XBP Global Holdings, Inc.

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our Chief Executive Officer (“CEO”) and our Chief Financial Officer (“CFO”) has evaluated the effectiveness of the design and operation of our disclosure controls and procedures as of December 31, 2024. The term "disclosure controls and procedures," as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, or the Exchange Act, means controls and other procedures of a company that are designed to ensure that information required to be disclosed by the company in the reports that it files or submits under the Exchange Act of 1934 is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company's management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate, to allow timely decisions regarding required disclosure.

Our management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives, and our management necessarily applies its judgement in evaluating the cost-benefit relationship of possible controls and procedures. Based on such review and evaluation, our CEO and our CFO have concluded that as of December 31, 2024, our internal controls were effective at the reasonable assurance level for this purpose.

Management’s Report on Internal Control over Financial Reporting

Management, under the supervision of the board of directors, is responsible for establishing and maintaining adequate “internal control over financial reporting,” as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act. Our internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with U.S. GAAP and includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with U.S. GAAP, and that receipts and expenditures of the Company are being made only in accordance with authorizations of management and directors of the Company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the Company’s assets that could have a material effect on the financial statements. All internal control systems, no matter how well designed, have inherent limitations. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation. Because of its inherent limitations, a system of internal control over financial reporting may not prevent or detect misstatements.

Management, with participation of the CEO and CFO, under the oversight of our Board of Directors, assessed the effectiveness of our internal control over financial reporting as of December 31, 2024 using the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission in Internal Control- Integrated Framework (2013) (the “COSO 2013 Framework”). Based on its assessment, our management, including our CEO and CFO, has concluded that our internal control over financial reporting were effective as of December 31, 2024.

Remediation of Previously Reported Material Weakness

As previously disclosed, we identified a material weakness related to ineffective review controls over the financial statement closing process and the order-to-cash process, including the review of new agreements and work orders.

In response, and as part of the remediation plan, management under the overall SOX controls framework brought about a higher focus on the order-to-cash and the financial close and reporting process controls, expanded the Risks and Controls Matrix (RACM) language to address documentation gaps on control descriptions, designed and implemented specific period closure checklists to strengthen review controls for the financial close and reporting process, added experienced personnel across financial close and reporting and order-to-cash sub-processes, and established a Center of Excellence (COE) to strengthen the controls environment. As aforementioned, the effectiveness of the financial close and reporting and order-to-cash controls was tested and found to be effective. We have therefore concluded that the material weaknesses were remediated as of December 31, 2024.

We believe these efforts will enhance our financial reporting controls, though we may need to continue reviewing and modifying them as necessary in the future.

Changes in Internal Controls over Financial Reporting

No changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) occurred during the quarter ended December 31, 2024 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.