Paymentus Holdings Inc

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, evaluated, as of the end of the period covered by this Quarterly Report on Form 10-Q, the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended, or the Exchange Act). Based on that evaluation, and as a result of the material weaknesses in internal control over financial reporting described below, our Chief Executive Officer and Chief Financial Officer concluded that, as of September 30, 2024, our disclosure controls and procedures were not effective at the reasonable assurance level. In light of this fact, our management has performed additional analyses, reconciliations, and other post-closing procedures and has concluded that, notwithstanding the material weaknesses in our internal control over financial reporting, the unaudited condensed consolidated financial statements for the periods covered by and included in this Quarterly Report on Form 10-Q fairly state, in all material respects, our financial position, results of operations and cash flows for the periods presented in conformity with GAAP.

Material Weaknesses in Internal Control over Financial Reporting

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our financial statements will not be prevented or detected on a timely basis. As of September 30, 2024, our material weaknesses were as follows:

•

We lacked a sufficient number of trained professionals with an appropriate level of accounting knowledge, training and experience to appropriately analyze, record and disclose accounting matters, including accounting for capitalized internal-use software development costs, identification of reporting units, translation of foreign currency in consolidation, accounting for deferred compensation, calculation of earnings per share and classification of accounts in the financial statements. Additionally, we did not design and maintain effective controls over verifying the appropriate review and approval of journal entries.

•

We did not design and maintain effective controls relevant to the preparation of our financial statements with respect to certain IT general controls for information systems. Specifically, we did not design and maintain (1) program change management controls to ensure that IT program and data changes affecting certain IT applications and underlying accounting records are identified, tested, authorized and implemented appropriately; and (2) user access controls to ensure appropriate segregation of duties and that adequately restrict user and privileged access to financial applications, programs and data to appropriate company personnel.

Status of Remediation Plan

We believe we have made significant progress towards remediation of the material weaknesses described above. As previously disclosed, we have completed the following remediation measures:

•

onboarded experienced finance and accounting professionals at various senior roles;

•

updated the design of our general ledger accounting system to allow for effective restricted access and segregation of duties to govern the preparation and review of journal entries;

•

implemented management review controls over journal entries and the identification and review of complex transactions;

•

secured the general ledger accounting system by implementing single sign-on (SSO); and

•

implemented additional change management and access controls for our relevant IT applications to further restrict privileged access and implemented controls to review activities, which may materially affect our financial statements, for those users who have privileged access.

In addition to the aforementioned actions that have been completed to date, during the third quarter, we continued to enhance the design and implementation of certain IT general controls for information systems. While we believe that these actions will remediate the material weaknesses, the material weaknesses will not be considered remediated until the applicable controls have operated for a sufficient period of time, and management has concluded, through testing, that these controls are designed and operating effectively.

Changes in Internal Control over Financial Reporting

Other than continuing to make progress on the ongoing remediation efforts described above, there were no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the three months ended September 30, 2024 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Inherent Limitations on Effectiveness of Controls

Management does not expect that our disclosure controls and procedures or our internal control over financial reporting will prevent or detect all errors and all fraud. A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, within the company have been detected. The design of any system of controls also is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Over time, controls may become inadequate because of changes in conditions, or the degree of compliance with the policies or procedures may deteriorate. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected.

PART II—OTHER INFORMATION