CORPAY INC

Evaluation of Disclosure Controls and Procedures

As of September 30, 2024, management carried out, under the supervision and with the participation of our Chief Executive Officer and Chief Financial Officer, an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934). Based on this evaluation, and as a result of the material weaknesses described below, our Chief Executive Officer and Chief Financial Officer concluded that, as of September 30, 2024, our disclosure controls and procedures were not effective in ensuring that information required to be disclosed by us in the reports that we file or submit under the Securities Exchange Act of 1934, as amended, is recorded, processed, summarized and reported within the time periods specified in applicable rules and forms and are not designed to ensure that information required to be disclosed in those reports is accumulated and communicated to management, including our Chief Executive Officer and Chief Financial Officer, as appropriate to allow timely decisions regarding required disclosure.

As discussed in our Annual Report on Form 10-K for the year ended December 31, 2023, we identified the following material weaknesses in internal controls:

(1) A material weakness in internal control related to ineffective information technology general controls (ITGCs) in the area of user access management over certain information technology systems used in the execution of controls that support the Company’s financial reporting processes. Our business process application and manual controls that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted.

(2) A material weakness resulting from ineffective controls over the application of U.S. GAAP guidance related to the balance sheet recognition of customer funds held for the benefit of others, which resulted in the restatement of previously issued 2023 interim consolidated financial statements as further discussed within our Annual Report on Form 10-K filed with the SEC on February 29, 2024.

As a result of the material weaknesses identified, the Company has begun updating its internal control over financial reporting as discussed in its remediation plan updated below.

Remediation Update

(1) Our management has been implementing and continues to implement measures designed to ensure that control deficiencies contributing to the ITGC material weakness are remediated, such that these controls are designed, implemented, and operating effectively. The remediation actions include: (i) enhancing the information technology compliance oversight function; (ii) developing a training program addressing ITGCs and policies, including educating control owners concerning the principles and requirements of internal controls, with a focus on those related to user access over information technology systems impacting financial reporting; (iii) developing and maintaining documentation underlying ITGCs to enhance the information evidencing the performance of ITGCs; (iv) developing enhanced integration functionality and controls related to the ongoing implementation of user access information technology system; (v) enhancing the information technology management review and testing plan to monitor ITGCs with a specific focus on systems supporting our financial reporting processes; and (vi) enhancing quarterly reporting on the remediation measures to the Audit Committee of the Board.

(2) Management has developed enhanced monitoring and oversight controls in the application of U.S. GAAP guidance pertaining to customer funds held for the benefit of others.

We believe that these actions will remediate the material weaknesses. The material weaknesses will not be considered remediated, however, until the applicable controls operate for a sufficient period of time and our management has concluded, through testing, that these controls are operating effectively.

Changes in Internal Control over Financial Reporting

Other than the changes to our internal control over financial reporting described above, there were no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) or 15d-15(f) of the Exchange Act) during the quarter ended September 30, 2024, that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

PART II—OTHER INFORMATION