CORPAY, INC.

Evaluation of Disclosure Controls and Procedures

As of June 30, 2025, management carried out, under the supervision and with the participation of our Chief Executive Officer and Chief Financial Officer, an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934). Based on this evaluation, and as a result of the material weakness described below, our Chief Executive Officer and Chief Financial Officer concluded that, as of June 30, 2025, our disclosure controls and procedures were not effective in ensuring that information required to be disclosed by us in the reports that we file or submit under the Securities Exchange Act of 1934, as amended, is recorded, processed, summarized and reported within the time periods specified in applicable rules and forms and are not designed to ensure that information required to be disclosed in those reports is accumulated and communicated to management, including our Chief Executive Officer and Chief Financial Officer, as appropriate to allow timely decisions regarding required disclosure.

As discussed in our Annual Report on Form 10-K for the year ended December 31, 2024, we identified the following material weakness in internal controls:

(1) A material weakness in internal control related to ineffective information technology general controls (ITGCs) in the area of user access management over certain information technology systems used in the execution of controls that support the Company’s financial reporting processes. Our business process application and manual controls that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted. We believe that these control deficiencies were the result of challenges in the prior year implementation of technology aimed to automate the user access review process. Specifically, these deficiencies pertained to the completeness and accuracy of data used in the automated solution and in existing manual user access control processes that lacked sufficient documentation and formality, as well as insufficient training of information technology personnel responsible for the execution and documentation of ITGCs. The material weakness did not result in any identified misstatements to the financial statements, and there were no changes to previously released financial results.

As a result of the material weakness identified, the Company is updating its internal control over financial reporting as discussed in its remediation plan updated below.

Remediation Update

(1) Our management continues to implement measures to ensure that control deficiencies contributing to the material weakness are remediated, such that these controls are designed, implemented and operating effectively. The remediation actions include: (i) enhancing the information technology compliance oversight function; (ii) developing a training program addressing ITGCs and policies, including educating control owners concerning the principles and requirements of internal controls, with a focus on those related to user access over information technology systems impacting financial reporting; (iii) developing and maintaining documentation underlying ITGCs to enhance the information evidencing the performance of ITGCs; (iv) developing enhanced integration functionality and controls related to the ongoing implementation of user access information technology system; (v) enhancing the information technology management review and testing plan to monitor ITGCs with a specific focus on systems supporting our financial reporting processes; and (vi) enhancing quarterly reporting on the remediation measures to the Audit Committee of the Board.

We believe that these actions will remediate the material weakness. The material weaknesses will not be considered remediated, however, until the applicable controls operate for a sufficient period of time and our management has concluded, through testing, that these controls are operating effectively.

Changes in Internal Control over Financial Reporting

Except for the remediation described above, there have been no other changes in our internal control over financial reporting (as defined in Rules 13a-15(f) or 15d-15(f) of the Exchange Act) during the quarter ended June 30, 2025, that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

PART II—OTHER INFORMATION