possible recommendations to the Board of Directors;
  • Analyze and issue recommendations, at least once a year, on the stress test program, as applicable, as well as the liquidity contingency plan to the Board of Directors;
  • Position and report to the Board of Directors, every six months - or sooner if deemed convenient - the evaluation of results related to the liquidity risk management process, as well as the level of compliance of the liquidity risk management structure with the applicable current regulations, providing to the collegiate body a broad and integrated overview of the risks and their impacts;

4