ARROW FINANCIAL CORP

Management, under the supervision and with the participation of the Chief Executive Officer (who is our principal executive officer) and Chief Financial Officer (who is our principal financial officer), evaluated the effectiveness of our disclosure controls and procedures, as defined in Rule 13a-15(e) and 15d15(e) of the Securities Exchange Act of 1934, as amended (the "Exchange Act"), as of December 31, 2023. The term "disclosure controls and procedures" means controls and other procedures of a company that are designed to ensure that:

•information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms; and

•information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to management, including the principal executive and principal financial officers, or persons and committees performing similar functions, such as the Audit Committee, as appropriate to allow timely decisions regarding required disclosure.

Based on that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that as of December 31, 2023, our disclosure controls and procedures were not effective due to material weaknesses in internal controls over financial reporting described below under the heading "Management's Report on Internal Control Over Financial Reporting." We have in place and are executing a remediation plan to address the material weaknesses described below.

Following identification of the material weaknesses and prior to filing this Form 10-K, we performed relevant and responsive substantive procedures as of December 31, 2023 and for the year then ended, in order to complete our financial statements and related disclosures. Based on these procedures, Management believes that our consolidated financial statements included in this Form 10-K have been prepared in accordance with GAAP. Our Chief Executive Officer and Chief Financial Officer have certified that, based on their knowledge, the financial statements, and other financial information included in this Form 10-K, fairly present in all material respects the financial condition, results of operations, and cash flows of the Company as of the dates, and for the periods presented in this Form 10-K for 2023.

Management’s Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting as such term is defined in Exchange Act Rules 13a-15(f) and 15d-15(f).

As of December 31, 2023, our management, under the oversight of our Board of Directors, evaluated the effectiveness of our internal control over financial reporting based on the criteria for effective internal control over financial reporting established by the Committee of Sponsoring Organization of the Treadway Commission (COSO) in Internal Control – Integrated Framework (2013). Based on this evaluation, our management concluded that our internal control over financial reporting was not effective as of December 31, 2023 due to the material weaknesses previously disclosed in the 2022 Form 10-K, which are described below:

•We did not maintain effective monitoring controls related to 1) Internal Audit’s testing of management’s internal control over financial reporting, 2) the completeness and accuracy of information presented to the Audit Committee by Internal Audit, and 3) the related Audit Committee oversight over Internal Audit’s testing of management’s internal control over financial reporting.

•With regard to the conversion of our core banking information technology system that occurred in September 2022, we did not effectively perform risk assessment procedures to identify the impact of the conversion on our internal control over financial reporting.

Management concluded that these material weaknesses were primarily due to:

•The Company did not have an effective control environment. Specifically, it did not effectively establish structure, authority and responsibility to support a functioning system of internal control. The Company’s Audit Committee did not demonstrate sufficient oversight of Internal Audit’s monitoring of management’s design, implementation and conduct of internal control over financial reporting. The Company did not have sufficient internal resources with appropriate knowledge and expertise to design and implement, document and operate effectively certain internal controls over financial reporting and certain information technology systems. The Company did not have sufficient training of personnel on the COSO 2013 Framework and its implications on financial reporting and their related internal control responsibilities. Additionally, the Company did not have effective policies and procedures that held personnel accountable for defined internal control responsibilities.

•The Company did not have an effective risk assessment process that successfully identified and assessed risks of misstatement to ensure controls were designed and implemented to respond to the risks associated with the core banking information technology system conversion. The Company did not adequately communicate the changes necessary in financial reporting and related internal controls throughout its organization.

•The Company did not have an effective information and communication process that identified and assessed the source of and controls necessary to ensure the reliability of information used in financial reporting to the Company’s Board of Directors, and communications with relevant third parties.

•The Company did not have effective monitoring activities through Internal Audit to assess the operation of internal control over financial reporting, including the continued appropriateness of control design and level of documentation maintained to support control effectiveness as well as monitoring corrective action to remediate known control deficiencies in a timely manner.

The material weaknesses noted above did not result in misstatements to our consolidated financial statements for any of the years presented. As outlined below, as of December 31, 2023, certain remediation measures for these existing material weaknesses were implemented and operating but were not in place for a sufficient amount of time for the material weakness to be considered remediated. These remediation measures continue to be monitored and assessed on an ongoing basis and therefore, our management concluded that these outstanding material weaknesses cannot be considered remediated as of December 31, 2023.

KPMG LLP, the Company’s independent registered public accounting firm, who audited the consolidated financial statements included in this Annual Report on Form 10-K, has issued an attestation report on the Company’s internal control over financial reporting. KPMG LLP’s attestation report contains an adverse opinion on the effectiveness of the Company’s internal control over financial reporting. KPMG LLP’s report is included in Item 8 of this Annual Report on Form 10-K.

Remediation Efforts to Address the Material Weaknesses

The aforementioned material weaknesses were previously disclosed in the 2022 Form 10-K. While the Company has improved its organizational capabilities and implemented necessary remediation measures, the remediation steps taken were not in place for a sufficient amount of time for the material weaknesses to be considered remediated as of December 31, 2023. Accordingly, the Company will continue to assess its remediation measures in 2024 in order to confirm effective remediation of the identified material weaknesses.

During the year ended December 31, 2023, management initiated and/or completed the following remedial actions:

•The Company evaluated the assignment of responsibilities of internal and external resources associated with the performance of internal control over financial reporting and hired additional resources, contracted external resources, and/or provided additional training to existing resources as appropriate. In addition, we have initiated a process to identify and maintain the information required to support the functioning of internal control.

•Audit Committee and management implemented the following actions to improve the monitoring activities related to Audit Committee oversight over Internal Audit’s testing of management’s internal control over financial reporting:

◦Increased the frequency and depth of reporting to the Audit Committee through the creation of a sub-committee of Audit Committee members that meet in the months in which the full Audit Committee does not have scheduled meetings or as needed.

◦Instituted more frequent Audit Committee meetings to facilitate timely review of matters related to the results of the Company’s monitoring program and Internal Audit’s progress against their plan as well as status of control testing results.

◦Developed a comprehensive internal audit strategy and program to test management’s controls over financial reporting.

◦Developed a robust reporting mechanism to ensure the completeness, accuracy and improved effectiveness of information which is presented on a timely basis to the Audit Committee to help fulfill the Audit Committee's oversight responsibilities.

◦Utilized monthly dashboards to report status and results of internal audits as well as operations of internal controls over financial reporting.

◦Engaged a professional services firm to review the Company’s control program required by the Sarbanes-Oxley Act of 2002, as amended, and assist Management with its overall Company-wide processes and with selecting and developing control activities designed to mitigate risks and support achievement of control objectives.

•Performed a thorough risk assessment to identify the impact of the core banking system conversion on our internal control over financial reporting. As a result, the company identified the need for additional controls to mitigate risks and support the achievement of control objectives. These controls are being implemented as part of the ongoing, overall remediation efforts.

The actions that we are taking are subject to ongoing management review and Audit Committee oversight to ensure they remain in place and continue to operate in order to be deemed effective.

Changes in Internal Control Over Financial Reporting

Except for the remediation measures in connection with the material weaknesses described above, there were no changes in our internal control over financial reporting, as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act, during the quarter ended December 31, 2023 that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.