Paymentus Holdings Inc

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures (as defined in Rule 13a-15(e) under the Securities Exchange Act of 1934, as amended, the Exchange Act) that are designed to ensure that information required to be disclosed in our reports filed or submitted under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC's rules and forms and that such information is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosures. Any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives.

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, evaluated, as of the end of the period covered by this Annual Report on Form 10-K, the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) under the Exchange Act). Based on that evaluation, and solely as a result of the material weaknesses in internal control over financial reporting described below, our Chief Executive Officer and Chief Financial Officer concluded that, as of December 31, 2023, our disclosure controls and procedures were not effective at the reasonable assurance level. In light of this fact, our management has performed additional analyses, reconciliations, and other post-closing procedures and has concluded that, notwithstanding the material weaknesses in our internal control over financial reporting, the consolidated financial statements for the periods covered by and included in this Annual Report on Form 10-K fairly state, in all material respects, our financial position, results of operations and cash flows for the periods presented in conformity with GAAP.

Management’s Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting, as such term is defined in Rule 13a-15(f) under the Exchange Act. Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles in the United States of America. Internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with GAAP, and that receipts and expenditures of the Company are being made only in accordance with authorizations of management and directors of the Company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the Company’s assets that could have a material effect on its financial statements.

Our management, including our Chief Executive Officer and Chief Financial Officer conducted an assessment of the effectiveness of our internal control over financial reporting as of December 31, 2023. In making this assessment, the Chief Executive Officer and Chief Financial Officer used the criteria set forth in Internal Control-Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission, the COSO framework. Based upon this evaluation, our Chief Executive Officer and Chief Financial Officer concluded that, as of December 31, 2023, our internal control over financial reporting was not effective because of material weaknesses in internal control over financial reporting described below.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our financial statements will not be prevented or detected on a timely basis. As of the end of the period covered by this report, our material weaknesses are as follows:

•

We lacked a sufficient number of trained professionals with an appropriate level of accounting knowledge, training and experience to appropriately analyze, record and disclose accounting matters, including accounting for capitalized internal-use software development costs, identification of reporting units, translation of foreign currency in consolidation, accounting for deferred compensation, calculation of earnings per share and classification of accounts in the financial statements. Additionally, we did not design and maintain effective controls over verifying the appropriate review and approval of journal entries.

•

We did not design and maintain effective controls relevant to the preparation of our financial statements with respect to certain IT general controls for information systems. Specifically, we did not design and maintain (1) program change management controls to ensure that IT program and data changes affecting certain IT applications and underlying accounting records are identified, tested, authorized and implemented appropriately; and (2) user access controls to ensure appropriate segregation of duties and that adequately restrict user and privileged access to financial applications, programs and data to appropriate company personnel.

These material weaknesses resulted in misstatements related to capitalized internal-use software development costs, accumulated other comprehensive income, cost of revenue, sales and marketing expenses, research and development expenses, general and administrative expenses, income tax expense, the disclosure of deferred compensation, the classification of revenue, sales and marketing expenses, research and development expenses and general and administrative expenses, the calculation of earnings per share and the disclosure of revenue by geography as of and for the year ended December 31, 2019, which resulted in the restatement of the 2019 consolidated financial statements and a classification adjustment that was recorded to revenue and sales and marketing expenses in the 2020 consolidated financial statements. Additionally, these material weaknesses could result in a misstatement of substantially all of our accounts or disclosures that would result in a material misstatement to the annual or interim consolidated financial statements that would not be prevented or detected.

Remediation Plan

We believe we have made significant progress towards remediation of the material weaknesses described above. We have completed the following remediation measures:

•

onboarded experienced finance and accounting professionals at various senior roles;

•

updated the design of our general ledger accounting system to allow for effective restricted access and segregation of duties to govern the preparation and review of journal entries;

•

implemented management review controls over journal entries and the identification and review of complex transactions;

•

secured the general ledger accounting system by implementing single sign-on (SSO); and

•

implemented additional change management and access controls for our relevant IT applications to further restrict privileged access and implemented controls to review activities, which may materially affect our financial statements, for those users who have privileged access.

We are currently in the process of assessing the effectiveness of design and implementation of controls to address all material weaknesses. Upon completing this assessment, thorough operating effectiveness testing will be performed to ensure that the implemented controls operated effectively for a sufficient period of time. While we believe these efforts will remediate the material weaknesses, these material weaknesses cannot be considered fully remediated until the applicable remedial controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively.

Changes in Internal Control over Financial Reporting

There were no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the three months ended December 31, 2023 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Inherent Limitations on Effectiveness of Controls

Management does not expect that our disclosure controls and procedures or our internal control over financial reporting will prevent or detect all errors and all fraud. A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, within the company have been detected. The design of any system of controls also is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Over time, controls may become inadequate because of changes in conditions, or the degree of compliance with the policies or procedures may deteriorate. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected.