XBP Global Holdings, Inc.

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our Chief Executive Officer (“CEO”) and our Chief Financial Officer (“CFO”) has evaluated the effectiveness of the design and operation of our disclosure controls and procedures as of December 31, 2025. The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, or the Exchange Act, means controls and other procedures of a company that are designed to ensure that information required to be disclosed by the company in the reports that it files or submits under the Exchange Act of 1934 is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company's management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate, to allow timely decisions regarding required disclosure.

Our management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives. Based on such review and evaluation, our CEO and our CFO have concluded that as of December 31, 2025, our disclosure controls and procedures were not effective at the reasonable assurance level for this purpose, solely because of the material weaknesses in our internal control over financial reporting identified in relation to our financial reporting processes discussed below.

Management’s Report on Internal Control over Financial Reporting

Management, under the supervision of the board of directors, is responsible for establishing and maintaining adequate “internal control over financial reporting” (“ICFR”), as defined in Exchange Act Rules 13a-15(f) and 15d-15(f). ICFR refers to the processes designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with GAAP.

Our ICFR is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP and includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with GAAP, and that receipts and expenditures of the Company are being made only in accordance with authorizations of management and directors of the Company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the Company’s assets that could have a material effect on the financial statements. All internal control systems, no matter how well designed, have inherent limitations. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation. Because of its inherent limitations, a system of internal control over financial reporting may not prevent or detect misstatements.

A material weakness, as defined in Exchange Act Rule 12b-2, is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of a company’s annual or interim consolidated financial statements will not be prevented or detected on a timely basis.

As elaborated in the notes to our consolidated and combined financial statements under Note 1*, Description of the Business*, on July 3, 2025, pursuant to the MIPA, a wholly owned subsidiary of XBP Europe Holdings, Inc. agreed to purchase BPA. This transaction, referred to herein as the Business Combination, was subject to certain conditions

subsequent, including emergence of BPA and certain of its affiliates from the Chapter 11 Cases, which occurred on July 29, 2025. On July 29, 2025, BPA consummated the Restructuring and emerged from bankruptcy having satisfied or waived all the conditions set forth in the Plan. As a result, all conditions subsequent to the MIPA were met, and the acquisition was deemed closed from an accounting perspective as of July 29, 2025. For financial reporting purposes, BPA was determined to be the “accounting acquirer”. Being the accounting acquirer means that BPA’s assets, liabilities, and historical financial statements form the basis of the combined company’s financial reporting, and, accordingly, the historical results of XBP Europe Holdings, Inc. are not included for periods prior to the Business Combination.

Material weakness in BPAs internal control over financial reporting were previously reported in the risk factors section of the Company’s Proxy Statement Pursuant to Section 14(a) of the Securities Exchange Act of 1934 filed with the SEC on July 15, 2025. BPA had concluded its internal control over financial reporting was not effective as of December 31, 2024 due to pervasive material weaknesses in its internal control over financial reporting. BPA management, with the participation of their Principal Executive Officer and their Interim Chief Financial Officer, had evaluated the effectiveness of their disclosure controls and procedures as of December 31, 2024. Based upon that evaluation, it was concluded that pervasive material weaknesses in internal control over financial reporting existed as described below.

​BPA management concluded that these deficiencies were largely caused by an ineffective control environment. Management reassessed the controls of the combined entity (XBP Global Holdings Inc.) after the Business Combination and determined that the material weaknesses persisted for the reporting period as of September 30, 2025.

As of the end of the period covered by this report, we carried out an evaluation, under the supervision and with the participation of our management, including our CEO and CFO, of the effectiveness of our internal control over financial reporting. Based upon that evaluation, our CEO and CFO concluded that our internal control over financial reporting was not effective as of December 31, 2025 solely due to the material weaknesses in our internal control over financial reporting as discussed below:

measures including domain integration, implementation of identity and access management solutions, and AI enabled tools to ensure timely revocation of access of terminated users to effectively remediate the reported material weakness.

Notwithstanding such material weaknesses in internal control over financial reporting, our management, including our CEO and CFO, has concluded that our consolidated and combined financial statements present fairly, in all material aspects, our financial position, results of our operations and our cash flows for the periods presented in this report, in conformity with GAAP.

Remediation of Material Weaknesses

We are undertaking the following remediation measures with appropriate executive sponsorship, to specifically address the material weaknesses related to the financial reporting processes, and the control environment and information and communication components, to further strengthen internal controls:

Management intends to deploy the aforementioned additional remediation measures during the year ending December 31, 2026. The effort may require incremental time and resources to remediate, and we may decide to take other measures with appropriate executive sponsorship to address the material weaknesses or modify the remediation steps described above. The material weaknesses will not be considered remediated until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. Until these deficiencies are remediated, we plan to continue to perform additional analyses and other procedures to ensure that our consolidated financial statements are prepared in accordance with GAAP.

Changes in Internal Controls over Financial Reporting

During the year ended December 31, 2025, the Business Combination resulted in a change from what the XBP Europe Holdings, Inc. previously reported in its standalone filings because the combined company’s historical financial statements and ICFR are based on BPA as the accounting acquirer. This represents a change in reporting basis, not the emergence of new deficiencies. The material weaknesses described above were pre-existing at BPA and continued following the Business Combination and therefore do not constitute a “change” in ICFR introducing additional material weaknesses for purposes of Item 308(c) of Regulation S-K. Other than as described above, there were no changes in our internal control over financial reporting during the year ended December 31, 2025 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.