Kyndryl Holdings Inc

The Company’s management evaluated, with the participation of the Chief Executive Officer and Chief Financial Officer, the effectiveness of the Company’s disclosure controls and procedures (as such term is defined in Rule 13a-15(e) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”)) as of the end of the period covered by this report. Based on that evaluation, the Chief Executive Officer and Chief Financial Officer have concluded that the Company’s disclosure controls and procedures were not effective as of the end of the period covered by this report due to a material weakness in internal control over financial reporting in the area of our information technology general controls (“ITGCs”) that was disclosed in Part II, Item 9A of the Company’s Form 10-K. The deficiencies in ITGCs were related to access and program development and change management controls associated with the Company’s large-scale migration in a compressed timeframe of its internal operating systems to a new enterprise resource planning system, which was required to replace the systems temporarily being made available to the Company by our former Parent following our Spin-off. These control deficiencies did not result in a misstatement to the annual or interim consolidated financial statements previously filed or included in this Form 10-Q.

Changes in Internal Control over Financial Reporting

There have been no changes in the Company’s internal control over financial reporting (as such term is defined in Rule 13a-15(f) of the Exchange Act) that occurred during the period covered by this report that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting other than the ongoing remediation of the ITGC deficiencies described below.

Remediation

As previously described in Part II, Item 9A of the Company’s Form 10-K, the Company began implementing a remediation plan to address ITGC deficiencies. This plan includes but is not limited to (i) implementing and/or formalizing additional controls across our information technology environment, including user access and segregation of duty controls, program development and change management controls, and certain computer operations controls, and (ii) training of relevant personnel on the design and operation of any new or modified ITGCs. The remediation plan is subject to ongoing management review, as well as oversight by the Audit Committee of our Board. The deficiencies will not be considered fully remediated, until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. The Company expects to complete the implementation of its remediation plan during fiscal year 2025.