Summary

  • A Pix payment can look free and immediate to a Brazilian merchant, but Itau Unibanco's economic role begins behind the screen: the bank has to make settlement, fraud controls, account records, app uptime, customer recovery and liquidity feel invisible.
  • The public record supports a large, profitable, technology-heavy bank rather than a simple payments app: Itau reported R$12.3 billion of recurring managerial result in 1Q26, R$1.5 trillion of credit portfolio, 1.9% NPL over 90 days, R$16.2 billion of quarterly non-interest expenses and R$3.1 billion of Brazil technology expense in the quarter.
  • The judgement turns on whether Itau can keep pricing infrastructure trust through accounts, merchant services, credit cards, acquiring, deposits, advisory and credit discipline while Pix, Open Finance, digital banks, fintech acquirers and macro-credit stress push payment revenue and customer attention away from old banking bundles.

The merchant sees Pix as cheap until the bank has to make it settle

A snack-bar owner in Sao Paulo can finish a lunch rush with a phone full of Pix confirmations and the impression that payment has become almost costless. The customer scans a QR code, the notification arrives, the receipt is shown, and the merchant moves on to the next order. No card terminal has to print a slip. No cash drawer has to be counted. No bank manager has to approve a transfer. The visible price of the payment looks close to zero.

That is where the economics become more interesting. The merchant's screen is only the last few seconds of a much larger system. The customer's bank has to authenticate the user, check the account, apply limits, assess whether the transaction resembles fraud, send the order, preserve enough liquidity, produce a record, and let the customer recover if a phone was stolen or a coercive transfer occurred. The merchant's bank has to receive the money, make the balance usable, reconcile it, answer disputes, and keep the account available during weekends, holidays and payroll days. If a transaction fails, the bank becomes the first support desk. If fraud is alleged, the bank becomes an investigator and recovery channel. If the app is down, the bank's brand becomes the outage.

Itau Unibanco S.A. should be read through that hidden cost. The bank is not merely defending a loan book or a branch network. It is defending the account infrastructure that makes Brazilian money movement credible at scale. Its own Pix page for companies says Pix is an instant-payment method developed by the Banco Central do Brasil and says business customers can pay and receive immediately, 24 hours a day, including weekends, with Itau security around the service (https://www.itau.com.br/empresas/pix). That customer promise is simple. The operating bill behind it is not.

Valuation is especially hard because Pix deliberately made payments feel public, open and cheap. The Banco Central open-data portal describes Pix statistics as covering keys in the Transactional Account Identifier Directory, transactions settled in the Instant Payment System and information reported by Pix participants (https://dadosabertos.bcb.gov.br/dataset/pix). Using that data, June 2026 showed roughly 6.98 billion Pix transactions with about R$3.04 trillion in value, while the registered-user table showed 184.9 million total registered users at 30 June 2026 through 166.5 million individual users and 18.3 million legal-entity users (https://olinda.bcb.gov.br/olinda/servico/Pix_DadosAbertos/versao/v1/odata/). A system with that scale cannot be treated as a feature bolted onto a bank app. It is now part of the financial operating system of Brazil.

The important point for Itau is that cheap payment does not eliminate banking cost. It changes where the bank tries to recover it. The customer may not pay a fee for many personal Pix transfers, but the bank can still earn from the account relationship, deposits, working-capital credit, card spending, merchant services, business-account plans, payroll, insurance, advisory, investment balances and the lower funding cost that comes when customers keep money inside a bank they trust. The hidden question is whether those revenues are large and durable enough to pay for the infrastructure that makes the payment look free.

Pix is a public scheme carried on private operating stacks

Pix is a central-bank arrangement, but it is not experienced by users as a central-bank app. It is experienced through banks, payment institutions, merchant tools, QR codes, APIs, business accounts, fraud teams and support channels. The Banco Central's original Pix regulation established the payment scheme and approved its rulebook (https://www.bcb.gov.br/content/estabilidadefinanceira/pix/Pix_Regulation/Resolution_BCB_1.pdf). Itau's 2025 Form 20-F describes Pix as an instant-payment ecosystem whose settlement is centralized at the Central Bank, available 24 hours a day, seven days a week, all days of the year, and mandatory for financial institutions and payment agents authorized by the Central Bank with more than 500,000 active customer accounts (https://www.sec.gov/Archives/edgar/data/1132597/000113259726000132/itub-20251231.htm).

That mandatory-participation rule matters for a bank the size of Itau. Pix is not a side bet the bank can avoid. Itau has to participate and keep improving around rule changes, fraud controls and new functions. In the same Form 20-F, the bank links Brazil's competitive pressure to regulations that increase client switching, allow data sharing with customer permission and establish instant-payment rules. In other words, Pix and Open Finance are not only cheaper rails. They are competitive interventions that make account primacy less secure.

For customers, the public benefit is obvious. For banks, the pricing is split. BCB Resolution 19 prohibits fees to natural-person customers for many Pix transfers and receipts, while allowing fees in specified circumstances, including legal-entity remittance and receipt and accessory services (https://www.bcb.gov.br/content/estabilidadefinanceira/pix/Pix_Regulation/Resolution_BCB_19.pdf). Itau's own consumer Pix page advertises transfers and receipts any day of the week in minutes and without a fee, while also noting that Pix through the app can carry a tariff 50% below physical channels for certain uses (https://www.itau.com.br/pix). Its business content is more explicit that companies must still pay attention to costs because Pix is generally free for individuals but not necessarily for legal entities (https://www.itau.com.br/sustentabilidade/itaumulherempreendedora/plataforma/conteudos/pix-para-empresas-como-implementar/).

The bank account therefore becomes the economic unit. Itau can give a person a low-friction Pix experience and still hope to keep salary deposits, credit-card spending, investment balances and loans. It can give a small merchant Pix tools and still sell a business account, receivables anticipation, card acquiring, working-capital credit, payroll services and insurance. It can serve a larger company through Itau BBA, where Pix is positioned as a complete and secure ecosystem for paying and receiving, including recurring payments and specialist support (https://www.itau.com.br/itaubba-pt/pix). The visible transaction may be cheap; the surrounding account can still be monetized.

The danger is that Pix also trains customers to expect instant money movement as a baseline. Once the baseline is free, instant and available at all hours, old fees become harder to defend unless the bank is selling control, continuity and recovery. A merchant who accepts Pix may ask why card acceptance is expensive. A business owner who receives instant settlement may question why other bank products are slow. A household that can move balances instantly may split relationships across banks more easily. Pix compresses the payment margin while raising the required standard of service.

That is why Itau's advantage has to be more than scale. It has to turn scale into reliability. The bank has to persuade customers that the account is a safer place to receive, hold, reconcile and finance money than a narrower fintech service. If it can do that, Pix helps Itau by increasing digital account usage and data-rich customer contact. If it cannot, Pix becomes a public rail on which competitors ride into the customer relationship.

Itau is selling the operating account, not only the transaction

Itau's filings show a bank with many ways to recover the cost of trust infrastructure. The 2025 Form 20-F says the group operates through Retail Business, Wholesale Business and Activities with the Market and Corporation, with 2025 net operating revenue of R$112.2 billion in Retail Business, R$62.6 billion in Wholesale Business and R$9.6 billion in Activities with the Market and Corporation (https://www.sec.gov/Archives/edgar/data/1132597/000113259726000132/itub-20251231.htm). Retail includes personal loans, mortgages, payroll loans, credit cards, acquiring services, vehicle financing, investments, insurance, pension plans and premium bonds. Wholesale includes Itau BBA, large-company commercial operations, investment banking, units abroad, private banking, middle-market companies and institutional clients.

That breadth is the defense against Pix fee compression. The account relationship becomes the place where payments, balances and risk history create opportunities. Itau Empresas says it serves over 1.6 million small and medium enterprise customers in Brazil with annual revenues up to R$50 million and is moving toward a more digital, personalized and scalable model powered by AI, according to the 20-F. The business-account product pages add the commercial texture: Itau offers a 100% digital account for small entrepreneurs, while its broader corporate account has monthly service plans, including Adapt plans priced at R$169, R$289 and R$399 per month on the public page at retrieval (https://www.itau.com.br/empresas/abra-sua-conta). A free or cheap payment can sit inside a paid account proposition.

The 1Q26 results show the size of the balance sheet supporting that proposition. In its May 2026 SEC exhibit, Itau reported recurring managerial result of R$12.282 billion, annualized recurring managerial ROE of 24.8%, operating revenues of R$46.822 billion, managerial financial margin of R$32.326 billion and a total credit portfolio of R$1.4827 trillion excluding foreign-exchange variation (https://www.sec.gov/Archives/edgar/data/1132597/000113259726000153/pressreleaseontheresults.htm). The same release said the credit portfolio grew 9.0% year over year, financial margin with clients grew 4.5%, commissions and fees plus insurance result grew 5.3%, and the NPL ratio over 90 days stayed at 1.9%.

Those figures make Itau look like an efficient incumbent, but they also show why the account matters. A bank earning R$32.3 billion of quarterly financial margin with clients is not dependent only on transaction fees. It earns from funding, credit pricing, product mix and the ability to hold customers through cycles. Pix may lower some payment costs, but it can also make account balances more active and valuable if customers keep Itau as their primary financial hub.

The credit mix is part of the same story. Itau said 1Q26 growth was driven by government-program lending in the corporate segment and by mortgage, credit-card and payroll-loan growth in individuals. Those products behave differently in a downturn. Mortgages create long relationships but are sensitive to income and rates. Credit cards can produce fees, interchange and financing income but expose the bank to unsecured stress. Payroll loans are anchored by deduction mechanics but can become more competitive as regulation changes. The bank's ability to use payment and account data responsibly is therefore valuable only if it improves risk selection rather than encouraging undisciplined lending.

Itau's public narrative supports that interpretation. The 1Q26 release said the bank had calibrated portfolio composition with a focus on origination quality and credit conditions tailored to each client's profile. That sounds like a bank trying to turn data and account relationships into cycle resilience. The test is whether it can maintain that discipline while competitors offer simpler apps, lower fees and aggressive credit.

Fraud controls are part of the settlement price

Pix made money movement fast enough that fraud control became a user-experience problem. If a bank blocks too little, customers lose money and blame the bank. If it blocks too much, legitimate merchants and households see the bank as unreliable. If the review process is opaque, customers learn that instant payment is instant only when everything is normal.

The Banco Central's Pix FAQ says the Special Return Mechanism, known as MED, is a Pix mechanism created to facilitate refunds in fraud cases and increase the victim's chances of getting money back (https://www.bcb.gov.br/en/financialstability/pixfaqen). Itau publishes customer-facing explanations of that mechanism. One Itau article says fraud victims should contact the bank immediately so the MED can be attempted, while another explains that a request can be made within 80 days of the transaction and that the receiving account may be blocked while the case is reviewed (https://feito.itau.com.br/e-possivel-reverter-um-pix/; https://feito.itau.com.br/como-evitar-cair-no-golpe-do-pix-falso/).

The scale of the fraud workload is visible in Banco Central open data. For December 2025, the Pix fraud-statistics table showed 3.77 million contested Pix transactions, 322,571 accepted contests, R$573.9 million in accepted contested value, a 9.6% return percentage and R$303.0 million in accepted contested value not returned because of insufficient balance in the receiving account (https://olinda.bcb.gov.br/olinda/servico/Pix_DadosAbertos/versao/v1/odata/). Those numbers should not be read as an Itau-specific fraud rate. They show the system workload that every large participant must be able to process.

Timing rules add another layer. The Banco Central's Pix timing manual states that the maximum time count begins when the participant receives the payer's payment order and ends when settlement is completed, and it provides special maximum times for suspected-fraud cases, secondary transmission channels and transactions not settled through the SPI (https://www.bcb.gov.br/content/estabilidadefinanceira/pix/Regulamento_Pix/IX_ManualdeTemposdoPix.pdf). The merchant sees an immediate payment. The bank sees time limits, rejection rules, notifications, fraud-suspicion pathways and audit trails.

This is where Itau's cost base becomes a competitive argument. The 2025 Form 20-F warns that operating failures, human error or fraud can increase costs, cause losses, create conflicts with clients, trigger lawsuits, punitive damages, regulatory fines, sanctions, interventions and indemnity costs. It also warns that the bank depends on technology and information management because of the high volume of daily data processing, and that failures in power, telecommunications, clearing houses, third-party providers, service providers or cyberattacks could interrupt business (https://www.sec.gov/Archives/edgar/data/1132597/000113259726000132/itub-20251231.htm).

Those warnings are not boilerplate when Pix is central to daily commerce. A failed payment is no longer a rare back-office event. It can be a lunch counter, a ride, a rent payment, a payroll instruction, an ecommerce order or a supplier settlement. Itau has to run fraud review in a way that protects the customer without making the account feel capricious. That is expensive, but it is also where a large bank can differentiate itself from a narrow payment interface.

Card acquiring shows why payment is still working capital

Pix did not remove the card business. It forced banks and acquirers to prove why card acceptance, receivables anticipation and merchant services still deserve a margin. Itau's Redecard unit is the clearest example. The 2025 Form 20-F says Redecard's activities include merchant acquiring, capturing, transmitting, processing and settling credit and debit card transactions, prepayment of merchant receivables, point-of-sale terminal rental, ecommerce solutions, e-wallet and check verification. It says revenue from merchant-acquirer operations mostly consists of merchant discount rates charged on processed value, while costs include equipment maintenance and processing handling.

The numbers are large. Itau says it processed R$1.0254 trillion in credit and debit card transactions in 2025, up 11.7% from 2024. Credit-card transactions reached R$727.7 billion, up 16.4%, while debit-card transactions totaled R$297.6 billion, up 1.8%. According to ABECS as cited by Itau, Redecard had 22.7% of Brazilian merchant-acquiring volume in the twelve months ended 31 December 2025. Itau names Cielo and GetNet as traditional competitors, and PagSeguro and Stone among fintech challengers, in the same filing (https://www.sec.gov/Archives/edgar/data/1132597/000113259726000132/itub-20251231.htm).

The acquiring business explains why instant payments are not a clean substitute for all payments. A Pix payment can be cheap and final. A card transaction can carry credit, installments, chargeback rights, loyalty economics, cardholder financing, settlement timing and merchant receivables that can be advanced. A merchant may dislike merchant discount rates but still need card acceptance because customers want credit, loyalty points or installment plans. A bank may lose debit-card volume to Pix while preserving card income through credit and merchant-finance products.

StoneCo's 2025 disclosures show that payment challengers are not merely taking transactions; they are also building financial services around merchants. Stone's investor site says it filed its 2025 Form 20-F in April 2026, and its 4Q25 materials define total payment volume as including card volumes settled by StoneCo, including Pix QR Code transactions from merchants (https://investors.stone.co/; https://api.mziq.com/mzfilemanager/v2/d/46ed7b29-1318-408a-a036-ba544e2ecccb/2d44061e-2f9f-6a24-2141-3d48209d1d4c?origin=2). That matters because a merchant can now receive a blend of card, Pix and account services from non-bank platforms.

Itau's defense is to tie payment acceptance to a wider balance-sheet relationship. If a merchant uses Itau for Pix, cards, payroll, credit, receivables anticipation, insurance and business-account advice, the bank can still price the bundle even when one rail is cheap. If the merchant uses Itau only for a card terminal and sends Pix, deposits and working capital elsewhere, the bank loses the operating-account advantage.

Pix Automático sharpens the point. Itau Empresas describes Pix Automático as available from June 2025 for recurring payments and says it is currently available for receiving customers using APIs and CNABs, with support for recurring receipts and payments across more than 900 financial institutions (https://www.itau.com.br/empresas/pix/pix-automatico). Recurring Pix threatens parts of boleto, debit and card-on-file economics, but it also creates new control and reconciliation opportunities for banks that can serve businesses well. The bank that handles the recurring mandate, receipt, API and exception process can still be valuable. The bank that only holds the account number becomes easier to replace.

The expense line is the infrastructure story

Itau's profitability is impressive, but the expense line is where the infrastructure story becomes visible. In 1Q26, Itau reported R$16.188 billion of non-interest expenses, up 4.8% year over year. Its management discussion and analysis breaks Brazil non-interest expenses into commercial and administrative personnel, transactional operations and service, technology personnel and infrastructure, and other expenses. Technology in Brazil was R$3.087 billion in 1Q26, up 8.9% year over year, and the text attributes higher technology spending to cloud processing volume and systems development (https://www.sec.gov/Archives/edgar/data/1132597/000113259726000164/managementdiscussionanal.htm).

That technology spend is not decorative. It is the cost of making a large bank behave like a real-time utility. The same 1Q26 MD&A shows total employees of about 91.5 thousand at March 2026, including Avenue and Handy, and a total of 2,367 branches and client service branches, including 1,817 brick-and-mortar branches in Brazil, 300 client service branches in Brazil and 250 Latin America and IBBA points. The branch count has been falling, but the bank still needs physical recovery capacity, high-income advisory, SME support and exception handling. Digital banking reduces routine branch use, but it does not eliminate the need for human resolution when money is stuck.

The 2025 Form 20-F adds the physical infrastructure. Itau says it leases most bank branches on renewable leases, and that at 31 December 2025 it owned about 39% of bank branches, including electronic service stations, banking sites and parking facilities, and leased about 61%. It also mentions commercial departments, back offices, wholesale and investment bank activities and a data processing center in its properties discussion (https://www.sec.gov/Archives/edgar/data/1132597/000113259726000132/itub-20251231.htm). That matters because "digital bank" does not mean infrastructure-light at Itau's scale. It means the infrastructure is distributed across apps, branches, service centers, core systems, cyber controls, data centers, networks and third-party providers.

The bank's efficiency ratio shows both progress and pressure. The 1Q26 press release said Brazil's efficiency ratio reached 34.9%, its best first-quarter historical level, while the MD&A showed consolidated quarterly efficiency ratio of 37.1% and Brazil quarterly efficiency ratio of 34.9%. A lower efficiency ratio gives Itau room to absorb technology spending and still produce high returns. But the direction of spend matters. If technology reduces fraud, supports cloud scale, improves app uptime, lowers support contacts and keeps customer balances sticky, the spend is productive. If it merely keeps pace with rising user expectations and regulatory complexity, it becomes a toll for staying in the game.

The same filings also show why the cost cannot be viewed only as IT. Personnel expense rises with collective wage agreements and profit sharing. Transactional expenses rise with service volume. Cloud and systems development rise with digital activity. Compliance and cyber teams are embedded across business lines. Branches and client service branches still have rents, security, cash handling, documentation and trained staff. The merchant's free Pix receipt sits on top of all of that.

This makes Itau's valuation less about whether Pix is good or bad and more about whether Pix increases high-quality account usage enough to spread fixed cost. A bank with millions of active relationships can turn each incremental digital interaction into lower unit cost if the platform works. The same bank can suffer if customers use its infrastructure only when something is free and take profitable balances, credit and merchant services elsewhere.

Network-resource records show an operating edge, not a separate subject

Itau's internet-number records are useful because they show that the bank operates visible network resources under its own name. They should not be overread. A registered autonomous system or address block is not a bank branch, not a customer, not a product and not a separate corporate subject. It is evidence about the operating surface of a bank that has to keep apps, APIs and payment services reachable.

LACNIC RDAP for autnum 15256 identifies a direct allocation in Brazil, with the registrant shown as Itau Unibanco S.A. and related resources including 200.196.144.0/20, 2801:9e::/32, 200.9.199.0/24 and 138.59.160.0/22 (https://rdap.lacnic.net/rdap/autnum/15256). Registro.br RDAP for 200.196.144.0/20 identifies the block as an active Brazil allocation with nic.br autnum 15256, registration in 2000 and registrant Itau Unibanco S.A. (https://rdap.registro.br/ip/200.196.144.0/20). Public routing views such as bgp.tools and Hurricane Electric's BGP Toolkit show AS15256 as an Itau Unibanco network with originated IPv4 prefixes and Brazilian routing context (https://bgp.tools/as/15256; https://bgp.he.net/AS15256).

The value of this record is not that Itau is an internet operator in the same sense as a carrier. The value is that a large bank has a named network edge that can be compared with its app, API, payment and data-processing obligations. If a bank promises 24-hour payment access, account visibility and fraud recovery, its network dependencies are part of the trust equation. Address space and routing records do not prove uptime, security or data residency. They show that the bank's digital presence is not an abstraction.

Upstream and interconnection dependence remain important. BGP views identify upstream relationships, and the Form 20-F warns that Itau depends on third-party services for call centers, networks, internet, systems and data management providers. That combination is the real point. Itau has its own visible network resources, but it still depends on external connectivity, cloud processing, telecommunications, service providers, payment-market infrastructure, device ecosystems and central-bank systems. A bank-grade payment promise is therefore a chain, not a single server.

The Banco Central's May 2026 Financial Stability Report says financial market infrastructures contributed to safe and efficient market operation, that the financial system held enough intraday liquidity to ensure seamless transactions in the Brazilian Payment System, and that Pix continued to increase its relevance in the national financial system and Brazilian Payment System, representing around 29% of total retail payments in the second half of 2025 (https://www.bcb.gov.br/content/publications/financialstabilityreport/202605/fsrFullRep.pdf). That is the public-sector continuity layer around Itau's private stack. Itau cannot make Pix credible alone. It has to connect reliably to public infrastructure that also has to work.

This is why network-resource evidence belongs in the article but not as a headline identity. The records help price the hidden infrastructure behind the account. They do not turn IP blocks, autonomous-system numbers or routing tables into business actors. The actor is the bank. The records are a way to inspect a small part of the bank's operating footprint.

Data locality is accountability, not a promise that every component is local

Data sovereignty in banking is often discussed as if the only question is where servers sit. For Itau, the better question is who can supervise the data and operations that make customer money move. The bank is Brazilian, supervised by Brazilian financial authorities, embedded in Brazilian payment systems and responsible for Brazilian customers. At the same time, its filings say relevant service data location and processing may occur inside or outside Brazil, and that contracts for relevant data processing, storage and cloud computing cannot hinder Central Bank supervision; in some foreign-provider situations, prior Central Bank approval is required (https://www.sec.gov/Archives/edgar/data/1132597/000113259726000132/itub-20251231.htm).

That is a realistic description of a modern bank. Itau cannot simply declare a Brazil-only technology stack. It operates across 18 countries and territories, uses cloud processing, depends on third-party providers, runs international wholesale and private-banking activities, and has cross-border compliance obligations. But it also cannot outsource accountability. The bank must remain able to show regulators, customers, auditors and courts how data, payments and controls are handled.

Cybersecurity is the bridge between locality and trust. The Form 20-F says Itau is subject to cybersecurity and data-protection regulations including LGPD, CVM Resolution 35/2021, CMN Resolution 4,893/2021, Central Bank Resolution 85/2021, SUSEP Circular 638/2021 and SEC cybersecurity disclosure rules. It says compliance requires significant investments in technology, processes, governance and personnel, and it identifies cyber risks including system penetration, malware, contamination through third parties, unauthorized access, service unavailability and weaknesses at financial institutions, payment processors and other third parties. It also says Itau conducts stress tests of cybersecurity infrastructure, periodic awareness campaigns and mandatory cybersecurity training, and uses external cybersecurity companies and auditors for annual assessments and independent penetration tests.

In payment terms, that means the bank must protect both the public rail and the private account. A Pix transfer requires customer identity, device trust, key lookup, account validation, fraud monitoring, settlement, notifications and records. A card transaction requires merchant data, cardholder data, issuer and acquirer processing, settlement and dispute workflows. A business API requires permissions, certificates, files, logs and reconciliation. A branch exception requires staff access without excessive disclosure. A support case requires enough information to resolve a complaint without leaking data.

The economic return from data locality is not automatic. Customers do not pay a premium because a bank has a compliance framework. They pay, directly or indirectly, because the framework lets the account work through stress. The public record does not show enough about Itau's exact architecture, cloud-provider mix, incident rates or data-recovery times to make a stronger claim. The defensible conclusion is narrower: Itau's local-bank trust depends on its ability to keep global technology inputs accountable to Brazilian money, Brazilian supervisors and Brazilian customers.

Competitors are unbundling the same account from different sides

Itau's competitive problem is not one rival. It is a set of rivals attacking different profit pools around the account. Traditional banks such as Banco do Brasil, Bradesco, Santander Brasil and Caixa compete for deposits, payroll, mortgages, cards, branches, corporate accounts and government-linked lending. Itau's own 20-F names many of them across products, including individuals loans, payroll loans, mortgages, insurance, private pension and vehicle financing (https://www.sec.gov/Archives/edgar/data/1132597/000113259726000132/itub-20251231.htm).

Digital banks attack habit and customer attention. Nu Holdings said in its full-year 2025 release that it reached 131 million customers globally at December 2025 and that, in Brazil, Nu was the largest private financial institution by number of customers according to the Brazilian Central Bank (https://international.nubank.com.br/company/nu-holdings-ltd-reports-fourth-quarter-and-full-year-2025-financial-results/). Its SEC 20-F describes a strategy of building a large retail banking franchise in Latin America (https://www.sec.gov/Archives/edgar/data/1691493/000129281426002166/nuform20f_2025.htm). A customer who uses Nu for daily spending and Pix may still hold an Itau product, but Itau's ability to monetize the primary account weakens if daily attention moves.

Fintech acquirers and merchant platforms attack the business account. Itau names PagSeguro and Stone as growing competitors in acquiring. Stone's results and investor materials show a merchant platform that blends payments, banking-like services and software. That kind of competitor does not need to replace Itau's entire bank. It can take small merchant payment acceptance, receivables, deposits and working capital one slice at a time.

Open Finance attacks information control. Itau's Form 20-F says Brazil's Open Finance model allows customer-authorized sharing of data on products, services, customer records and transactions among regulated entities, and includes payment initiation and forwarding loan proposals through digital correspondent agents. That means Itau's data advantage depends increasingly on customer consent and actual service quality. If customers value Itau's account, they may authorize flows that deepen the relationship. If they see Itau as a costly legacy account, Open Finance makes comparison and switching easier.

Itau still has strengths that narrow competitors lack. It has a large credit portfolio, a broad revenue base, high profitability, a leading credit-card position by purchase volume, Redecard acquiring scale, private-banking and wholesale businesses, branch and advisory infrastructure, a visible technology budget, and a recognized brand. But the bundle has to earn its keep every day. Pix turns the basic money movement into a public expectation. Competitors then compete on what sits around that movement: interface, credit, yield, reconciliation, fraud handling, working-capital speed, business tools and customer support.

The best case for Itau is that the bank uses Pix to increase account centrality. More instant payments can mean more balance visibility, richer transaction history, more merchant stickiness and better credit underwriting. The worst case is that Pix commoditizes the bank's payment surface while competitors take the profitable add-ons. The public numbers do not decide the case yet. They show a bank strong enough to invest, but facing a market where payments alone no longer protect the relationship.

Customer chatter maps stress points, not service truth

Unofficial customer signals have to be handled carefully. App-store reviews, complaint platforms and social-media outage reports are self-selected. They do not measure Itau's full service quality and should not be treated as statistically representative. They are still useful because they reveal where bank trust is most likely to break: app access, Pix execution, receipt generation, fraud disputes, card blocks, support handoffs and account recovery.

Google Play lists the Banco Itau app with more than 100 million downloads and millions of reviews, while Apple's App Store page for the same app shows a high rating and visible comments that mix praise for usability with complaints about bugs, statement display and account support (https://play.google.com/store/apps/details?hl=en_US&id=com.itau; https://apps.apple.com/us/app/banco-ita%C3%BA-conta-cart%C3%A3o-e/id474505665). The Itau Empresas App Store review page shows a sharper business-user stress map, including complaints about slowness, interface issues and payment or transfer frustration (https://apps.apple.com/us/app/ita%C3%BA-empresas-conta-pj/id348274534?platform=iphone&see-all=reviews). These comments do not prove systemic failure. They show why business banking reliability matters more than design polish.

Reclame Aqui's Banco Itau page showed an 8.1/10 reputation score and 20,347 complaints at retrieval (https://www.reclameaqui.com.br/empresa/itau/). That is not a regulatory finding. It is a high-volume public complaint surface. Individual complaint pages include Pix contestation, unauthorized Pix, payment receipt and app-instability themes. Those are exactly the friction points a bank must minimize if it wants customers to keep the operating account primary.

The Banco Central complaint-ranking service explains that the ranking is built from complaints registered by citizens through the central bank's channels and that a sample of institution responses is analyzed, with complaints classified as founded when there is evidence of rule breach (https://www.gov.br/pt-br/servicos/acessar-o-ranking-de-reclamacoes-de-instituicoes-financeiras-e-administradoras-de-consorcios). Public posts by the Banco Central around quarterly rankings in 2025 placed Itau among the listed large institutions in at least one quarter, but the article should not infer more than that without the full table. The useful point is that complaint data exists as a formal pressure channel, and payment/account failures are visible to regulators as well as customers.

There were also press and social reports of Itau app instability affecting access, bill payment and Pix in October 2025, with the bank reportedly acknowledging a failure and saying the problem was normalized that evening (https://en.clickpetroleoegas.com.br/app-do-itau-trava-no-5o-dia-util-clientes-ficam-sem-pagar-contas-e-fazer-pix-banco-admite-falha-e-diz-que-problema-foi-normalizado-as-19h40-gls/). A single incident report is not a trend. It is a reminder of the payment-infrastructure standard. A bank app is judged most harshly on the day customers need to pay wages, bills or suppliers. In the Pix era, downtime is no longer just inconvenience; it can interrupt commerce.

Customer chatter therefore supports the article's main judgement only as a stress map. Itau has strong app-market signals and a large digital base, but every bank-grade payment promise contains a recovery promise. If a transfer fails, a receipt cannot be generated, a Pix fraud claim is delayed or the business app slows during a payment run, the customer learns the true price of infrastructure. The bank that resolves the event well preserves trust. The bank that sends the customer across disconnected channels turns free payment into expensive frustration.

Macro-credit risk decides whether the trust premium survives the cycle

Itau's payment infrastructure cannot be separated from credit risk. The same account that receives Pix payments may also support overdraft, credit card, payroll loan, vehicle financing, mortgage, merchant receivables anticipation, working capital or investment products. When rates are high and household debt service rises, the account can generate both revenue and losses.

The Banco Central's May 2026 Financial Stability Report provides the right macro frame. It says the BCB assesses no relevant risk to financial stability and that the National Financial System has comfortable capitalization and liquidity, with adequate provisions relative to expected losses. It also says credit slowdown continues in line with moderating growth, higher-risk household modalities are cooling, companies of all sizes are affected by slowdown, and future conditions are likely to become even more restrictive for household credit because of debt service-to-income and delinquency factors. The report says a contractionary policy-rate environment combined with high household and corporate indebtedness requires caution and diligence in credit granting, and that household problem assets rose across all modalities (https://www.bcb.gov.br/content/publications/financialstabilityreport/202605/fsrFullRep.pdf).

Itau's own 1Q26 results fit that backdrop. The bank's NPL ratio over 90 days was stable at 1.9%, and the release emphasized cautious credit discipline. The MD&A said cost of credit was R$10.0 billion in 1Q26, up 4.5% year over year, while the credit portfolio grew and NPL creation remained at historically low levels (https://www.sec.gov/Archives/edgar/data/1132597/000113259726000164/managementdiscussionanal.htm). That is a strong position, but it is not immunity. A bank with a R$1.48 trillion credit portfolio cannot separate payment trust from borrower income, rates, unemployment, business cash flow and collateral values.

Macro risk also affects the payment business through merchant health. If small merchants face weaker demand, higher funding costs or higher default risk, they may need more receivables anticipation and working capital but qualify for less. If households are stretched, card financing can generate revenue and delinquencies at the same time. If public credit programs support small-business portfolios, they can sustain growth but may change risk distribution and competitive pricing. If inflation and rates remain high, customers become more sensitive to account fees and spreads.

The public-sector continuity theme matters here. Itau is a private bank, but it operates inside a financial system shaped by central-bank settlement, Pix rules, Open Finance rules, compulsory deposits, capital requirements, payment-institution licensing, consumer protection and public credit programs. The bank benefits when public infrastructure is trusted; it also bears costs when public rules raise security, reporting, capital or consumer-protection standards. The BCB report's statement that Pix represented around 29% of total retail payments in the second half of 2025 means that payment continuity is now macro-relevant. A major bank's app and settlement reliability are part of the everyday economy.

The positive case is that Itau's scale, profitability and risk discipline let it absorb this environment better than smaller rivals. It can spread technology cost across a vast customer base, use payments data for risk models, maintain liquidity and capital buffers, and keep investing when weaker players pull back. The negative case is that high profitability partly reflects a favorable position in spreads and fee pools that Pix, fintech competition and Open Finance are structurally pressuring. A strong NPL ratio today does not answer whether the bank can keep customers loyal if payment margins fall and credit conditions tighten.

What would change the judgement

The evidence supports a balanced conclusion. Itau Unibanco is one of the strongest institutions in Brazilian finance, and the public record shows a bank with high profitability, significant technology spending, disciplined credit metrics, large acquiring volume, broad product reach and direct exposure to Brazil's real-time payment infrastructure. It is not a fragile payments app trying to become a bank. It is a bank trying to make its account infrastructure valuable in a market where payments have become public, instant and cheap.

The unresolved question is whether infrastructure trust can be separated from cyclical banking spread and fee income. Itau can say that Pix makes the account more useful. Skeptics can say Pix trains customers to expect free movement while competitors take deposits, merchant services and daily engagement. Both readings fit the current public record.

Several facts would change the judgement materially. Payment success rates and outage minutes by channel would show whether Itau's app and business platforms are becoming more reliable as volumes rise. Pix fraud loss, MED recovery, false-positive and support-resolution metrics would show whether fraud control is a moat or a drag. Active primary-account share, salary-account retention and business-account churn would show whether customers keep Itau as the account of record. Merchant Pix, card and receivables-anticipation volumes by segment would show whether Redecard and Itau Empresas are defending the merchant relationship. Cloud concentration, third-party incident impact and recovery-time disclosures would clarify supplier dependence. Account-level profitability after technology, compliance and support cost would show whether "free" payments actually lead to durable returns. Credit migration by income band, merchant size and product would show whether the bank's risk discipline survives a tougher cycle.

Until those figures are public, the prudent view is that Itau is selling a hidden infrastructure premium. The merchant sees instant money. The bank has to fund settlement readiness, fraud controls, uptime, branch and app support, cyber defense, data accountability, network reach and credit resilience. If enough customers keep their operating accounts, merchant services and borrowing relationships inside Itau because those controls work, Pix can reinforce the bank's franchise. If customers treat Itau's infrastructure as a free utility and move profitable activity elsewhere, the cheap-payment promise will become more expensive than it looks.