CPI Card Group Inc.

Evaluation of Disclosure Controls and Procedures

Our management, under the supervision and with the participation of the Chief Executive Officer and Interim Chief Financial Officer, has evaluated the effectiveness of our controls and procedures related to our reporting and disclosure obligations (as defined by Rules 13a-15(e) and 15d-15(e) within the Exchange Act of 1934) as of March 31, 2026, which is the end of the period covered by this Quarterly Report on Form 10-Q. Based on that evaluation, the Chief Executive Officer and Interim Chief Financial Officer have concluded that, as of March 31, 2026, the disclosure controls and procedures were effective to ensure that information required to be disclosed by us in the reports we file or submit under the Exchange Act, is recorded, processed, summarized and reported, as applicable, within the time periods specified in the rules and forms of the SEC, and are designed to ensure that information required to be disclosed by us in the reports that we file or submit is accumulated and communicated to our management, including our Chief Executive Officer and Interim Chief Financial Officer, to allow timely decisions regarding required disclosure.

Changes in Internal Control over Financial Reporting

On May 6, 2025, the Company acquired Arroweye. We are currently in the process of integrating Arroweye's controls and processes into our control environment and will incorporate Arroweye in our assessment of the effectiveness of our internal control over financial reporting as of the end of 2026. Other than the change related to the integration of Arroweye, there were no changes that occurred during the fiscal quarter covered by this Quarterly Report on Form 10-Q that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.