Item 9A. CONTROLS AND PROCEDURES

Management Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining an adequate system of internal control over financial reporting

(as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act), pursuant to Rule 13a-15(c) of the Exchange Act. Our

internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial

reporting and the preparation of financial statements for external purposes in accordance with GAAP.

A company’s internal control over financial reporting includes policies and procedures that: (i) pertain to the maintenance of

records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company, (ii)

provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in

accordance with GAAP, and that receipts and expenditures of the company are being made only in accordance with

authorizations of management and directors of the company, and (iii) provide reasonable assurance regarding prevention or

timely detection of unauthorized acquisition, use or disposition of the company’s assets that could have a material effect on the

financial statements.

Under the supervision and with the participation of our management, we assessed the effectiveness of our internal control over

financial reporting as of December 31, 2024, using the criteria set forth by the Committee of Sponsoring Organizations of the

Treadway Commission (COSO) in Internal Control—Integrated Framework (2013). A material weakness is a deficiency, or a

combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material

misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. As of

December 31, 2024, we identified the following material weakness in internal controls:

(1) A material weakness in internal control related to ineffective information technology general controls (ITGCs) in

the area of user access management over certain information technology systems used in the execution of controls that

support the Company’s financial reporting processes. Our business process application and manual controls that are

dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted. We

believe that these control deficiencies were the result of challenges in the prior year implementation of technology

aimed to automate the user access review process. Specifically, these deficiencies pertained to the completeness and

accuracy of data used in the automated solution and in existing manual user access control processes that lacked

sufficient documentation and formality, as well as insufficient training of information technology personnel

responsible for the execution and documentation of ITGCs. The material weakness did not result in any identified

misstatements to the financial statements, and there were no changes to previously released financial results.

Based on this material weakness, the Company’s management concluded that at December 31, 2024, the Company’s internal

control over financial reporting was not effective.

The Company’s independent registered public accounting firm, Ernst & Young LLP has issued an adverse audit report on the

effectiveness of the Company’s internal control over financial reporting as of December 31, 2024, which appears in Item 9A of

this Annual Report.

As a result of the identification of the material weakness, and prior to filing this Annual Report, we performed further analysis

and completed additional procedures intended to ensure our consolidated financial statements for the year ended December 31,

2024 were prepared in accordance with GAAP. Based on these procedures and analysis, and notwithstanding the material

weakness in our internal control over financial reporting, our management has concluded that our consolidated financial

statements and related notes thereto included in this Annual Report have been prepared in accordance with GAAP. Our Chief

Executive Officer and Chief Financial Officer have certified that, based on each such officer’s knowledge, the financial

statements, as well as the other financial information included in this Annual Report, fairly present in all material respects the

financial condition, results of operations and cash flows of the Company as of, and for, the periods presented in this Annual

Report. In addition, Ernst & Young LLP has issued an unqualified opinion on our financial statements, which is included in

Item 8 of this Annual Report, and we have developed a remediation plan for the material weakness, which is described below.

In connection with management's evaluation, our management team excluded from its assessment of the effectiveness of our

internal control over financial reporting as of December 31, 2024, the internal controls related to three subsidiaries that we

acquired during the year ended December 31, 2024, and for which financial results are included in our consolidated financial

statements.

During 2024, the Company acquired 70% of Zapay, a Brazil-based digital consumer mobility solution for paying vehicle-

related taxes and compliance fees; Paymerang, a U.S.-based leader in accounts payables automation solutions; and GPS Capital

Markets, a U.S.-based provider of business-to-business cross-border and treasury management solutions to upper middle market

companies. Collectively, we refer to these transactions as the 2024 Acquisitions. In the evaluation of internal control over

financial reporting, management excluded the operations of acquired entities in the 2024 Acquisitions from the assessment of

internal control over financial reporting as of December 31, 2024. These operations were excluded in accordance with the

SEC’s general guidance because they and the related entities were acquired in purchase business combinations in 2024. These

2024 Acquisitions constituted 10.9% of total assets at December 31, 2024, and 1.5% of revenues, net for the year then ended.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements.

Projections of any evaluation of effectiveness for future periods are subject to the risk that controls may become inadequate

because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Remediation

(1) Our management has been implementing and continues to implement measures designed to ensure that control deficiencies

contributing to the material weakness are remediated, such that these controls are designed, implemented and operating

effectively. The remediation actions include: (i) enhancing the information technology compliance oversight function; (ii)

developing a training program addressing ITGCs and policies, including educating control owners concerning the principles

and requirements of internal controls, with a focus on those related to user access over information technology systems

impacting financial reporting; (iii) developing and maintaining documentation underlying ITGCs to enhance the information

evidencing the performance of ITGCs; (iv) developing enhanced integration functionality and controls related to the ongoing

implementation of user access information technology system; (v) enhancing the information technology management review

and testing plan to monitor ITGCs with a specific focus on systems supporting our financial reporting processes; and (vi)

enhancing quarterly reporting on the remediation measures to the Audit Committee of the Board.

We believe that these actions will remediate the material weakness. The material weakness will not be considered remediated,

however, until the applicable controls operate for a sufficient period of time and our management has concluded, through

testing, that these controls are operating effectively.

Changes in Internal Control over Financial Reporting

Except for the remediation described above, there have been no other changes in our internal control over financial reporting (as

defined in Rules 13a-15(f) or 15d-15(f) of the Exchange Act) during our fourth quarter ended December 31, 2024 that have

materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Report of Independent Registered Public Accounting Firm

To the Stockholders and the Board of Directors of Corpay, Inc. and Subsidiaries

Opinion on Internal Control over Financial Reporting

We have audited Corpay, Inc. and subsidiaries’ internal control over financial reporting as of December 31, 2024, based on

criteria established in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the

Treadway Commission (2013 framework) (the COSO criteria). In our opinion, because of the effect of the material weakness

described below on the achievement of the objectives of the control criteria, Corpay, Inc. and subsidiaries (the Company) has

not maintained effective internal control over financial reporting as of December 31, 2024, based on the COSO criteria.

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there

is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be

prevented or detected on a timely basis. The following material weakness has been identified and included in management’s

assessment.

A material weakness in internal controls related to ineffective information technology general controls (ITGCs) in the area of

user access management over certain information technology systems used in the execution of controls that support the

Company’s financial reporting processes. As a result, business process application and manual controls that are dependent on

the affected ITGCs were also deemed ineffective because they could have been adversely impacted.

As indicated in the accompanying Management Report on Internal Control over Financial Reporting, management’s assessment

of and conclusion on the effectiveness of internal control over financial reporting did not include the internal controls of the

Zapay, Paymerang, and GPS Capital Markets (the 2024 Acquisitions), which are included in the 2024 consolidated financial

statements of the Company and constituted 10.9% of total assets as of December 31, 2024 and 1.5% of revenues, net for the

year then ended. Our audit of internal control over financial reporting of the Company also did not include an evaluation of the

internal control over financial reporting of the 2024 Acquisitions.

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States)

(PCAOB), the consolidated balance sheets of the Company as of December 31, 2024 and 2023, the related consolidated

statements of income, comprehensive income, equity and cash flows for each of the three years in the period ended December

31, 2024, and the related notes. This material weakness was considered in determining the nature, timing and extent of audit

tests applied in our audit of the 2024 consolidated financial statements, and this report does not affect our report dated February

27, 2025 which expressed an unqualified opinion thereon.

Basis for Opinion

The Company’s management is responsible for maintaining effective internal control over financial reporting and for its

assessment of the effectiveness of internal control over financial reporting included in the accompanying Management Report

on Internal Control over Financial Reporting. Our responsibility is to express an opinion on the Company’s internal control

over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be

independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and

regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the

audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all

material respects.

Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material

weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk and

performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a

reasonable basis for our opinion.

Definition and Limitations of Internal Control Over Financial Reporting

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the

reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally

accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures

that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and

dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit

preparation of financial statements in accordance with generally accepted accounting principles and that receipts and

expenditures of the company are being made only in accordance with authorizations of management and directors of the

company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or

disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also,

projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate

because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

/s/ Ernst & Young LLP

Atlanta, Georgia

February 27, 2025