NewtekOne Inc

(a) Evaluation of Disclosure Controls and Procedures:

As of December 31, 2023 (the end of the period covered by this report), management evaluated the effectiveness of the design and operation of the Company’s disclosure controls and procedures (as defined in Rule 13a-15(e) of the Exchange Act).

Based on the evaluation of our disclosure controls and procedures management concluded that the Company’s disclosure controls and procedures were not effective as of December 31, 2023, due to certain factors including identified material weaknesses. A material weakness (as defined in Rule 12b-2 under the Exchange Act) is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of annual or interim financial statements will be presented or not detected on a timely basis.

Based on additional analysis and other procedures performed by management, management concluded that the Consolidated Financial Statements included in this report fairly present in all material respects the Company’s financial position, results of operations, capital position, and cash flows for the periods presented, in conformity with U.S. GAAP. See the discussion below under “Management’s Report on Internal Control Over Financial Reporting” for further information regarding the material weaknesses identified, as well as “NOTE 24—SELECTED QUARTERLY FINANCIAL DATA (UNAUDITED)” to our consolidated financial statements included in “Item 15. Exhibits and Financial Statement Schedules” of this Form 10-K for further information regarding the 2023 prior period adjustments.

(b) Management’s Report on Internal Control over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting (“ICFR”) and for performing an assessment of the effectiveness of ICFR as of December 31, 2023, as such term is defined in Exchange Act Rule 13a-15(f). ICFR is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP. The Company’s ICFR includes those policies and procedures that (i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Company; (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with GAAP, and that receipts and expenditures of the Company are being made only in accordance with authorizations of management and the Board ; and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the Company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, ICFR may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risks that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Management assessed the effectiveness of our ICFR based upon the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) in Internal Control — Integrated Framework (2013). Based on this assessment, management concluded that the Company did not maintain effective ICFR as of December 31, 2023, as a result of the material weaknesses described below.

Material Weaknesses in Internal Control Over Financial Reporting

The material weaknesses that were identified are as follows:

•Significant Unusual Transactions – As noted in Item 1. Business, the Company completed the Acquisition and converted from a BDC to a financial holding company effective January 6, 2023, which caused a major restructuring within the Company, including a transition from being regulated under the 1940 Act and no longer qualifying for accounting treatment as an investment company, which resulted in a significant change in the Company’s accounting and financial reporting requirements for the year ended December 31, 2023. Given the effect of the Acquisition on the Company’s accounting and reporting requirements, the Company expended considerable capital and resources and engaged a reputable, national public accounting firm to assist management with this transition. Ultimately, the Company did not adequately or appropriately identify and assess changes and resulting risks that could significantly impact the system of internal control. This material weakness impacted the consolidation of the control investments that occurred on January 6, 2023 and the three subsequent interim periods, specifically goodwill and intangibles, net deferred tax assets, income taxes receivable, income tax expense, additional paid in capital, non-interest income and expense, and EPS. It also could affect all transaction cycles within the financial statements.

•SOX Governance Program – Further adding to the complexity of the significant unusual transactions, the Company’s previously unconsolidated portfolio companies became consolidated subsidiaries subject to the heightened standards of ICFR required by a SEC registrant under SOX 404 for the first time. While the Company engaged a reputable, national public accounting firm to prepare for this transition and the Acquisition, as noted above, there were significant delays in the documentation of the internal control environment’s processes, resulting in inadequate and untimely identification of financial reporting risks and the associated identification of key controls. This material weakness in our control environment impacted the overall effectiveness of our ICFR and also contributed to the Company adjusting its previously issued quarterly financial statements for 2023 as discussed in “NOTE 24—SELECTED QUARTERLY FINANCIAL DATA (UNAUDITED)” to our consolidated financial statements. This material weakness could affect all transaction cycles within the financial statements.

•Knowledge, Skills, and Experience of Staff – Given the conversion to a financial holding company, the knowledge, skills, and experience of Company staff that comprised those with a financial reporting oversight role consisted of individuals with experience at a public investment company and/or BDC, in positions with less financial reporting oversight at public companies, and/or limited public accounting experience auditing public financial holding companies. This impacted the overall effectiveness of the Company’s ICFR and also contributed to the Company adjusting its previously issued quarterly condensed financial statements for 2023, as discussed in “NOTE 24—SELECTED QUARTERLY FINANCIAL DATA (UNAUDITED)” to our consolidated financial statements. This material weakness could affect all transaction cycles within the financial statements.

•Information Technology General Controls (ITGC) – In the course of completing the Company’s assessment of ICFR as of December 31, 2023, management identified a number of deficiencies related to the design and operating effectiveness of ITGCs for information systems that comprised part of the Company’s system of ICFR and are relevant to the preparation of the Company’s consolidated financial statements (such information technology systems are referred to as the “Affected IT Systems”). These deficiencies in the design and operating effectiveness of the controls involved logical access and program change management that are intended to ensure that access to financial applications and data are adequately restricted to appropriate personnel, and that changes affecting the financial applications and underlying account records are identified, authorized, tested and implemented appropriately. The material weakness was due to system limitations as a result to the age of the technology, which resulted in management’s inability to generate details of configuration, changes, and settings to evidence the operating effectiveness of ITGCs. Management has concluded that deficiencies in ITGC logical access and related program change management, including controls intended to ensure that access rights are compatible with job duties (segregation of duties) and to test changes to relevant information systems, existed and therefore represented a material weakness. This material weakness could affect all transaction cycles within the financial statements.

•Management Review Controls– Management identified deficiencies due to the design and operating effectiveness of management review controls, including documentation and the level of precision. The deficiencies related to control gaps, unmitigated risks, untimely review, insufficient documentation, improper testing procedures, and inconsistent performance frequency of certain controls. This includes ITGCs that did not operate effectively due to insufficient management review controls related to the precision of the review, completeness and accuracy and insufficient evidence of report lists, and the parameters used to generate such report lists. The Company did not sufficiently document and deploy appropriate control activities through policies that establish what is expected and in procedures that put policies into action which resulted in a material weakness. This material weakness could affect all transaction cycles within the financial statements.

•Completeness and Accuracy of Information Produced by the Entity (“IPE”) – Management identified deficiencies due to a lack of available and reliable IPE, including multiple control gaps. The control gaps are related to reports extracted from Affected IT Systems that were not verified for completeness and accuracy. These deficiencies related to untimely review, insufficient documentation, improper testing procedures, and ineffective design of certain controls. Management did not sufficiently select and develop IPE control activities that contribute to the mitigation of risks to achieve the reduction of risk to acceptable levels which resulted in a material weakness. This material weakness could affect all transaction cycles within the financial statements.

•NTS System Conversion– NTS’s system of record for webhosting revenue was converted during the first quarter of 2023 and certain changes made to the sunsetting system and the newly implemented system to which it was converted were not tested and approved in a separate environment prior to being placed into production, which is a program change management ITGC. As it specifically relates to this system conversion, the deficiencies in the aforementioned change management controls resulted in this material weakness as management did not develop sufficient general control activities over technology to support the achievement of the conversion’s objectives. This material weakness impacted other assets, retained earnings, technology services expense, and technology and IT support income.

•NTS Revenue Cycle – Multiple controls over revenue recognition at NTS were not designed and implemented appropriately and/or did not operate effectively. As it specifically relates to this deficiency, there was excessive turnover in the NTS controller role which led to the deficiencies in design, implementation, and operating effectiveness of the controls. Management did not consistently retain individuals in that financial reporting oversight role resulting in a material weakness This material weakness impacted other assets, retained earnings, technology services expense, and technology and IT support income.

(c) Audit Report of the Registered Public Accounting Firm.

RSM US LLP, our independent registered public accounting firm, has issued an audit report on the effectiveness of the Company’s internal control over financial reporting as of December 31, 2023, as stated in its report, which is included under “ITEM 8. CONSOLIDATED FINANCIAL STATEMENTS AND SUPPLEMENTARY DATA” of this annual report on Form 10-K, which is consistent with management’s report on ICFR as set forth above.

(d) Changes in Internal Control over Financial Reporting.

Except as described below under “Remediation Process,” there were no changes in the Company’s ICFR (as defined in Rule 13a-15(f) of the Exchange Act) that occurred during our most recently completed fiscal quarter, that have materially affected, or are reasonably likely to materially affect, the Company’s ICFR.

Remediation Process

While certain actions have been taken to enhance the Company’s ICFR relating to the material weaknesses identified as of the date of this report, we are still in the process of implementing our comprehensive remediation plan. Accordingly, the previously identified material weaknesses cannot be considered remediated until each control has been appropriately designed, has operated for a sufficient period of time, and until management has concluded, through testing, that the control is operating effectively.

Following the identification of the material weaknesses described above, with the oversight of the Audit Committee, we commenced a process to remediate the underlying causes of those material weaknesses, enhance the control environment and strengthen our ICFR. The initial steps that the Company has taken to-date, and will continue to take, with respect to remediation of the material weaknesses identified are summarized below:

•The hiring of senior financial management and additional qualified finance and accounting resources, including:

◦The hiring of a Chief Financial Officer in May 2023 with significant financial holding company experience and prior experience as a Chief Accounting Officer of a financial holding company, who was appointed to and is serving as the Company’s Principal Financial Officer as of April 1, 2024;

◦The appointment of a new Chief Accounting Officer with significant financial holding company experience and prior experience as a Chief Accounting Officer of a bank holding company who is serving as the Company’s Principal Accounting Officer as of April 1, 2024;

◦The hiring and appointment of a Chief Risk Officer with significant financial holding company experience and prior experience as a Chief Audit Executive of a bank holding company who began employment on April 1, 2024;

◦The recent and anticipated hiring of additional qualified finance and accounting resources, as well as providing appropriate training to the relevant current and/or prospective control owners.

•Improving the design, operation, and monitoring of control activities and procedures to address ICFR requirements, including:

◦Improvements to the financial reporting process and control activities, including strengthening reconciliation controls;

◦The expansion of the responsibilities of the Company’s third-party internal audit provider; and

◦The continuing evaluation of the Company’s third-party vendors whose role is the facilitation of the timely documentation and related evaluation of the design and operating effectiveness of IFCR under SOX 404 and commensurate with the complexity of a well-diversified financial holding company who actively participates in the capital markets.

•Improving the design, operating effectiveness, and documentation of management review controls and controls designed to verify the completeness and accuracy of data and IPE used in financial reporting. These activities include the development of new management review controls, training, and education for process owners on audit requirements, and the creation of review templates to properly document evidence of management review in addition to building a data governance framework for data used in financial reporting.

•Implementing a new ERP system, along with other technology, that interfaces with other internal systems and are designed to ensure only authorized individuals can access certain modules and perform certain duties based on their role and responsibilities. Detailed processes and automated controls are maintained in the systems in an effort to ensure all control activities conform with our risk and control matrix, and to limit manual intervention and the risk of human error.

•Implementing new financial reporting software with (i) greater preventative controls that address completeness and accuracy of information produced by the Company and (ii) data connections that are directly tied to source systems and are explicitly linked to the future data governance framework.

•Management has been actively engaged in the implementation of a remediation plan designed to ensure that controls contributing to remediation of our ITGC material weakness are designed appropriately and will operate effectively, which include but are not limited to the following:

◦Enhancing information technology governance policies and procedures;

◦Designing and implementing control activities and procedures around user and administrator access and program change management;

◦Procuring and implementing technology to facilitate change management and logical access to systems; and

◦Hiring of additional qualified information technology resources and providing appropriate t training to the relevant control owners.

The status of our remediation plan is being, and will continue to be, reported by management to the Audit Committee on a regular basis. In addition, management has assigned executive owners to oversee the remedial changes to the overall design of the Company’s internal control environment and to address the root causes of our material weaknesses.

As management continues to evaluate and strive to improve the Company’s ICFR, management may take additional measures to address these control deficiencies or modify the previously disclosed remediation plan. While management intends to resolve all of the material weaknesses, no assurance can be provided that these remediation efforts will be successful, that the Company’s internal controls over financial reporting will be effective as a result of these efforts by any particular date, nor is it certain whether additional actions will be required.