RCI HOSPITALITY HOLDINGS, INC.

Evaluation of Disclosure Controls and Procedures

In connection with the preparation of this report, an evaluation was carried out by certain members of Company management, with the participation of the Interim Chief Executive Officer (“CEO”) and the Interim Chief Financial Officer (“CFO”) of the effectiveness of the Company’s disclosure controls and procedures (as defined in Securities and Exchange Commission’s (“SEC”) Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934 (“Exchange Act”) as of September 30, 2025. Disclosure controls and procedures are designed to ensure that information required to be disclosed in reports filed or submitted under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to management, including the CEO and the CFO, to allow timely decisions regarding required disclosures.

Due to material weaknesses in internal control over financial reporting described below, management concluded that the Company’s disclosure controls and procedures were not effective as of September 30, 2025. Notwithstanding the existence of these material weaknesses, management believes that the consolidated financial statements in this annual report filed on Form 10-K present, in all material respects, the Company’s financial condition as reported, in conformity with United States Generally Accepted Accounting Principles (“U.S. GAAP”).

Management’s Annual Report on Internal Control over Financial Reporting

Management of the Company is responsible for establishing and maintaining adequate internal control over financial reporting as defined in Rule 13a-15(f) under the Exchange Act. Our internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with U.S. GAAP and includes those policies and procedures that: (1) pertain to the maintenance of records that in reasonable detail accurately and fairly reflect our transactions and the dispositions of our assets; (2) provide reasonable assurance that our transactions are recorded as necessary to permit preparation of financial statements in accordance with U.S. GAAP and that our receipts and expenditures are being made only in accordance with appropriate authorizations; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets that could have a material effect on our consolidated financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Under the supervision of and with the participation of our management, we assessed the effectiveness of our internal control over financial reporting as of September 30, 2025, using the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) in Internal Control—Integrated Framework (2013). A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements will not be prevented or detected on a timely basis.

We have identified material weaknesses in internal control related to (1) ineffective design and operation of controls over certain information technology general controls ("ITGCs"), including program change management and vendor management controls; (2) ineffective design and operation of controls, which include management review controls, over the accounting for business combinations and contingent liabilities; and (3) ineffective design and operation of controls, which include management review controls, over the impairment assessments over long-lived assets, definite- and indefinite-lived intangible assets, and goodwill. The identified ITGC control deficiencies resulted from two factors. First, the Company's procedures governing program change management were insufficiently documented, resulting in controls that could not be consistently evidenced. Second, the Company relies on third-party IT service providers for certain key components of the technology infrastructure supporting its financial reporting processes. Specifically, certain service providers supporting applications within the Company's revenue cycle were unable to provide System and Organization Controls ("SOC") reports, thus management was unable to effectively evaluate the design and operating effectiveness of the internal controls maintained by these service providers. Consequently, certain business process controls were determined to be ineffective, limited to the extent those controls rely upon information processed within, or subject to, the control environments of the applicable third-party service providers.

These deficiencies may have an impact on our financial statements, account balances, and disclosures. Based on our evaluation, our management, with the participation of our CEO and our CFO, concluded that our internal control over financial reporting was not effective as of September 30, 2025.

Following identification of these material weaknesses, and prior to filing this Annual Report on Form 10-K, we completed additional procedures as deemed necessary for the year ended September 30, 2025. Based on these procedures, management believes that the consolidated financial statements included in this Form 10-K have been prepared in accordance with U.S. GAAP. Our CEO and CFO have certified that, based on their knowledge, the financial statements, and other financial information included in this Form 10-K, fairly present in all material respects the financial condition, results of operations and cash flows of the Company as of, and for, the periods presented in this Form 10-K.

The Company’s independent registered public accounting firm, CBIZ CPAs P.C., has expressed an unqualified opinion on our consolidated financial statements and an adverse opinion on our internal control over financial reporting as of September 30, 2025, in the audit report that appears at the end of Part II of this Annual Report on Form 10-K.

Remediation Plan for Existing Material Weaknesses

Management is committed to the remediation of the material weaknesses described above.

Review of Accounting for Business Combinations and Contingent Liabilities

Management has re-evaluated the design of its controls over the accounting for business combinations and will continue to implement enhancements to improve the precision, documentation, and timeliness of review procedures. Management has re-evaluated the design of its controls over the accounting for legal contingencies and will implement enhancements to improve the clarity and quality of documentation supporting review of legal contingencies, including related legal fees and unasserted claims.

Review of Impairment Assessments over Long-lived Assets, Definite- and Indefinite-lived Intangibles Assets, and Goodwill

Given the inherently subjective nature of the assumptions underlying the valuation models used in impairment analyses, management will re-evaluate the review procedures to strengthen the validation and documentation of such assumptions.

Information Technology General Controls

As a result of the material weakness and its ongoing remediation efforts, Management is enhancing change monitoring procedures and evaluating alternative procedures where SOC reports are not available for certain third party application vendors.

Further, Management is committed to enhanced quarterly reporting on the remediation measures to the Audit Committee of the board of directors.

It is our belief that these added controls will effectively remediate the existing material weaknesses.

The material weaknesses will not be considered remediated, however, until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. We expect that the remediation of these material weaknesses will be completed prior to the end of fiscal 2026.

Changes in Internal Control Over Financial Reporting

During fiscal year 2025, the Company completed several business combinations as described in Note 16 - Acquisitions and Dispositions to our audited Consolidated Financial Statements.

•On January 21, 2025, the Company and certain of its subsidiaries completed the acquisition of a club in Detroit, Michigan.

•On April 7, 2025, and another delayed closing date on June 13, 2025, the Company and certain of its subsidiaries completed the acquisition of two clubs, one in West Columbia, South Carolina, and another in Allentown, Pennsylvania.

The scope of management’s assessment of the effectiveness of the Company’s disclosure controls and procedures for fiscal year-end 2025 did not include the internal control over the financial reporting of these acquisitions, in accordance with the SEC’s staff guidance that permits exclusion of acquisitions from their final assessment of internal control over financial reporting for the fiscal year in which the acquisition occurred. Due to the size, breadth and complexity of the acquisition of these businesses, management’s evaluation of internal control over financial reporting for the fiscal year ended September 30, 2025, did exclude those internal control activities. The businesses are wholly owned subsidiaries whose total assets and total revenues are excluded from management’s assessment and represent approximately 4% and 2%, respectively, of the related consolidated financial statement amounts as of and for the year ended September 30, 2025.

Except for the remediation efforts as discussed above, there have been no other changes in our internal control over financial reporting (as defined in Rules 13a-15(f) or 15d-15(f) of the Exchange Act) during the quarter ended September 30, 2025 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.