OppFi Inc

Evaluation of Disclosure Controls and Procedures

Under the supervision and with the participation of the Company’s Chief Executive Officer and Chief Financial Officer, management has evaluated the effectiveness of the design and operation of the Company’s disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) as of December 31, 2023 (“Evaluation Date”). Based upon that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that, as of the Evaluation Date, the Company’s disclosure controls and procedures were not effective due to the material weakness in its internal control over financial reporting described below.

Material Weakness in Internal Control Over Financial Reporting

Notwithstanding the material weakness in the Company’s internal control over financial reporting described below, the Company’s Chief Executive Officer and Chief Financial Officer have concluded that the consolidated financial statements of the Company as included in Part II, Item 8 of this Annual Report on Form 10-K present fairly, in all material respects, the Company's financial condition, results of operations and cash flows as of and for the periods presented in accordance with generally accepted accounting principles in the United States.

Management of the Company is responsible for establishing and maintaining adequate internal control over financial reporting as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act and based upon the criteria established in Internal Control-Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (the “COSO framework”). The Company’s internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of the Company’s financial statements for external purposes in accordance with U.S. GAAP. Because of its inherent limitations, the Company’s internal control over financial reporting may not prevent or detect all misstatements. Effective internal controls can provide only reasonable assurance with respect to the preparation and fair presentation of financial statements.

Under the supervision and with the participation of the Company’s management, including the Company’s Chief Executive Officer and Chief Financial Officer, management has conducted an evaluation of the effectiveness of the Company’s internal control over financial reporting based on the COSO framework. Based on evaluation under these criteria, management determined that the Company’s internal control over financial reporting was not effective as of December 31, 2023 due to the existence of the previously reported material weakness in internal control over financial reporting related to information technology general controls (“ITGCs”) associated with the Company’s financially relevant information systems. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements will not be prevented or detected on a timely basis. As previously disclosed in Part II, Item 9A of the Company’s Annual Report on Form 10-K for the year ended December 31, 2022, management determined that the Company’s user access controls designed to ensure appropriate segregation of duties, adequate restriction of users and privileged access to the Company’s financially relevant information systems were not operating effectively. As previously disclosed in Part I, Item 4 of the Company’s Quarterly Report on Form 10-Q for the period ended September 30, 2023, management also determined that the Company’s user access control designed to ensure appropriate segregation of duties was not designed effectively. Management believes that compensating controls are in place and operating effectively to mitigate the risks associated with the identified material weakness as it is being remediated (as described below).

Remediation Plan for Material Weakness in Internal Control Over Financial Reporting

Management is committed to remediating the material weakness described above as promptly as possible. Management believes that certain of the controls in question are designed effectively and that these controls, when operating effectively, will provide appropriate remediation of part of the material weakness. In particular, as part of its remediation plan, the Company is implementing comprehensive access control protocols in order to implement restrictions on user and privileged access to the Company’s financially relevant information systems and will be providing internal control training for personnel involved in remediating this material weakness. In addition, management continues to design and implement new controls to ensure appropriate segregation of duties. Management intends to test the ongoing operating effectiveness of the controls in future periods. The material weakness cannot be considered completely remediated until the applicable controls have operated for a sufficient period of time and management has concluded, through testing, that these controls are designed and operating effectively. The Company can provide no assurance that its remediation efforts described herein will be successful and that the Company will not have material weaknesses in the future.

Changes in Internal Control Over Financial Reporting

Other than the changes to the Company’s internal control over financial reporting described in “Remediation Plan for Material Weakness in Internal Control Over Financial Reporting” above, there were no changes in the Company’s internal control over financial reporting (as such term is defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act) during the year ended December 31, 2023 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.