FLAGSTAR FINANCIAL INC

(a) Evaluation of Disclosure Controls and Procedures

Under the supervision, and with the participation, of our Chief Executive Officer and Chief Financial Officer, our management evaluated the effectiveness of the design and operation of the Company’s disclosure controls and procedures pursuant to Rule 13a-15(b), as adopted by the Securities and Exchange Commission (the “SEC”) under the Securities Exchange Act of 1934 (the “Exchange Act”). Based upon that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that the Company’s disclosure controls and procedures were not effective as of the end of the period covered by this annual report because of the material weaknesses in internal control over financial reporting described below. Notwithstanding the material weaknesses, based on additional analyses and other procedures performed, management concluded that the financial statements included in this report fairly present in all material respects our financial position, results of operations, capital position, and cash flows for the periods presented in conformity with U.S. generally accepted accounting principles (“GAAP”).

Per Rules 13a-15(e) and 15d-15(e), disclosure controls and procedures are the controls and other procedures that are designed to ensure that information required to be disclosed in the reports that the Company files or submits under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed in the reports that the Company files or submits under the Exchange Act is accumulated and communicated to management, including the Chief Executive Officer and Chief Financial Officer, or persons performing similar functions, as appropriate, to allow timely decisions regarding required disclosure.

(b) Management’s Report on Internal Control over Financial Reporting

Management of the Company is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act). Our system of internal control is designed under the supervision of management, including our Chief Executive Officer and Chief Financial Officer, to provide reasonable assurance regarding the reliability of our financial reporting and the preparation of the Company’s financial statements for external reporting purposes in accordance with GAAP.

Our internal control over financial reporting includes policies and procedures that pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect transactions and dispositions of assets of the Company; provide reasonable assurances that transactions are recorded as necessary to permit preparation of financial statements in accordance with GAAP, and that receipts and expenditures are made only in accordance with the authorization of management and the Boards of Directors of the Company and provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the Company’s assets that could have a material effect on our financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that the controls may become inadequate because of changes in conditions or that the degree of compliance with policies and procedures may deteriorate.

As of December 31, 2024, management assessed the effectiveness of the Company’s internal control over financial reporting based upon the framework established in Internal Control—Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”). A material weakness (as defined in Rule 12b-2 under the Exchange Act) is a deficiency or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement in our annual or interim financial statements will not be prevented or detected on a timely basis.

Based on this assessment, because of the following internal control deficiencies that constitute material weaknesses, management concluded that the Company did not maintain effective internal control over financial reporting as of December 31, 2024.

Risk assessment – We lacked effective periodic risk assessment processes to identify and timely respond to emerging risks in certain financial reporting processes and related internal controls, including independent Credit Review, that were responsive to changes in the business operations and regulatory and economic environments in which the Company operates.

Monitoring – Our recurring monitoring activities over process level control activities, including independent Credit Review, were not operating effectively.

Control activities – We did not sufficiently maintain effective control activities related to independent Credit Review processes and certain loan data reconciliations. Specifically, our independent Credit Review process controls were ineffective as the Company lacked the consistent application of an appropriate framework to validate that the ratings were accurate, timely, and appropriately challenged. These ineffective controls impact the Company’s ability to accurately disclose loan rating classifications, identify problem loans, and ultimately recognize the allowance for credit losses on loans and leases.

As a result of these ineffective risk assessment, monitoring, and control activities, the Board of Directors was not able to exercise sufficient oversight.

These control deficiencies create a reasonable possibility that a material misstatement to the consolidated financial statements will not be prevented or detected on a timely basis, and therefore we concluded that the deficiencies represent material weaknesses in our internal control over financial reporting and our internal control over financial reporting was not effective as of December 31, 2024.

The Company’s independent registered public accounting firm, KPMG LLP, which audited the 2024 consolidated financial statements included in this Form 10-K, has expressed an adverse opinion on the effectiveness of the Company’s internal control over financial reporting. KPMG LLP’s report appears on page 144 of this Annual Report on Form 10-K.

(c) Remediation Status of Reported Material Weaknesses

The Company continues actively working to remediate the material weaknesses described above, including assessing the need for additional remediation steps and implementing additional measures to remediate the underlying causes that gave rise to the material weaknesses, including governance and oversight to ensure an effective control environment.

In early 2024, we appointed several new members to the Board of Directors with extensive experience as financial experts in our industry and backgrounds in risk management, including a new Lead Independent Director, a new Chairman of the Audit Committee and a new Chairman of the Risk Assessment Committee. The number of Audit Committee meetings held has increased substantially during 2024, and both Audit and Risk Assessment Committee meetings have dedicated sessions related to evaluating credit risk in the portfolio. In addition, the Audit Committee has held dedicated sessions to discuss the Company’s methodology and results in determining the allowance for credit losses. While these actions, in conjunction with the actions further described below, have improved the complement of qualified leadership, the Board of Directors was not able to exercise sufficient oversight as a result of the ineffective risk assessment and monitoring activities noted above.

To address the material weakness in our risk assessment processes, we have taken or are in the process of taking the following actions:

•Appointed a Chief Risk Officer, a Chief Credit Officer and a new Senior Director of Credit Review, all with large commercial bank credit experience.

•We are enhancing the depth and breadth of our independent Credit Review program to make the necessary changes to the scoping approach, risk assessment and related processes, and enhancing the stature of the independent Credit Review function. We have improved the level of experience of the personnel performing credit reviews.

To address the material weakness in our monitoring activities, we have taken the following actions:

•Increased the frequency and nature of reporting from our independent Credit Review team and first line business units to the Risk Assessment Committee to support the Board of Directors' risk oversight role.

To address the material weakness related to our control activities, we have identified the following actions:

•Expanding the use of independent credit analysis and reducing the Company's reliance on tools and analyses prepared by our lines of business.

•Hired a new Senior Director of Credit Review and increased the Credit Review team's ability and stature within the organization to independently challenge risk rating scorecard model methodologies and results.

•Assessing the adequacy of staffing levels and expertise within the Company’s independent Credit Review function, considering, among other things, the size, complexity, and risk profile of the Company's loan portfolio. We are enhancing the expertise and adequacy of our staffing levels in the independent Credit Review program.

•Providing additional risk rating process training for all employees involved in the lending and credit review processes.

•Enhancing processes to identify and assess risks associated with estimating the allowance for credit losses and improving data governance processes.

While we believe our actions will be effective in remediating the material weaknesses, we are continuing to assess the need for additional remediation actions. The material weaknesses will not be fully remediated until all aspects of the weaknesses are addressed, the applicable remedial processes and, procedures have been in place for a sufficient period of time and management has concluded, through testing, that our efforts have been effective.

(d) Changes in Internal Control over Financial Reporting

Except for the actions noted above related to remediation of the Company's material weaknesses, there have not been any changes in the Company’s internal control over financial reporting (as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the fiscal quarter to which this report relates that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.