REALTY INCOME CORP

-52-

Item 4: Controls and Procedures

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) of the Securities Exchange Act of 1934, as amended (the "Exchange Act") that are designed to ensure that information required to be disclosed in our Exchange Act reports is recorded, processed, summarized and reported within the time periods specified in the Securities and Exchange Commission’s rules and forms, and that such information is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure. In designing and evaluating the disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives, and management necessarily was required to apply its judgment in evaluating the cost-benefit relationship of possible controls and procedures.

We carried out an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures as of March 31, 2026, under the supervision and with the participation of management, including our Chief Executive Officer and Chief Financial Officer.

Based on the foregoing, our Chief Executive Officer and Chief Financial Officer concluded that as of March 31, 2026 our disclosure controls and procedures were effective and were operating at a reasonable assurance level.

Changes in Internal Controls

There have been no changes in our internal control over financial reporting that occurred during the quarter ended March 31, 2026, that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Limitations on the Effectiveness of Controls

Internal control over financial reporting cannot provide absolute assurance of achieving financial reporting objectives because of its inherent limitations. Internal control over financial reporting is a process that involves human diligence and compliance and is subject to lapses in judgment and breakdowns resulting from human failures. Internal control over financial reporting also can be circumvented by collusion or improper management override. Because of such limitations, there is a risk that material misstatements may not be prevented or detected on a timely basis by internal control over financial reporting. However, these inherent limitations are known features of the financial reporting process. Therefore, it is possible to design into the process safeguards to reduce, though not eliminate, this risk.