Corpay 10-K 2023-12-31

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

For the Fiscal Year Ended December 31, 2023

OR

For the Transition Period From to

Commission File Number 001-35004

FLEETCOR Technologies, Inc.

Registrant’s telephone number, including area code: (770) 449-0479

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act:

NONE

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Exchange Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company” and "emerging growth company" in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant's executive officers during the relevant recovery period pursuant to §240.10D-1(b). ☐

The aggregate market value of the registrant’s common stock held by non-affiliates of the registrant was approximately $18,017,911,567 as of June 30, 2023, the last business day of the registrant’s most recently completed second fiscal quarter, based on the closing sale price as reported on the New York Stock Exchange.

As of February 17, 2024, there were 71,853,599 shares of common stock outstanding.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the registrant’s definitive Proxy Statement to be delivered to shareholders in connection with the Annual Meeting of Shareholders to be held on June 6, 2024 are incorporated by reference into Part III of this report.

FLEETCOR TECHNOLOGIES, INC.

FORM 10-K

For The Year Ended December 31, 2023

INDEX

Note About Forward-Looking Statements

This Annual Report on Form 10-K contains forward-looking statements within the meaning of the federal securities laws. Statements that are not historical facts, including statements about FLEETCOR’s beliefs, expectations and future performance, are forward-looking statements. Forward-looking statements can be identified by the use of words such as “anticipate,” “intend,” “believe,” “estimate,” “plan,” “seek,” “project” or “expect,” “may,” “will,” “would,” “could” or “should,” the negative of these terms or other comparable terminology.

These forward-looking statements are not a guarantee of performance, and you should not place undue reliance on such statements. We have based these forward-looking statements largely on our current expectations and projections about future events. Forward-looking statements are subject to many uncertainties and other variable circumstances, including those discussed in this report in Item 1A, “Risk Factors,” and Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” many of which are outside of our control, that could cause our actual results and experience to differ materially from any forward-looking statement.

These forward-looking statements may not be realized due to a variety of factors, including, without limitation:

• the impact of macroeconomic conditions, including any recession that has occurred or may occur in the future, and whether expected trends, including retail fuel prices, fuel price spreads, fuel transaction patterns, electric vehicle, and retail lodging price trends develop as anticipated and we are able to develop successful strategies in light of these trends;

• our ability to successfully execute our strategic plan, manage our growth and achieve our performance targets;

• our ability to attract new and retain existing partners, merchants, and providers, their promotion and support of our products, and their financial performance;

• the failure of management assumptions and estimates, as well as differences in, and changes to, economic, market, interest rate, interchange fees, foreign exchange rates, and credit conditions, including changes in borrowers’ credit risks and payment behaviors;

• the risk of higher borrowing costs and adverse financial market conditions impacting our funding and liquidity, and any reduction in our credit ratings;

• our ability to successfully manage our credit risks and the sufficiency of our allowance for expected credit losses;

• our ability to securitize our trade receivables;

• the occurrence of fraudulent activity, data breaches or failures of our information security controls or cybersecurity-related incidents that may compromise our systems or customers’ information;

• any disruptions in the operations of our computer systems and data centers;

• the international operational and political risks and compliance and regulatory risks and costs associated with international operations;

• the impact of international conflicts, including between Russia and Ukraine, as well as within the Middle East, on the global economy or our business and operations;

• our ability to develop and implement new technology, products, and services;

• any alleged infringement of intellectual property rights of others and our ability to protect our intellectual property;

• the regulation, supervision, and examination of our business by foreign and domestic governmental authorities, as well as litigation and regulatory actions, including the lawsuit filed by the Federal Trade Commission (FTC);

• the impact of regulations relating to privacy, information security and data protection; use of third-party vendors and ongoing third-party business relationships; and failure to comply with anti-money laundering (AML) and anti-terrorism financing laws;

• changes in our senior management team and our ability to attract, motivate and retain qualified personnel consistent with our strategic plan;

• tax legislation initiatives or challenges to our tax positions and/or interpretations, and state sales tax rules and regulations;

• the risks of mergers, acquisitions and divestitures, including, without limitation, the related time and costs of implementing such transactions, integrating operations as part of these transactions and possible failures to achieve expected gains, revenue growth and/or expense savings from such transactions;

• our ability to remediate material weaknesses and the ongoing effectiveness of internal control over financial reporting;

• our restatement of prior quarterly financial statements may affect investor confidence and raise reputational issues and may subject us to additional risks and uncertainties, including increased professional costs and the increased possibility of legal proceedings and regulatory inquiries; and

• the other factors and information in this Annual Report on Form 10-K and other filings that we make with the SEC under the Exchange Act and Securities Act. See “Risk Factors” in this Annual Report on Form 10-K.

Given these risks and uncertainties, you are cautioned not to place undue reliance on these forward-looking statements. The forward-looking statements included in this report are made only as of the date hereof. We do not undertake, and specifically disclaim, any obligation to update any such statements or to publicly announce the results of any revisions to any of such statements to reflect future events or developments.

EXPLANATORY NOTE

This Annual Report on Form 10-K for the year ended December 31, 2023 (“Form 10-K”) includes the restatement of our unaudited condensed consolidated financial statements for the quarterly periods ended March 31, 2023, June 30, 2023 and September 30, 2023 (the “Restated Periods”). The Audit Committee of the Company’s Board of Directors, in consultation with the Company's management, concluded that the Company’s previously issued condensed consolidated financial statements and related disclosures for the Restated Periods should no longer be relied upon related to the specific errors contained in such interim financial statements.

As disclosed in Note 20 to the Consolidated Financial Statements included in this Form 10-K, we are restating the Restated Periods to correct errors pertaining only to our balance sheets (and the related effects on the statements of cash flows) related to (1) the recognition of certain cash balances as restricted cash and customer deposits held in custodial accounts for the benefit of (FBO) customers entered into in the first quarter of 2023 based on the Company's determination that it exercises control over such funds and (2) a correction to the Company's accounts receivable and accounts payable balances related to an incorrect classification of certain unbilled accounts receivable balances.

As disclosed in Item 9A, as of December 31, 2023, management has determined that the Company did not maintain effective internal control over financial reporting due to the existence of certain material weaknesses. Management also concluded that the Company’s disclosure controls and procedures were not effective as of December 31, 2023 due to the existence of the material weaknesses. For additional information, see Item 9A of this Form 10-K.

We have not filed and do not intend to file amendments to our Quarterly Reports on Form 10-Q for the Restated Periods. 2023 comparative amounts presented in our 2024 Quarterly Reports on Form 10-Q will be changed retrospectively to reflect the restatement. Accordingly, investors should rely only on the financial information and other disclosures regarding the Restated Periods in this Form 10-K or in future filings with the SEC (as applicable), and not on any previously issued or filed reports, earnings releases or similar communications relating to the Restated Periods.

The impact of the restatement on the Restated Periods is described in Note 20 to our audited financial statements included in this Form 10-K.

PART I

Introduction

FLEETCOR is a global payments company that helps businesses and consumers better manager their expenses. FLEETCOR's suite of modern payment solutions help customers better manage vehicle-related expenses (e.g. fueling, tolls and parking), lodging expenses (e.g. hotel bookings) and corporate payments (e.g. domestic and international vendors). This results in our customers saving time and ultimately spending less. Since its incorporation in 2000, FLEETCOR’s smarter payment and spend management solutions have been delivered in a variety of ways depending on the needs of the customer. From physical payment cards to software that includes customizable controls and robust payment capabilities, we provide our customers with a better way to pay.

FLEETCOR has been a member of the S&P 500 since 2018 and trades on the New York Stock Exchange under the ticker FLT. We expect to rebrand FLEETCOR to Corpay, Inc. in March 2024, including changing our New York Stock Exchange ticker from FLT to CPAY.

Businesses spend an estimated $135 trillion each year in transactions with other businesses. In many instances, businesses lack the proper tools to monitor what is being purchased, and employ manual, paper-based, disparate processes and methods to both approve and make payments for their business-to-business purchases. This often results in wasted time and money due to unnecessary or unauthorized spending, fraud, receipt collection, data input and consolidation, report generation, reimbursement processing, account reconciliations, employee disciplinary actions, and more.

Digital payments are faster and more secure than paper-based methods such as checks, and provide timely and detailed data that can be utilized to effectively reduce unauthorized purchases and fraud, automate data entry and reporting, and eliminate reimbursement processes. Combining this payment data with analytical tools delivers powerful insights, which managers can use to better run their businesses.

FLEETCOR’s vision is that every payment is digital, every purchase is controlled, and every related decision is informed. Our wide range of modern, digitized solutions provide control, reporting, and automation benefits superior to many of the payment methods businesses often use such as cash, paper checks, general purpose credit cards, as well as employee pay and reclaim processes. In addition to delivering meaningful value to our customers, our solutions also share several important and attractive business model characteristics such as:

• the majority of revenue is derived primarily from business customers, which tend to have relatively predictable, consistent volumes;

• recurring revenue models driven by recurring volume, resulting in predictable revenue;

• similar selling systems with common sales approaches, management and reporting;

• specialized technology platforms and proprietary payment acceptance networks, which create competitive advantages and barriers to entry; and

• high EBITDA margins and cash flow translation with limited infrastructure investment requirements.

We actively market and sell to current and prospective customers leveraging a multi-channel, go-to-market approach, which includes comprehensive digital channels, direct sales forces and strategic partner relationships. We sell stand-alone products and services, and are currently organizing and establishing platforms where a single customer can use multiple products from one user interface. It is important to note that we compete mostly with legacy payment methods and traditional ways of paying, such as cash and checks. We supplement our organic growth strategy and sales efforts by pursuing attractive acquisition opportunities, which serve to strengthen and extend our market positions and create value faster. With a long, proven operating history, FLEETCOR now serves hundreds of thousands of customers with millions of cardholders making payments to millions of vendors around the world.

FLEETCOR has the following reportable segments: Vehicle Payments, Corporate Payments, Lodging Payments and Other. We report these segments as they reflect how we organize and manage our global employee base, manage operating performance, execute on strategic initiatives and contemplate the differing regulatory environments across geographies and solutions. Our Vehicle Payments solutions help control and monitor employee spending while in the field or in a vehicle and include fuel, tolls and other complementary products. Our Corporate Payments solutions simplify and automate vendor payments and include accounts payable (AP) automation, virtual cards, cross-border, and purchasing and travel and entertainment (T&E) card products. Our Lodging Payments solutions help businesses manage their lodging costs, while simplifying the management offerings from hotels, to longer term housing arrangements, while also providing traveler and end customer support.

Vehicle Payments

Our Vehicle Payments solutions are purpose-built to enable our customers to pay for vehicle related expenses. For our business customers, we also provide greater control and visibility of spending when compared with less specialized payment methods, such as cash or general-purpose credit cards. Our digital enabled solutions provide customers with significant control capabilities such as, customizable user-level controls, programmable alerts, and detailed transaction reporting. Furthermore, our business customers can use the data, controls and tools to combat employee misuse and fraud, streamline expense administration and potentially lower their operating costs, accessible through sophisticated web portals and mobile applications. For our consumer customers, our Vehicle Payment solutions provide seamless, mobile first digital experience when paying for certain vehicle related expenses, removing the friction associated with alternative payment methods and having to use multiple service providers.

We utilize both proprietary and third-party payment acceptance networks to deliver our Vehicle Payments solutions. In our proprietary networks, which tend to be geographically distinct and unique to the markets we serve, transactions are processed on applications and operating systems owned and operated by us, and only at select participating merchants with whom we have contracted directly for acceptance. These proprietary networks generally provide us with better economics, as we control more of the transaction, and richer data because of how the networks and point of sale software are configured. Third-party networks are operated by independent parties, and tend to be more broadly accepted, which is the primary benefit compared with our proprietary networks. Mastercard and VISA are our primary third-party network partners.

Fuel – Our fuel solutions are used by customers to pay and control spending for fuel for vehicles and fleets, Our fuel solutions are fuel type agnostic, regardless of fuel type (fossil fuel, electricity, etc.). We offer fuel solutions to businesses and government entities who operate vehicle fleets, as well as to consumers primarily in Brazil, Mexico and Europe. At the most basic level, we provide the measurement of fuel used and facilitate the payment for that fuel to the merchant, whether that fuel be diesel, gasoline, compressed natural gas, or electricity, while also providing online control, reporting and tracking capabilities to fleet operators. In many cases we can also deliver fuel price savings to our business customers when compared to the retail (board) price of fuel, and in Europe especially, we also enable fleets to significantly streamline the VAT reclaim process by digitizing and itemizing fuel receipts in a way that is compliant with tax authority requirements.

The measurement, control and payment needs of our customers operating electric vehicles (EV) are similar to those operating traditional, internal combustion veh

Showing the first 8K of 66K characters. Open the full section

You should carefully consider the following risks applicable to us. If any of the following risks actually occur, our business, operating results, financial condition and the trading price of our common stock could be materially adversely affected. The risks discussed below also include forward-looking statements, and our actual results may differ substantially from those discussed in these forward-looking statements. See “Note Regarding Forward-Looking Statements” in this report.

Risks related to information technology and security

We are dependent on the efficient and uninterrupted operation of interconnected computer systems, telecommunications, data centers and call centers, including technology and network systems managed by multiple third parties, which could result in our inability to prevent disruptions in our services.

Our ability to provide reliable service to customers, cardholders and other network participants depends upon uninterrupted operation of our data centers and call centers as well as third-party labor and services providers. Our business involves processing large numbers of transactions, the movement of large sums of money and the management of large amounts of data. We rely on the ability of our employees, contractors, suppliers, systems and processes to complete these transactions in a secure, uninterrupted and error-free manner.

Our subsidiaries operate in various countries and country specific factors, such as power availability, telecommunications carrier redundancy, embargoes and regulation can adversely impact our information processing by or for our local subsidiaries.

We engage backup facilities for each of our processing centers for key systems and data. However, there could be material delays in fully activating backup facilities depending on the nature of the breakdown, security breach or catastrophic event (such as fire, explosion, flood, pandemic, natural disaster, power loss, telecommunications failure or physical break-in). We have controls and documented measures to mitigate these risks but these mitigating controls might not reduce the duration, scope or severity of an outage in time to avoid adverse effects.

We may experience software defects, system errors, computer viruses and development delays, which could damage customer relationships, decrease our profitability and expose us to liability.

Our business depends heavily on the reliability of proprietary and third-party processing systems. A system outage could adversely affect our business, financial condition or results of operations, including by damaging our reputation or exposing us to third-party liability. To successfully operate our business, we must be able to protect our processing and other systems from interruption, including from events that may be beyond our control. Events that could cause system interruptions include, but are not limited to, fire, natural disaster, unauthorized entry, power loss, telecommunications failure, computer viruses, terrorist acts and war. Although we have taken steps to protect against data loss and system failures, there is still risk that we may lose critical data or experience system failures.

Our solutions are based on sophisticated software and computing systems that are constantly evolving. We often encounter delays and cost overruns in developing changes implemented to our systems. In addition, the underlying software may contain undetected errors, viruses or defects. Defects in our software products and errors or delays in our processing of electronic transactions could result in additional development costs, diversion of technical and other resources from our other development efforts, loss of credibility with current or potential customers, harm to our reputation or exposure to liability claims. In addition, we rely on technologies supplied to us by third parties that may also contain undetected errors, viruses or defects that could adversely affect our business, financial condition or results of operations. Although we attempt to limit our potential liability for warranty claims through disclaimers in our software documentation and limitation of liability provisions in our licenses and other agreements with our customers, we cannot assure that these measures will be successful in limiting our liability.

We may not be able to adequately protect our systems or the data we collect from continually evolving cybersecurity risks or other technological risks, which could subject us to liability and damage our reputation.

We electronically receive, process, store and transmit data and sensitive information about our customers and merchants, including bank account information, social security numbers, expense data, and credit card, debit card and checking account numbers. We endeavor to keep this information confidential; however, our websites, networks, information systems, services and technologies may be targeted for sabotage, disruption or misappropriation. The uninterrupted operation of our information systems and our ability to maintain the confidentiality of the customer and consumer information that resides on our systems are critical to the successful operation of our business. Unauthorized access to our networks and computer systems could result in the theft or publication of confidential information or the deletion or modification of records or could otherwise cause interruptions in our service and operations.

Other than a previously disclosed unauthorized access incident during the second quarter of 2018, we are not aware of any material breach of our or our associated third parties’ computer systems, although we and others in our industry are regularly the subject of attempts by bad actors to gain unauthorized access to these computer systems and data or to obtain, change or destroy confidential data (including personal consumer information of individuals) through a variety of means.

Because techniques used to sabotage or obtain unauthorized access to our systems and the data we collect change frequently and may not be recognized until launched against a target, especially considering heightened threats and risks associated with artificial intelligence, we may be unable to anticipate these techniques or to implement adequate preventative measures. An incident may not be detected until well after it occurs and the severity and potential impact may not be fully known for a substantial period of time after it has been discovered. Our ability to address incidents may also depend on the timing and nature of assistance that may be provided from relevant governmental or law enforcement agencies. Threats to our systems and our associated third parties’ systems can derive from human error, fraud or malice on the part of employees or third parties, or may result from accidental technological failure. Computer viruses can be distributed and could infiltrate our systems or those of our associated third parties. In addition, denial of service or other attacks could be launched against us for a variety of purposes, including to interfere with our services or create a diversion for other malicious activities. Although we believe we have sufficient controls in place to prevent disruption and misappropriation and to respond to such attacks, any inability to prevent security breaches could have a negative impact on our reputation, expose us to liability, decrease market acceptance of electronic transactions and cause our present and potential clients to choose another service provider.

In addition, the risk of cyber-attacks has increased in connection with the military conflicts between Russia and Ukraine, as well as within the Middle East, and the resulting geopolitical conflicts. In light of those and other geopolitical events, nation-state actors or their supporters may launch retaliatory cyber-attacks, and may attempt to cause supply chain and other third-party service provider dis

Showing the first 8K of 91K characters. Open the full section

We have no unresolved written comments regarding our periodic or current reports from the staff of the SEC.

Risk Management and Strategy

The Company is subject to cyber-attacks and information theft risks in our operations, which we seek to manage through cyber and information security programs, training, and insurance coverage. To strengthen our security and cyber defenses, we maintain a defensive approach to cyber and information security designed to defend our systems against misuse, intrusions, and cyberattacks and to protect the data we collect. The Company's processes to assess, identify and manage material risks from cybersecurity threats are strategically integrated into the Company's overall risk management framework, as evidenced by annual risk assessments and required trainings across business lines and applications. The Company’s information security program maintains procedures and controls for the systems, applications, and data of the Company and of its third-party providers. The Company has an established cybersecurity training program which is administered through online learning modules and is required for all employees at least annually. Such trainings cover topics such as password protection, phishing, the protection of confidential information and asset security, among others, and educate employees on mechanisms in place to report cyber-related incidents or suspicions of cybersecurity threats. Further, the Company maintains a cybersecurity incident response plan, which is managed by the Company's chief information security officer and is reviewed and tested annually. The incident response process is overseen by a security operations and cybersecurity incident response team comprised of members across the organization, including global management and IT operations and leverages an organizational-wide self-service platform that allows the Company to track, manage and resolve information security risks across the organization.

Our information security program is designed to generally align with recommended practices in security standards issued by ISO, AICPA (SSAE18), National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standard (PCI DSS) and other industry sources. Specifically, we strive to maintain ISO certifications (ISO 27001 Brazil and U.K.), SOC 1 and 2 Type 2 reports and PCI DSS reports on compliance to adhere to industry standard practices.

Our newly acquired businesses maintain separate cybersecurity programs and processes that may differ in scope and complexity from the Company’s overall cybersecurity programs and processes.

As part of our overall risk mitigation strategy, the Company also maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.

We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial condition. However, we have been the target of cyber-attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that we will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to Part I, “Item 1A. Risk Factors.”

Use of Third-Parties

To regularly assess whether our cybersecurity strategies and processes remain appropriate to prevent, investigate and address cyber-related issues, the Company engages with information security and forensics firms with specialized industry knowledge. Our collaboration with these third parties includes the administration of third-party security questionnaires, risk assessments and testing, and consultation on security enhancements to attempt to mitigate threats. We also collaborate with third parties, regulators, and law enforcement, when appropriate, to resolve security incidents and assist in efforts to prevent unauthorized access to our processing systems.

In order to oversee and identify risks from cybersecurity threats associated our use of third-party service providers, we maintain a risk management program designed to help protect against the misuse of information technology. In addition to risk assessments and questionnaires obtained upon selection of a new service provider, we also perform annual third-party risk assessments to ensure these service providers continue to meet contractual obligations for cybersecurity, regulatory and industry requirements.

Governance

The Board of Directors oversees the Company’s information security and risk management program. To support effective governance in managing risks related to cybersecurity, the Board has established an information technology and security committee.

Board of Directors Oversight

The information technology and security committee is responsible for providing oversight and leadership for our information technology security and cybersecurity, planning processes, policies and objectives. The information technology and security committee is composed of board members with both industry knowledge as well as expertise in technology and security, finance and risk management. The primary purpose of the committee is to review, assess and make recommendations regarding the long-term strategy for global information security and the evolution of our technology in a competitive environment.

To accomplish this purpose, the information technology and security committee has five primary responsibilities:

• understanding the security controls and assessments conducted on our major payment platforms and comparing them to industry best practices;

• evaluating strategies to protect our intellectual property;

• assessing opportunities to update our processing platform strategies to ensure the long term use of our resources;

• reviewing progress on significant IT security and cybersecurity projects and evaluating effectiveness of projects; and

• overseeing our disaster recovery and business continuity plans.

Management's Role

The Board and the information technology and security committee directed the formation of a cross-functional cybersecurity council at the Company, and receive regular cybersecurity reports from the global CIO, the corporate CIO and the chief information security officer (CISO), among others. These reports include updates on the Company’s cybersecurity strategy and execution of its processes, including updates on procedures to prepare for, prevent, detect, respond to and recover from (as applicable) cyber incidents. Such updates also include updates on the Company's continued compliance with regulatory requirements. The Company’s information security and risk management program is periodically evaluated by third-party specialists, and the results of those reviews are reported to the Board.

Our CISO, who reports directly to the Company’s Chief Information Officer (“CIO”), has served in various roles in information technology and information security for over 20 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information systems, and business resiliency. He is a Certified Information Systems Security Professional and Certified Information Systems Auditor.

Our CISO manages the Company's information security and oversees our data security personnel and our incident response and business continuity management programs to assess and manage the cybersecurity element of our risk management program, including policies, cybersecurity training, security operations and engineering, cyber threat detection and incident response. Our CISO promptly informs and updates the Board about any information security incidents that may pose a significant risk to the Company.

Our corporate headquarters are located in Atlanta, Georgia where we lease approximately 46,500 square feet of office space. In addition to our corporate headquarters, we have major operations located in Brentwood, Tennessee; Covington, Louisiana; Louisville, Kentucky; Lexington, Kentucky; and Peachtree Corners, Georgia. Our largest offices internationally are located in São Paulo, Brazil; London, United Kingdom; Prague, Czech Republic; Mexico City, Mexico and Toronto, Canada. We lease all of the real property used in our business, except for a portion of our headquarters in Mexico City, which we own.

In the ordinary course of business, the Company is involved in various pending or threatened legal actions, arbitration proceedings, claims, subpoenas, and matters relating to compliance with laws and regulations (collectively, "legal proceedings"). Based on our current knowledge, management presently does not believe that the liabilities arising from these legal proceedings will have a material adverse effect on our consolidated financial condition, results of operations or cash flows. However, it is possible that the ultimate resolution of these legal proceedings could have a material adverse effect on our results of operations and financial condition for any particular period.

Derivative Lawsuits

On July 10, 2017, a shareholder derivative complaint was filed against the Company and certain of the Company’s directors and officers in the United States District Court for the Northern District of Georgia ("Federal Derivative Action") seeking recovery from the Company. The District Court dismissed the Federal Derivative Action on October 21, 2020, and the United States Court of Appeals for the Eleventh Circuit affirmed the dismissal on July 27, 2022, ending the lawsuit. A similar derivative lawsuit that had been filed on January 9, 2019 in the Superior Court of Gwinnett County, Georgia (“State Derivative Action”) was likewise dismissed on October 31, 2022.

On January 20, 2023, the previous State Derivative Action plaintiffs filed a new derivative lawsuit in the Superior Court of Gwinnett County, Georgia. The new lawsuit, City of Aventura Police Officers’ Retirement Fund, derivatively on behalf of FleetCor Technologies, Inc. v. Ronald F. Clarke and Eric R. Dey, alleges that the defendants breached their fiduciary duties by causing or permitting the Company to engage in unfair or deceptive marketing and billing practices, making false and misleading public statements concerning the Company’s fee charges and financial and business prospects, and making improper sales of stock. The complaint seeks approximately $118 million in monetary damages on behalf of the Company, including contribution by defendants as joint tortfeasors with the Company in unfair and deceptive practices, and disgorgement of incentive pay and stock compensation. On January 24, 2023, the previous Federal Derivative Action plaintiffs filed a similar new derivative lawsuit, Jerrell Whitten, derivatively on behalf of FleetCor Technologies, Inc. v. Ronald F. Clarke and Eric R. Dey, against Mr. Clarke and Mr. Dey in Gwinnett County, Georgia. The defendants dispute the allegations in the derivative complaints and intend to vigorously defend against the claims.

FTC Investigation

In October 2017, the Federal Trade Commission ("FTC") issued a Notice of Civil Investigative Demand to the Company for the production of documentation and a request for responses to written interrogatories. After discussions with the Company, the FTC proposed in October 2019 to resolve potential claims relating to the Company’s advertising and marketing practices, principally in its U.S. direct fuel card business within its North American Fuel Card business. The parties reached impasse primarily related to what the Company believes are unreasonable demands for redress made by the FTC. On December 20, 2019, the FTC filed a lawsuit in the Northern District of Georgia against the Company and Ron Clarke. See FTC v. FLEETCOR and Ronald F. Clarke, No. 19-cv-05727 (N.D. Ga.). The complaint alleges the Company and Ron Clarke violated the FTC Act’s prohibitions on unfair and deceptive acts and practices. The complaint seeks among other things injunctive relief, consumer redress, and costs of suit. The Company continues to believe that the FTC’s claims are without merit and these matters are not and will not be material to the Company’s financial performance. On April 17, 2021, the FTC filed a motion for summary judgment. On April 22, 2021, the United States Supreme Court held unanimously in AMG Capital Management v. FTC that the FTC does not have authority under current law to seek monetary redress by means of Section 13(b) of the FTC Act, which is the means by which the FTC has sought such redress in this case. FLEETCOR cross-moved for summary judgment regarding the FTC’s ability to seek monetary or injunctive relief on May 17, 2021. On August 13, 2021, the FTC filed a motion to stay or to voluntarily dismiss without prejudice the case pending in the Northern District of Georgia in favor of a parallel administrative action under Section 5 of the FTC Act that it filed on August 11, 2021 in the FTC’s administrative process. Apart from the jurisdiction and statutory change, the FTC’s administrative complaint makes the same factual allegations as the FTC’s original complaint filed in December 2019. The Company opposed the FTC’s motion for a stay or to voluntarily dismiss, and the court denied the FTC’s motion on February 7, 2022. In the meantime, the FTC’s administrative action is stayed. On August 9, 2022, the District Court for the Northern District of Georgia granted the FTC's motion for summary judgment as to liability for the Company and Ron Clarke, but granted the Company's motion for summary judgment as to the FTC's claim for monetary relief as to both the Company and Ron Clarke. The Company intends to appeal this decision after final judgment is issued. On October 20-21, 2022, the court held a hearing on the scope of injunctive relief. At the conclusion of the hearing, the Court did not enter either the FTC’s proposed order or the Company’s proposed order, and instead suggested that the parties enter mediation. Following mediation, both parties filed proposed orders with the Court.

On June 8, 2023, the Court issued an Order for Permanent Injunction and Other Relief. The Company filed its notice of appeal to the United States Court of Appeals for the Eleventh Circuit on August 3, 2023. On August 17, 2023, the FTC Commission ordered that the stay of the parallel Section 5 administration action will remain in place during the pendency of the Eleventh Circuit appeal. The Company has incurred and continues to incur legal and other fees related to this FTC complaint. Any settlement of this matter, or defense against the lawsuit, could involve costs to the Company, including legal fees, redress, penalties, and remediation expenses.

Estimating an amount or range of possible losses resulting from litigation proceedings is inherently difficult and requires an extensive degree of judgment, particularly where, as here, the matters involve indeterminate claims for monetary damages and

are in the stages of the proceedings where key factual and legal issues have not been resolved. For these reasons, the Company is currently unable to predict the ultimate timing or outcome of, or reasonably estimate the possible losses or a range of possible losses resulting from, the matters described above.

Not applicable.

PART II

MATTERS, AND ISSUER PURCHASES OF EQUITY SECURITIES

Our common stock is traded on the New York Stock Exchange (NYSE) under the ticker FLT. As of December 31, 2023, there were 454 holders of record of our common stock.

DIVIDENDS AND STOCK REPURCHASES

We currently expect to retain all future earnings, if any, for use in the operation, expansion of our business and stock repurchases. We have never declared or paid any dividends on our common stock and do not anticipate paying cash dividends to holders of our common stock in the foreseeable future. In addition, our credit agreements restrict our ability to pay dividends. Any determination to pay dividends in the future will be at the discretion of our board of directors and will depend upon, among other factors, our results of operations, financial condition, capital requirements and covenants in our existing financing arrangements, and any future financing arrangements.

The Company's Board of Directors (the "Board") has approved a stock repurchase program (as updated from time to time, the "Program") authorizing the Company to repurchase its common stock from time to time until February 4, 2025. On January 25, 2024, the Board authorized an increase to the aggregate size of the Program by $1.0 billion to $8.1 billion. Since the beginning of the Program through December 31, 2023, the Company repurchased 28,878,862 shares for an aggregate purchase price of $6.5 billion, leaving the Company up to $1.6 billion of remaining authorization available under the Program for future repurchases of shares of its common stock. The Company repurchased 2,597,954 common shares totaling $687 million in 2023; 6,212,410 common shares totaling $1.4 billion in 2022 and 5,451,556 common shares totaling $1.4 billion in 2021.

On August 18, 2023, as part of the Program, the Company entered an accelerated share repurchase ("ASR") agreement ("2023 ASR Agreement") with a third-party financial institution to repurchase $450 million of its common stock. Pursuant to the 2023 ASR Agreement, the Company delivered $450 million in cash and received 1,372,841 shares based on a stock price of $262.23 on August 18, 2023. The transactions contemplated by the 2023 ASR Agreement was completed on September 26, 2023, at which time the Company received 293,588 additional shares based on a final weighted average per share purchase price during the repurchase period of $270.04.

Any stock repurchases may be made at times and in such amounts as deemed appropriate. The timing and amount of stock repurchases, if any, will depend on a variety of factors including the stock price, market conditions, corporate and regulatory requirements, and any additional constraints related to material inside information the Company may possess. Any repurchases have been and are expected to be funded by a combination of available cash flow from the business, working capital and debt.

The following table presents information with respect to purchase of common stock of the Company made during the three months ended December 31, 2023 by the Company as defined in Rule 10b-18(a)(3) under the Exchange Act:

PERFORMANCE GRAPH

The following graph assumes $100 invested on December 31, 2018, at the closing price ($185.72) of our common stock on that day, and compares (a) the percentage change of our cumulative total stockholder return on the common stock (as measured by dividing (i) the difference between our share price at the end and the beginning of the period presented by (ii) the share price at the beginning of the periods presented) with (b) (i) the Russell 2000 Index, (ii) the S&P 500® Data Processing & Outsourced Services and (iii) S&P 500.

RECENT SALES OF UNREGISTERED SECURITIES AND USE OF PROCEEDS

Not Applicable.

RESULTS OF OPERATIONS

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with the consolidated financial statements and related notes appearing elsewhere in this report. In addition to historical information, this discussion contains forward-looking statements that involve risks, uncertainties and assumptions that could cause actual results to differ materially from management’s expectations. Factors that could cause such differences include, but are not limited to, those identified below and those described in Item 1A “Risk Factors” appearing elsewhere in this report. All foreign currency amounts that have been converted into U.S. dollars in this discussion are based on the exchange rate as reported by Oanda for the applicable periods.

The following discussion and analysis of our financial condition and results of operations generally discusses 2023 and 2022 items, with year-over-year comparisons between these two years. A detailed discussion of 2022 items and year-over-year comparisons between 2022 and 2021 that are not included in this Annual Report on Form 10-K can be found in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part II, Item 7 of our Annual Report on Form 10-K for the year ended December 31, 2022.

Executive Overview

FLEETCOR is a global payments company that helps businesses and consumers better manage their expenses. FLEETCOR's suite of modern payment solutions help customers better manage vehicle-related expenses (e.g. fueling, tolls and parking), lodging expenses (e.g. hotel bookings) and corporate payments (e.g. domestic and international vendors). This results in our customers saving time and ultimately spending less. Since its incorporation in 2000, FLEETCOR’s smarter payment and spend management solutions have been delivered in a variety of ways depending on the needs of the customer. From physical payment cards to software that includes customizable controls and robust payment capabilities, we provide businesses and consumers with a better way to pay.

FLEETCOR has been a member of the S&P 500 since 2018 and trades on the New York Stock Exchange under the ticker FLT. We expect to rebrand FLEETCOR to Corpay, Inc. in March 2024, including changing our New York Stock Exchange ticker from FLT to CPAY.

Businesses spend an estimated $135 trillion each year in transactions with other businesses. In many instances, businesses lack the proper tools to monitor what is being purchased, and employ manual, paper-based, disparate processes and methods to both approve and make payments for their business-to-business purchases. This often results in wasted time and money due to unnecessary or unauthorized spending, fraud, receipt collection, data input and consolidation, report generation, reimbursement processing, account reconciliations, employee disciplinary actions, and more.

FLEETCOR’s vision is that every payment is digital, every purchase is controlled, and every related decision is informed. Digital payments are faster and more secure than paper-based methods such as checks, and provide timely and detailed data that can be utilized to effectively reduce unauthorized purchases and fraud, automate data entry and reporting, and eliminate reimbursement processes. Combining this payment data with analytical tools delivers powerful insights, which managers can use to better run their businesses. Our wide range of modern, digitized solutions generally provides control, reporting, and automation benefits superior to many of the payment methods businesses often use such as cash, paper checks, general purpose credit cards, as well as employee pay and reclaim processes.

Impact of Geo-Political Events on Our Business

The current military conflicts between Russia and Ukraine, as well as within the Middle East, continue to create substantial uncertainty about the global economy in the future. Although the length, impact and outcome of the ongoing military conflicts between Russia and Ukraine and within the Middle East are highly unpredictable, these conflicts could lead to significant market and other disruptions. We recently exited the Russia market via the disposition of our Russia business, which closed in the third quarter of 2023 (see "Russia Disposition" section below), and we do not have material operations in Israel or Gaza. We cannot predict how and the extent to which these conflicts will affect our customers, operations or business partners or the demand for our products and our global business.

We are actively monitoring the situations and assessing the impact on our business. The extent, severity, duration and outcome of the military conflicts, sanctions and resulting market disruptions could be significant and could potentially have substantial impact on the global economy and our business for an unknown period of time.

Russia Disposition

During the second quarter of 2023, we signed definitive documents to sell our Russia business to a third party. At June 30, 2023, we concluded that the sale was not considered probable due to continued uncertainty regarding regulatory approvals and ongoing discussions regarding the nature and timing of deal completion. As such, the assets and liabilities associated with our Russian business were not classified as held for sale prior to the completion of the transaction. The Russia business was historically reported within our Vehicle Payments segment and did not meet the criteria to be presented as discontinued operations. We completed the sale of our Russia business on August 15, 2023.

The sale included the entirety of our operations in Russia and resulted in a complete exit from the Russia market. We received total proceeds, net of cash disposed and net of a $5.6 million foreign exchange loss upon conversion of the ruble-denominated proceeds to U.S. dollars, of $197.0 million, which have been recorded within investing activities in the accompanying Consolidated Statements of Cash Flows. In connection with the sale, we recorded a net gain on disposal of $13.7 million during the year ended December 31, 2023, which represents the proceeds received less the derecognition of the related net assets, the reclassification of accumulated foreign currency translation losses, and the foreign exchange loss upon conversion of the ruble-denominated proceeds to U.S. dollars. The net gain is included within other (income) expense, net in the accompanying Consolidated Statements of Income.

Exclusive of the impact of disposition, our business in Russia accounted for approximately $62.0 million and $84.7 million of our consolidated income before income taxes for years ended December 31, 2023 and 2022, respectively. Our assets in Russia were approximately 3.2% of our consolidated assets at December 31, 2022.

Results

Revenues, net, Net Income and Net Income Per Diluted Share. Set forth below are revenues, net, net income and net income per diluted share for the years ended December 31, 2023 and 2022 (in millions, except per share amounts).

Adjusted Net Income, Adjusted Net Income Per Diluted Share, EBITDA and EBITDA margin. Set forth below are adjusted net income, adjusted net income per diluted share, EBITDA and EBITDA margin for the years ended December 31, 2023 and 2022 (in millions, except per sh

Showing the first 8K of 115K characters. Open the full section

Foreign currency risk

Foreign Earnings

Our international businesses expose us to foreign currency exchange rate changes that can impact translations of foreign-denominated assets and liabilities into U.S. dollars and future earnings and cash flows from transactions denominated in different currencies. Revenues from our international businesses were 43.2% and 38.9% of total revenues for the years ended December 31, 2023, and 2022, respectively. We measure foreign currency exchange risk based on changes in foreign currency exchange rates using a sensitivity analysis. The sensitivity analysis measures the potential change in earnings based on a hypothetical 10% change in currency exchange rates. Such analysis indicated that a hypothetical 10% change in foreign currency exchange rates would have increased or decreased consolidated operating income during the year ended December 31, 2023 by approximately $86.0 million had the U.S. dollar exchange rate increased or decreased relative to the currencies to which we had exposure. Similarly, the analysis for the prior year indicated that a hypothetical 10% change in currency exchange rates would have increased or decreased consolidated operating income for the years ended December 31, 2022 by approximately $68.4 million had the U.S. dollar exchange rate increased or decreased relative to the currencies to which we had exposure.

Unhedged Cross-Currency Risk

With our cross-border payment solutions, we have additional foreign exchange risk and associated foreign exchange risk management requirements due to the nature of our cross-border payments provider business. The majority of cross-border payments revenue is from exchanges of currency at spot rates, which enable customers to make cross-currency payments. In our cross-border payment solutions, we also write foreign currency forward and option contracts for customers to facilitate future payments. The duration of these derivative contracts at inception is generally less than one year. We aggregate foreign exchange exposures arising from customer contracts, including the derivative contracts described above, and hedge (economic hedge) the resulting net currency risks by entering into offsetting contracts with established financial institution counterparties.

Interest rate risk

We are exposed to the risk of changing interest rates on our cash investments and on the unhedged portion of our variable rate debt. As of December 31, 2023, and 2022, we had $5.4 billion and $5.7 billion, respectively, of variable rate debt outstanding under our Credit Agreement. See Note 11 of the accompanying consolidated financial statements for information about the Credit Agreement. We use derivative financial instruments to reduce our exposure related to changes in interest rates. As of December 31, 2023, we had a number of receive-variable SOFR, pay-fixed interest rate swap derivative contracts with a cumulative notional U.S. dollar value of $4.0 billion. The objective of these contracts is to reduce the variability of cash flows in the previously unhedged interest payments associated with variable rate debt, the sole source of which is due to changes in SOFR benchmark interest rate. While these agreements are intended to lessen the impact of rising interest rates on us, they also expose us to the risk that the other parties to the agreements will not perform, we could incur significant costs associated with the settlement of the agreements, the agreements will be unenforceable and the underlying transactions will fail to qualify as highly-effective cash flow hedges under GAAP. See Note 16 of the accompanying consolidated financial statements for information about the swap contracts.

Based on the amounts and mix of our fixed and floating rate debt (exclusive of our Securitization Facility but inclusive of the aforementioned interest rate swaps) at December 31, 2023 and 2022, if market interest rates had increased or decreased an average of 100 basis points, our interest expense for the years ended December 31, 2023 and 2022 would have changed by approximately $14 million and $43 million, respectively. We determined these amounts by considering the impact of the hypothetical interest rates on our borrowing costs. These analyses do not consider the effects of changes in the level of overall economic activity that could exist in such an environment.

Fuel price risk

Our fleet customers use our products and services primarily in connection with the purchase of fuel. Accordingly, our revenue is affected by fuel prices, which are subject to significant volatility. A decline in retail fuel prices could cause a change in our revenue from several sources, including fees paid to us based on a percentage of each customer’s total purchase. Changes in the absolute price of fuel may also impact unpaid account balances and the late fees and charges based on these amounts. The impact of changes in fuel price is somewhat mitigated by our agreements with certain merchants, where the price paid to the merchant is equal to the lesser of the merchant’s cost plus a markup or a percentage of the transaction purchase price. We do not enter into any fuel price derivative instruments.

Fuel price spread risk

From our merchant and network relationships, we derive revenue from the difference between the price charged to a fleet customer for a transaction and the price paid to the merchant or network for the same transaction. For certain of our payment products, the price paid to a merchant or network is calculated as the merchant’s wholesale cost of fuel plus a markup. The merchant’s wholesale cost of fuel is dependent on several factors including, among others, the factors described above affecting fuel prices. The fuel price that we charge to our customer is dependent on several factors including, among others, the fuel price

paid to the fuel merchant, posted retail fuel prices and competitive fuel prices. We experience fuel price spread contraction when the merchant’s wholesale cost of fuel increases at a faster rate than the fuel price we charge to our customers, or the fuel price we charge to our customers decreases at a faster rate than the merchant’s wholesale cost of fuel. Accordingly, if fuel price spreads contract, we may generate less revenue, which could adversely affect our operating results. The impact of volatility in fuel spreads is somewhat mitigated by our agreements with certain merchants, where the price paid to the merchant is equal to cost plus a markup or a percentage of the transaction purchase price.

INDEX TO CONSOLIDATED FINANCIAL STATEMENTS

Report of Independent Registered Public Accounting Firm

To the Stockholders and the Board of Directors of FLEETCOR Technologies, Inc. and Subsidiaries

Opinion on the Financial Statements

We have audited the accompanying consolidated balance sheets of FLEETCOR Technologies, Inc. and subsidiaries (the Company) as of December 31, 2023 and 2022, the related consolidated statements of income, comprehensive income, stockholders' equity and cash flows for each of the three years in the period ended December 31, 2023, and the related notes (collectively referred to as the “consolidated financial statements”). In our opinion, the consolidated financial statements present fairly, in all material respects, the financial position of the Company at December 31, 2023 and 2022, and the results of its operations and its cash flows for each of the three years in the period ended December 31, 2023, in conformity with U.S. generally accepted accounting principles.

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the Company's internal control over financial reporting as of December 31, 2023, based on criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) and our report dated February 29, 2024 expressed an adverse opinion thereon.

Basis for Opinion

These financial statements are the responsibility of the Company's management. Our responsibility is to express an opinion on the Company’s financial statements based on our audits. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether due to error or fraud. Our audits included performing procedures to assess the risks of material misstatement of the financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the financial statements. We believe that our audits provide a reasonable basis for our opinion.

Critical Audit Matter

The critical audit matter communicated below is a matter arising from the current period audit of the financial statements that was communicated or required to be communicated to the audit committee and that: (1) relates to accounts or disclosures that are material to the financial statements and (2) involved our especially challenging, subjective or complex judgments. The communication of the critical audit matter does not alter in any way our opinion on the consolidated financial statements, taken as a whole, and we are not, by communicating the critical audit matter below, providing a separate opinion on the critical audit matter or on the account or disclosure to which it relates.

Showing the first 8K of 229K characters. Open the full section

Not applicable.

Management Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining an adequate system of internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act), pursuant to Rule 13a-15(c) of the Exchange Act. Our internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP.

A company’s internal control over financial reporting includes policies and procedures that: (i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company, (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with GAAP, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company, and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Projections of any evaluation of effectiveness for future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Under the supervision and with the participation of our management, we assessed the effectiveness of our internal control over financial reporting as of December 31, 2023, using the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control—Integrated Framework (2013). A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. As of December 31, 2023, we identified the following material weaknesses in internal controls:

(1) A material weakness in internal control related to ineffective information technology general controls (ITGCs) in the area of user access management over certain information technology systems used in the execution of controls that support the Company’s financial reporting processes. Our business process application and manual controls that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted. We believe that these control deficiencies were the result of challenges in the current year implementation of technology aimed to automate the user access review process. Specifically, these deficiencies pertained to the completeness and accuracy of data used in the automated solution and in existing manual user access control processes that lacked sufficient documentation and formality, as well as insufficient training of information technology personnel responsible for the execution and documentation of ITGCs. The material weakness did not result in any identified misstatements to the financial statements, and there were no changes to previously released financial results.

(2) A material weakness resulting from ineffective controls over the application of U.S. GAAP guidance related to the balance sheet recognition of customer funds held for the benefit of others leading to the restatement of previously issued 2023 interim consolidated financial statements as further discussed within note 20 to the Consolidated Financial Statements.

Based on these material weaknesses, the Company’s management concluded that at December 31, 2023, the Company’s internal control over financial reporting was not effective.

The Company’s independent registered public accounting firm, Ernst & Young LLP has issued an adverse audit report on the effectiveness of the Company’s internal control over financial reporting as of December 31, 2023, which appears in Item 9A of this Annual Report.

As a result of the identification of the material weaknesses, and prior to filing this Annual Report, we performed further analysis and completed additional procedures intended to ensure our consolidated financial statements for the year ended December 31, 2023 were prepared in accordance with GAAP. Based on these procedures and analysis, and notwithstanding the material weaknesses in our internal control over financial reporting, our management has concluded that our consolidated financial statements and related notes thereto included in this Annual Report have been prepared in accordance with GAAP. Our Chief Executive Officer and Chief Financial Officer have certified that, based on each such officer’s knowledge, the financial statements, as well as the other financial information included in this Annual Report, fairly present in all material

respects the financial condition, results of operations and cash flows of the Company as of, and for, the periods presented in this Annual Report. In addition, Ernst & Young LLP has issued an unqualified opinion on our financial statements, which is included in Item 8 of this Annual Report, and we have developed a remediation plan for the material weaknesses, which are described below.

Remediation

(1) Our management has been implementing and continues to implement measures designed to ensure that control deficiencies contributing to the material weakness are remediated, such that these controls are designed, implemented, and operating effectively. The remediation actions include: (i) enhancing the information technology compliance oversight function; (ii) developing a training program addressing ITGCs and policies, including educating control owners concerning the principles and requirements of internal controls, with a focus on those related to user access over information technology systems impacting financial reporting; (iii) developing and maintaining documentation underlying ITGCs to enhance the information evidencing the performance of ITGCs; (iv) developing enhanced integration functionality and controls related to the ongoing implementation of user access information technology system; (v) enhancing the information technology management review and testing plan to monitor ITGCs with a specific focus on systems supporting our financial reporting processes; and (vi) enhancing quarterly reporting on the remediation measures to the Audit Committee of the Board.

We believe that these actions will remediate the material weakness. The material weakness will not be considered remediated, however, until the applicable controls operate for a sufficient period of time and our management has concluded, through testing, that these controls are operating effectively. We expect that the remediation of this material weakness will be completed prior to the end of fiscal 2024.

(2) As further discussed in note 20 to the Consolidated Financial Statements, management has restated its 2023 interim consolidated financial statements. In addition, management is developing enhanced monitoring and oversight controls in the application of U.S. GAAP guidance pertaining to customer funds held for the benefit of others. We believe that these actions will remediate the material weakness as of March 31, 2024.

In connection with management's evaluation, our management team excluded from its assessment of the effectiveness of our internal control over financial reporting as of December 31, 2023, the internal controls related to four subsidiaries that we acquired during the year ended December 31, 2023, and for which financial results are included in our consolidated financial statements.

During 2023, the Company acquired Global Reach, a U.K.-based cross-border payments provider; Mina Digital Limited Solutions, a cloud-based electric vehicle charging software platform; Business Gateway AG, a European-based service, maintenance and repair technology provider; and PayByPhone Technologies, Inc., the world's second largest mobile parking operator. Collectively, we refer to these transactions as the 2023 Acquisitions. These 2023 Acquisitions constituted 3.9% of total assets at December 31, 2023, and 0.9% of revenues, net for the year then ended. This exclusion was in accordance with Securities and Exchange Commission guidance that an assessment of a recently acquired business may be omitted in management's report on internal control over financial reporting the year of acquisition.

Changes in Internal Control over Financial Reporting

Except for the material weaknesses identified above, as of December 31, 2023, there have been no other changes in our internal control over financial reporting (as defined in Rules 13a-15(f) or 15d-15(f) of the Exchange Act) during our fourth quarter ended December 31, 2023 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Report of Independent Registered Public Accounting Firm

To the Stockholders and the Board of Directors of FLEETCOR Technologies, Inc. and Subsidiaries

Opinion on Internal Control over Financial Reporting

We have audited FLEETCOR Technologies, Inc. and subsidiaries’ internal control over financial reporting as of December 31, 2023, based on criteria established in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) (the COSO criteria). In our opinion, because of the effect of the material weaknesses described below on the achievement of the objectives of the control criteria, FLEETCOR Technologies, Inc. and subsidiaries (the Company) has not maintained effective internal control over financial reporting as of December 31, 2023, based on the COSO criteria.

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis. The following material weaknesses have been identified and included in management’s assessment.

(1) A material weakness in controls related to information technology general controls (ITGCs) in the area of user access over certain information technology (IT) systems used in the execution of controls that support the Company’s financial reporting processes. As a result, business process application and manual controls that were dependent on the affected ITGCs could have been adversely impacted.

(2) A material weakness in controls over the application of U.S. GAAP guidance related to the recognition of customer funds held for the benefit of others.

As indicated in the accompanying Management Report on Internal Control over Financial Reporting, management’s assessment of and conclusion on the effectiveness of internal control over financial reporting did not include the internal controls of the 2023 Acquisitions (as defined by management), which are included in the 2023 consolidated financial statements of the Company and constituted 3.9% of total assets as of December 31, 2023 and 0.9% of revenues, net for the year then ended. Our audit of internal control over financial reporting of the Company also did not include an evaluation of the internal control over financial reporting of the 2023 Acquisitions.

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated balance sheets of the Company as of December 31, 2023 and 2022, the related consolidated statements of income, comprehensive income, stockholders' equity and cash flows for each of the three years in the period ended December 31, 2023, and the related notes. These material weaknesses were considered in determining the nature, timing and extent of audit tests applied in our audit of the 2023 consolidated financial statements, and this report does not affect our report dated February 29, 2024 which expressed an unqualified opinion thereon.

Basis for Opinion

The Company’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting included in the accompanying Management Report on Internal Control over Financial Reporting. Our responsibility is to express an opinion on the Company’s internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects.

Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

Definition and Limitations of Internal Control Over Financial Reporting

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit

preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

/s/ Ernst & Young LLP

Atlanta, Georgia

February 29, 2024

Rule 10b5-1 Trading Plans

During the three months ended December 31, 2023, no director or executive officer of the Company adopted, modified or terminated any contract, instruction or written plan for the purchase or sale of Company securities that was intended to satisfy the affirmative defense conditions of Rule 10b5-1(c) or any “non-Rule 10b5-1 trading arrangement.”

None.

PART III

A list of our executive officers and biographical information appears in Part I, Item X of this Form 10-K. Information about our directors may be found under the caption “Director Nominees” and “Continuing Directors” in our Proxy Statement for the Annual Meeting of Shareholders to be held June 6, 2024 (the “Proxy Statement”). Information about our Audit Committee may be found under the caption “Board Meetings and Committees” in the Proxy Statement. The foregoing information is incorporated herein by reference.

The information in the Proxy Statement set forth under the caption “Delinquent Section 16(a) Reports” is incorporated herein by reference.

We have adopted the FLEETCOR Code of Business Conduct and Ethics (the “code of ethics”), which applies to our Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer and Corporate Controller, and other finance organization employees. The code of ethics is publicly available on our website at www.fleetcor.com under Investor Relations. If we make any substantive amendments to the code of ethics or grant any waiver, including any implicit waiver, from a provision of the code to our Chief Executive Officer, Chief Financial Officer, or Chief Accounting Officer, we will disclose the nature of the amendment or waiver on that website or in a report on Form 8-K.

The information in the Proxy Statement set forth under the captions “Director Compensation,” “2023 Named Executive Officer Compensation,” “Compensation Committee Report,” and “Compensation Committee Interlocks and Insider Participation” is incorporated herein by reference.

AND RELATED STOCKHOLDER MATTERS

The information in the Proxy Statement set forth under the captions “Information Regarding Beneficial Ownership of Principal Shareholders, Directors, and Management” and “Equity Compensation Plan Information” is incorporated herein by reference.

INDEPENDENCE

The information set forth in the Proxy Statement under the captions “Director Independence” and “Certain Relationships and Related-Party Transactions” is incorporated herein by reference.

Information concerning principal accountant fees and services appears in the Proxy Statement under the headings “Fees Billed by Ernst & Young LLP” and “Policy on Audit Committee Pre-Approval of Audit and Permissible Non-Audit Services of Independent Auditor” and is incorporated herein by reference.

PART IV

(a) Financial Statements and Schedules

The financial statements are set forth under Item 8 of this Form 10-K, as indexed below. Financial statement schedules have been omitted since they either are not required, not applicable, or the information is otherwise included.

Index to Financial Statements

(b) Exhibit Listing

None.

Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned; thereunto duly authorized, in the City of Atlanta, State of Georgia, on February 29, 2024.

Pursuant to the requirements of the Securities Exchange Act of 1934, this report has been signed below by the following persons on behalf of registrant and in the capacities indicated on February 29, 2024.