Company: FCFS
Filing Date: 2025-04-25
Form Type: DEF 14A
Source: 0000840489-25-000055
Chunk: 19

Company: FirstCash Holdings, Inc.
Filing Date: 2025-04-25
Form: DEF 14A
Chunk 19
---
 involving cybersecurity.

At the direction of the Audit Committee, the Chief Information Officer (the “CIO”) and his team (the Security Incident Response Team, or “SIRT”) monitor internal and external cybersecurity threats and review and revise the Company’s cybersecurity defenses on an ongoing basis. The Company’s CIO, together with other members of the SIRT, bring a wealth of expertise to their respective roles, including expertise in security technologies; designing and implementing security strategies; security standards such as NIST, ISO, COBIT and ITIL; and risk management and incident response. The CIO prepares reports on IT general controls and cybersecurity metrics for the Audit Committee on a regular basis, and the CIO presents those reports to the Audit Committee and addresses any questions and concerns raised by the Audit Committee. At least annually, the Audit Committee meets with the CIO in person to discuss cybersecurity in greater detail. The Audit Committee reports to the Board of Directors regarding cybersecurity matters, and the Board of Directors addresses cybersecurity issues either directly with management or through the Audit Committee.

#### Compensation Programs
The Compensation Committee reviews the risks and rewards associated with the Company’s compensation programs. With the assistance of Pay Governance, an independent compensation consulting firm, the Compensation Committee designs compensation programs with features that mitigate risk without diminishing the incentive nature of the compensation. While these performance-based compensation and equity programs have been designed and administered in a manner that discourages undue risk-taking by employees, the Compensation Committee believes these programs create appropriate incentives to increase long-term stockholder value. The Compensation Committee has discussed the concept of risk as it relates to the compensation programs and the Compensation Committee does not believe the compensation programs encourage excessive or inappropriate risk-taking for the following reasons:

• The Company structures its pay to consist of both fixed and variable compensation. The fixed portion of compensation (salary) is designed to provide a steady income independent of the Company’s stock price performance so that executives do not feel pressured to focus exclusively on short-term stock price performance to the long-term detriment of other important business decisions and metrics and are not encouraged to take unnecessary or excessive risks to achieve corporate objectives. The variable portions of compensation (performance-based cash and equity awards along with time-based equity awards) are designed to reward both short- and long-term corporate performance. For short-term performance, the Company utilizes annual incentive-based cash awards that are based primarily on earnings metrics. The metrics are set annually by the Compensation Committee and approved by the Board of Directors. For long-term performance, the Company grants restricted stock awards with a multi-year vesting period