FLAGSTAR FINANCIAL, INC.

Evaluation of Disclosure Controls and Procedures

Under the supervision of our Chief Executive Officer and Chief Financial Officer, Management evaluated the effectiveness of design and operation of the Company’s disclosure controls and procedures pursuant to Rule 13a-15(b), as adopted by the SEC under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Management concluded its disclosure controls and procedures were not effective as of June 30, 2025, due to the material weaknesses in its system of Internal Control over Financial Reporting, as described below. Notwithstanding the material weaknesses, Management evaluated its disclosure controls and procedures, and concluded the financial statements included in this report fairly present, in all material respects, the Company’s financial position, results of operations, capital position, and cash flows, for the periods presented, in conformity with GAAP.

Per Rules 13a-15(e) and 15d-15(e), disclosure controls and procedures are the controls and other procedures designed to ensure information required to be disclosed in the reports the Company files or submits under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include activities designed to ensure information required to be disclosed in the reports that the Company files or submits under the Exchange Act is accumulated and communicated to management, including the Chief Executive Officer and Chief Financial Officer, to allow timely decisions regarding required disclosure.

Material Weaknesses in Internal Control over Financial Reporting

A material weakness is a deficiency, or combination of deficiencies, in Internal Control over Financial Reporting, such that there exists a reasonable possibility a material misstatement in the annual or interim financial statements may not be prevented or detected on a timely basis. Management has previously identified the following material weaknesses in its system of Internal Control over Financial Reporting.

Risk assessment: We lacked effective periodic risk assessment processes to identify and timely respond to emerging risks in certain financial reporting processes and related internal controls, including independent Credit Review, that were responsive to changes in the business operations and regulatory and economic environments in which the Company operates.

Monitoring: Our recurring monitoring activities over process level control activities, including independent Credit Review, were not operating effectively.

Control activities: We did not sufficiently maintain effective control activities related to independent Credit Review processes and certain loan data reconciliations. Specifically, our independent Credit Review process controls were ineffective as the Company lacked the consistent application of an appropriate framework to validate that the ratings were accurate, timely, and appropriately challenged. These ineffective controls impact the Company's ability to accurately disclose loan rating classifications, identify problem loans, and ultimately recognize the ACL on loans and leases.

As a result of these ineffective risk assessment, monitoring, and control activities, the Board of Directors were not able to exercise sufficient oversight.

These control deficiencies create a reasonable possibility that a material misstatement to the condensed consolidated financial statements may not be prevented or detected on a timely basis, and therefore we concluded that the deficiencies represent material weaknesses in our Internal Control over Financial Reporting.

Remediation Status of Reported Material Weaknesses

The Company continues actively working to remediate the material weaknesses described above, including assessing the need for additional remediation steps and implementing additional measures to remediate the underlying causes of the material weaknesses, including governance and oversight of its system of Internal Control over Financial Reporting.

In early 2024, the Company appointed several new members to the Board of Directors with extensive experience as financial experts in our industry and backgrounds in risk management, including a new Lead Independent Director, a new Chairman of the Audit Committee and a new Chairman of the Risk Assessment Committee. The frequency of Audit Committee meetings increased substantially during 2024, with both Audit and Risk Assessment Committees dedicating sessions to evaluating credit risk in the portfolio. In addition, the Audit Committee dedicates sessions to discuss the Company’s ACL methodology and results.

Management has identified, and is implementing, the following actions to address the material weakness in our risk assessment processes:

•Appointed a Chief Risk Officer, a Chief Credit Officer and a new Senior Director of Credit Review, all with large commercial bank credit experience.

•Enhancing the depth and breadth of our Independent Credit Review program to make the necessary changes in scoping approach, risk assessment and related processes, and elevating the overall stature of the Independent Credit Review function. We have improved the experience-level of the personnel performing credit reviews.

Management has taken the following actions to address the material weakness in our monitoring activities:

•Increased the frequency and nature of reporting from our Independent Credit Review function and First-Line Business Units to the Board’s Risk Assessment Committee in support of the Boards' risk oversight role.

Management has identified, and is implementing, the following actions to address the material weakness in our control activities:

•Expanding the use of independent credit analysis and reducing the Company's reliance on tools and analyses prepared by First-line Business Units.

•Increased the Credit Review team's ability and elevated its stature within the organization to independently challenge risk rating methodologies and results.

•Assessed the adequacy of staffing levels and expertise within the Independent Credit Review function, considering the size, complexity, and risk profile of the loan portfolios. Management has enhanced the expertise and capacity of the Independent Credit Review function.

•Providing comprehensive risk rating process training to all employees involved in the lending and credit review processes.

•Enhancing processes to identify and assess risks associated with estimating the ACL and improving data governance processes.

While we believe our actions will be effective in remediating the material weaknesses, we continually assess the need for additional remediation actions. The material weaknesses will not be remediated until the remediation activities are in place, with applicable procedures and evidence to support sustainability, and Management concludes, based on validation testing, the remedial efforts are effective.

Changes in Internal Control over Financial Reporting

Except for the actions noted above related to remediation of the Company's material weaknesses, there have been no changes in the Company’s system of Internal Control over Financial Reporting (as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the three months ended June 30, 2025 to which this report relates, which materially affect, or are reasonably likely to materially affect, the Company’s system of Internal Control over Financial Reporting.