Sally Beauty Holdings, Inc.

Background.

-39 -

Attached as exhibits to this Annual Report on Form 10-K are certifications of our CEO and our CFO, which are required in accordance with Rule 13a-14 of the Exchange Act. This “Controls and Procedures” section includes information concerning the controls and controls evaluation referred to in the certifications. Part II, Item 8 — Financial Statements and Supplementary Data of this Annual Report on Form 10-K sets forth the attestation report of KPMG LLP, our independent registered public accounting firm, regarding its audit of our internal control over financial reporting. This section should be read in conjunction with the certifications and the KPMG attestation report for a more complete understanding of the topics presented.

Controls Evaluation and Related CEO and CFO Certifications.

Our management, with the participation of our CEO and CFO, conducted an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures as of the end of the period covered by this Annual Report. The controls evaluation was conducted by our Disclosure Committee, comprised of senior representatives from our finance, accounting, IT security, internal audit and legal departments under the supervision of our CEO and CFO.

Certifications of our CEO and our CFO, which are required in accordance with Rule 13a-14 of the Exchange Act, are attached as exhibits to this Annual Report. This “Controls and Procedures” section includes the information concerning the controls evaluation referred to in the certifications, and it should be read in conjunction with the certifications for a more complete understanding of the topics presented.

Limitations on the Effectiveness of Controls.

We do not expect our disclosure controls and procedures will prevent all errors and all fraud. A system of controls and procedures, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the system are met. Because of the limitations in all such systems, no evaluation can provide absolute assurance that all control issues and instances of fraud, if any, within the Company have been detected. Furthermore, the design of any system of controls and procedures is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions, regardless of how unlikely. Because of these inherent limitations in a cost-effective system of controls and procedures, misstatements or omissions due to error or fraud may occur and may not be detected.

Scope of the Controls Evaluation.

The evaluation of our disclosure controls and procedures included a review of their objectives and design, our implementation of the controls and procedures and the effect of the controls and procedures on the information generated for use in this Annual Report. In the course of the evaluation, we sought to identify whether we had any data errors, control problems or acts of fraud and to confirm appropriate corrective action, including process improvements, was being undertaken if needed. This type of evaluation is performed on a quarterly basis so conclusions concerning the effectiveness of our disclosure controls and procedures can be reported in our Quarterly Reports on Form 10-Q and our Annual Reports on Form 10-K. Many of the components of our disclosure controls and procedures are also evaluated by our internal audit department, by our legal department and by personnel in our finance organization. The overall goals of these various evaluation activities are to monitor our disclosure controls and procedures on an ongoing basis and to maintain them as dynamic systems that change as conditions warrant.

Conclusions regarding Disclosure Controls.

Based on the required evaluation of our disclosure controls and procedures, our CEO and CFO have concluded that, as of September 30, 2025, we maintain disclosure controls and procedures that are effective in providing reasonable assurance that information required to be disclosed by us in the reports that we file or submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and such information is accumulated and communicated to our management, including our CEO and CFO, as appropriate to allow timely decisions regarding required disclosure.

Management’s Annual Report on Internal Control over Financial Reporting.

Management of the Company, including the CEO and CFO, is responsible for establishing and maintaining adequate internal control over financial reporting as defined in Rule 13a-15(f) under the Exchange Act. Our internal control system was designed to provide reasonable assurance to management and our Board of Directors regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

-40 -

All internal control systems, no matter how well designed, have inherent limitations. A system of internal controls may become inadequate over time because of changes in conditions or deterioration in the degree of compliance with the policies or procedures. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation.

Management assessed the effectiveness of our internal control over financial reporting as of September 30, 2025 using the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control-Integrated Framework (2013). Based on this assessment, management has concluded that, as of September 30, 2025, our internal control over financial reporting was effective to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles based on such criteria.

Report of Independent Registered Public Accounting Firm.

Please refer to KPMG’s Report of Independent Registered Public Accounting Firm on Internal Control over Financial Reporting on page F-1 of the financial statements, which begin on page 50 of this Annual Report.

Changes in Internal Control over Financial Reporting. During our last fiscal quarter, there were no changes in our internal control over financial reporting that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.