Item 4. Controls and Procedures

Evaluation of Disclosure Controls and Procedures

As of March 31, 2025, management carried out, under the supervision and with the participation of our Chief Executive Officer and Chief Financial Officer, an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934). Based on this evaluation, and as a result of the material weakness described below, our Chief Executive Officer and Chief Financial Officer concluded that, as of March 31, 2025, our disclosure controls and procedures were not effective in ensuring that information required to be disclosed by us in the reports that we file or submit under the Securities Exchange Act of 1934, as amended, is recorded, processed, summarized and reported within the time periods specified in applicable rules and forms and are not designed to ensure that information required to be disclosed in those reports is accumulated and communicated to management, including our Chief Executive Officer and Chief Financial Officer, as appropriate to allow timely decisions regarding required disclosure.

As discussed in our Annual Report on Form 10-K for the year ended December 31, 2024, we identified the following material weakness in internal controls:

(1) A material weakness in internal control related to ineffective information technology general controls (ITGCs) in the area of user access management over certain information technology systems used in the execution of controls that support the Company’s financial reporting processes. Our business process application and manual controls that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted. We believe that these control deficiencies were the result of challenges in the prior year implementation of technology aimed to automate the user access review process. Specifically, these deficiencies pertained to the completeness and accuracy of data used in the automated solution and in existing manual user access control processes that lacked sufficient documentation and formality, as well as insufficient training of information technology personnel responsible for the execution and documentation of ITGCs. The material weakness did not result in any identified misstatements to the financial statements, and there were no changes to previously released financial results.

As a result of the material weakness identified, the Company is updating its internal control over financial reporting as discussed in its remediation plan updated below.

Remediation Update

(1) Our management continues to implement measures to ensure that control deficiencies contributing to the material weakness are remediated, such that these controls are designed, implemented and operating effectively. The

remediation actions include: (i) enhancing the information technology compliance oversight function; (ii) developing a training program addressing ITGCs and policies, including educating control owners concerning the principles and requirements of internal controls, with a focus on those related to user access over information technology systems impacting financial reporting; (iii) developing and maintaining documentation underlying ITGCs to enhance the information evidencing the performance of ITGCs; (iv) developing enhanced integration functionality and controls related to the ongoing implementation of user access information technology system; (v) enhancing the information technology management review and testing plan to monitor ITGCs with a specific focus on systems supporting our financial reporting processes; and (vi) enhancing quarterly reporting on the remediation measures to the Audit Committee of the Board.

We believe that these actions will remediate the material weakness. The material weaknesses will not be considered remediated, however, until the applicable controls operate for a sufficient period of time and our management has concluded, through testing, that these controls are operating effectively.

Changes in Internal Control over Financial Reporting

Except for the remediation described above, there have been no other changes in our internal control over financial reporting (as defined in Rules 13a-15(f) or 15d-15(f) of the Exchange Act) during the quarter ended March 31, 2025, that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

PART II—OTHER INFORMATION

In the ordinary course of business, Corpay, Inc. and its subsidiaries, (the Company) is involved in various pending or threatened legal actions, arbitration proceedings, claims, subpoenas and matters relating to compliance with laws and regulations (collectively, "legal proceedings"). Based on our current knowledge, management presently does not believe that the liabilities arising from these legal proceedings will have a material adverse effect on our consolidated financial condition, results of operations or cash flows. However, it is possible that the ultimate resolution of these legal proceedings could have a material adverse effect on our results of operations and financial condition for any particular period.

Derivative Lawsuits

On July 10, 2017, a shareholder derivative complaint was filed against the Company and certain of the Company’s directors and officers in the United States District Court for the Northern District of Georgia ("Federal Derivative Action") seeking recovery from the Company. The District Court dismissed the Federal Derivative Action on October 21, 2020, and the United States Court of Appeals for the Eleventh Circuit affirmed the dismissal on July 27, 2022, ending the lawsuit. A similar derivative lawsuit that had been filed on January 9, 2019 in the Superior Court of Gwinnett County, Georgia (“State Derivative Action”) was likewise dismissed on October 31, 2022.

On January 20, 2023, the previous State Derivative Action plaintiffs filed a new derivative lawsuit in the Superior Court of Gwinnett County, Georgia. The new lawsuit, City of Aventura Police Officers’ Retirement Fund, derivatively on behalf of Fleetcor Technologies, Inc. v. Ronald F. Clarke and Eric R. Dey, alleges that the defendants breached their fiduciary duties by causing or permitting the Company to engage in unfair or deceptive marketing and billing practices, making false and misleading public statements concerning the Company’s fee charges and financial and business prospects, and making improper sales of stock. The complaint seeks approximately $118 million in monetary damages on behalf of the Company, including contribution by defendants as joint tortfeasors with the Company in unfair and deceptive practices, and disgorgement of incentive pay and stock compensation. On January 24, 2023, the previous Federal Derivative Action plaintiffs filed a similar new derivative lawsuit, Jerrell Whitten, derivatively on behalf of Fleetcor Technologies, Inc. v. Ronald F. Clarke and Eric R. Dey, against Mr. Clarke and Mr. Dey in Gwinnett County, Georgia. The defendants dispute the allegations in the derivative complaints and intend to vigorously defend against the claims. On May 1, 2024, both pending derivative cases were transferred to the Fulton County Metro Atlanta Business Case Division and consolidated as In re Corpay, Inc. Shareholder Derivative Litigation, CAFN 2023CV383303 (consolidated with CAFN 2023CV381421).

On April 1, 2025, the Court granted defendants’ motion to dismiss the consolidated lawsuit. To date, plaintiffs have not filed an appeal.

FTC Matter

In October 2017, the Federal Trade Commission (FTC) issued a Notice of Civil Investigative Demand to the Company for the production of documentation and a request for responses to written interrogatories. After discussions with the Company, the FTC proposed in October 2019 to resolve potential claims relating to the Company’s advertising and marketing practices, principally in its U.S. direct fuel card business within its North American Fuel Card business. The parties reached impasse primarily related to what the Company believes are unreasonable demands for redress made by the FTC. On December 20, 2019, the FTC filed a lawsuit in the Northern District of Georgia against the Company and Ron Clarke. See FTC v. FleetCor and Ronald F. Clarke, No. 19-cv-05727 (N.D. Ga.). The complaint alleges the Company and Ron Clarke violated the FTC Act’s prohibitions on unfair and deceptive acts and practices. The complaint seeks among other things injunctive relief, consumer redress, and costs of suit. The Company continues to believe that the FTC’s claims are without merit and these matters are not and will not be material to the Company’s financial performance. On April 17, 2021, the FTC filed a motion for summary judgment. On April 22, 2021, the United States Supreme Court held unanimously in AMG Capital Management v. FTC that the FTC does not have authority under current law to seek monetary redress by means of Section 13(b) of the FTC Act, which is the means by which the FTC has sought such redress in this case. The Company cross-moved for summary judgment regarding the FTC’s ability to seek monetary or injunctive relief on May 17, 2021. On August 13, 2021, the FTC filed a motion to stay or to voluntarily dismiss without prejudice the case pending in the Northern District of Georgia in favor of a parallel administrative action under Section 5 of the FTC Act that it filed on August 11, 2021 in the FTC’s administrative process. Apart from the jurisdiction and statutory change, the FTC’s administrative complaint makes the same factual allegations as the FTC’s original complaint filed in December 2019. The FTC’s administrative action was stayed pending resolution of the case in federal court. On August 9, 2022, the District Court for the Northern District of Georgia granted the FTC's motion for summary judgment as to liability for the Company and Ron Clarke, but granted the Company's motion for summary judgment as to the FTC's claim for monetary relief as to both the Company and Ron Clarke.

On June 8, 2023, the Court issued an Order for Permanent Injunction and Other Relief. The Company filed its notice of appeal to the United States Court of Appeals for the Eleventh Circuit on August 3, 2023. On August 17, 2023, the FTC Commission ordered that the stay of the parallel Section 5 administration action will remain in place during the pendency of the Eleventh Circuit appeal. Oral argument in the Eleventh Circuit appeal was held on January 21, 2025. The Company has incurred and

continues to incur legal and other fees related to this FTC complaint. Any settlement of this matter, or defense against the lawsuit, could involve costs to the Company, including legal fees, redress, penalties, and remediation expenses.

Estimating an amount or range of possible losses resulting from litigation proceedings is inherently difficult and requires an extensive degree of judgment, particularly where, as here, the matters involve indeterminate claims for monetary damages and are in the stages of the proceedings where key factual and legal issues have not been resolved. For these reasons, the Company is currently unable to predict the ultimate timing or outcome of, or reasonably estimate the possible losses or a range of possible losses resulting from, the matters described above.