PennantPark Floating Rate Capital Ltd.

isk Factors

In addition to the other information set forth in this Report, you should consider carefully the factors discussed below, as well as in Part I “Item 1A. Risk Factors” in our Annual Report on Form 10-K for the fiscal year ended September 30, 2024 filed on November 26, 2024, which could materially affect our business, financial condition and/or operating results. The risks described as in our Annual Report on Form 10-K are not the only risks facing PennantPark Floating Rate Capital Ltd. Additional risks and uncertainties not currently known to us or that we currently deem to be immaterial also may materially and adversely affect our business, financial condition and/or operating results.

Changes to U.S. tariff and import/export regulations may have a negative effect on our portfolio companies.

There have been significant changes to U.S. trade policies, treaties and tariffs, and in the future there may be additional significant changes. Existing or new tariffs imposed on foreign goods imported by the United States or on U.S. goods imported by foreign countries could subject us or our portfolio companies to additional risks. Among other effects, tariffs may increase the cost of production for certain of our portfolio companies or reduce demand for their products, which could adversely affect their results of operations. We cannot predict whether, or to what extent, any tariff or other trade protections may affect our portfolio

companies or our business, financial condition or results of operations.

We are subject to risks associated with cybersecurity and cyber incidents.

Our internal computer systems and infrastructure and those of our Investment Adviser, strategic collaborators, vendors, contractors, consultants or regulators with whom we share confidential, protected or sensitive data or information, or upon which our business relies, are vulnerable to damage from computer viruses, unauthorized access, misuse, natural disasters, terrorism, cybersecurity threats, war and telecommunication and electrical failures, as well as security compromises or breaches, which may compromise our systems, infrastructure, data or that of those with whom we share such data or information or upon which our business relies, or lead to data compromise, misuse, misappropriation or leakage. We may experience, and from time to time have experienced, cyber attacks on our information technology systems and infrastructure by threat actors of all types (including nation states, criminal enterprises, individual actors or advanced persistent threat groups, among others). In addition to extracting sensitive information, such attacks could include the deployment of harmful malware, ransomware, digital extortion, business email compromises and denial-of-service attacks, social engineering (including phishing attacks) and other means to affect server reliability and threaten the confidentiality, integrity and availability of information, systems or infrastructure.

As our reliance on technology has increased, so have the risks posed to our information systems, both internal and those provided by our Investment Adviser and other third-parties. We, along with our Investment Adviser, have implemented processes, procedures and internal controls to help mitigate cybersecurity risks and cyber-attacks, but these measures, as well as our increased awareness of the nature and extent of the risk of a cyber attack, may be ineffective and do not guarantee that a cyber attack will not occur or that our financial results, operations or confidential information will not be negatively impacted by such an attack. Further, our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages or claims related to our privacy and data security obligations. Further, although we maintain cyber liability insurance, this insurance may not provide adequate coverage against potential liabilities related to any experienced cybersecurity attack or breach.

Furthermore, cybersecurity continues to be a priority for regulators around the world, and some jurisdictions have enacted laws requiring companies to notify individuals and/or regulators of data security breaches involving certain types of personal information. If we fail to comply with the relevant laws and regulations, we could suffer financial losses, a disruption of our businesses, liability to investors, regulatory intervention or reputational damage.