FLAGSTAR BANK, NATIONAL ASSOCIATION

Evaluation of Disclosure Controls and Procedures

Under the supervision of our Chief Executive Officer and Chief Financial Officer, Management evaluated the effectiveness of design and operation of our disclosure controls and procedures pursuant to Rule 13a-15(b), as adopted by the SEC under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Management concluded its disclosure controls and procedures were not effective as of September 30, 2025, due to the material weaknesses in its system of Internal Control over Financial Reporting, as described below. Notwithstanding the material weaknesses, Management evaluated its disclosure controls and procedures, and concluded the financial statements included in this report fairly present, in all material respects, Flagstar's financial position, results of operations, capital position, and cash flows, for the periods presented, in conformity with GAAP.

Per Rules 13a-15(e) and 15d-15(e), disclosure controls and procedures are the controls and other procedures designed to ensure information required to be disclosed in the reports Flagstar files or submits under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include activities designed to ensure information required to be disclosed in the reports that Flagstar files or submits under the Exchange Act is accumulated and communicated to management, including the Chief Executive Officer and Chief Financial Officer, to allow timely decisions regarding required disclosure.

Material Weaknesses in Internal Control over Financial Reporting

A material weakness is a deficiency, or combination of deficiencies, in Internal Control over Financial Reporting, such that there exists a reasonable possibility a material misstatement in the annual or interim financial statements may not be prevented or detected on a timely basis. Management has previously identified the following material weaknesses in its system of Internal Control over Financial Reporting.

Risk assessment: We lacked effective periodic risk assessment processes to identify and timely respond to emerging risks in certain financial reporting processes and related internal controls, including independent Credit Review, that were responsive to changes in the business operations and regulatory and economic environments in which Flagstar operates.

Monitoring: Our recurring monitoring activities over process level control activities, including independent Credit Review, were not operating effectively.

Control activities: We did not sufficiently maintain effective control activities related to independent Credit Review processes and certain loan data reconciliations. Specifically, our independent Credit Review process controls were ineffective as Flagstar lacked the consistent application of an appropriate framework to validate that the ratings were accurate, timely, and appropriately challenged. These ineffective controls impact the Company's ability to accurately disclose loan rating classifications, identify problem loans, and ultimately recognize the ACL on loans and leases.

As a result of these ineffective risk assessment, monitoring, and control activities, the Board of Directors were not able to exercise sufficient oversight.

These control deficiencies create a reasonable possibility that a material misstatement to the condensed consolidated financial statements may not be prevented or detected on a timely basis, and therefore we concluded that the deficiencies represent material weaknesses in our Internal Control over Financial Reporting.

Remediation Status of Reported Material Weaknesses

In early 2024, we appointed several new members to the Board of Directors with extensive experience as financial experts in our industry and backgrounds in risk management, including a new Lead Independent Director, a new Chairman of the Audit Committee and a new Chairman of the Risk Assessment Committee. The frequency of Audit Committee meetings increased substantially during 2024, with both Audit and Risk Assessment Committees dedicating sessions to evaluating credit risk in the portfolio. In addition, during 2025, we have added a combined joint session of the Risk Assessment Committee and the Audit Committee that occurs at least quarterly to discuss our ACL methodology and results.

Management has identified and has implemented, the following actions to address the material weakness in our risk assessment processes:

•Appointed a Chief Risk Officer, a Chief Credit Officer and a new Senior Director of Credit Review, all with large commercial bank credit experience.

•Enhanced the depth and breadth of our Independent Credit Review program to make the necessary changes in scoping approach, risk assessment and related processes, and elevating the overall stature of the Independent Credit Review function. We have improved the experience-level of the personnel performing credit reviews.

Management has taken the following actions to address the material weakness in our monitoring activities:

•Increased the frequency and nature of reporting from our Independent Credit Review function and First-Line Business Units to the Board’s Risk Assessment Committee in support of the Boards' risk oversight Management has identified and has implemented the following actions to address the material weakness in our control activities:

•Expanded the use of independent credit analysis and reduced our reliance on tools and analyses prepared by First-line Business Units.

•Increased the Credit Review team's ability and elevated its stature within the organization to independently challenge risk rating methodologies and results.

•Assessed the adequacy of staffing and resource levels and expertise within the Independent Credit Review function, considering the size, complexity, and risk profile of the loan portfolios. Management has enhanced the expertise and capacity of the Independent Credit Review function.

•Provided comprehensive risk rating process training to all employees involved in the lending and credit review processes.

•Enhanced processes to identify and assess risks associated with estimating the ACL and improving data governance processes.

•Increased credit review coverage of the portfolio. Approximately 700 borrowers representing $21.9 billion of loan balances were tested during the nine months ended September 30, 2025.

We continue to actively work to remediate the material weaknesses described above and are primarily in the sustainability and validation testing phase of remediation. We continue to assess our progress and whether any additional remediation steps or additional measures are needed to remediate the underlying causes of the material weaknesses, including the governance and oversight of our system of Internal Control over Financial Reporting.

While we believe our actions will be effective in remediating the material weaknesses, the material weaknesses will not be remediated until the remediation efforts we have taken are deemed to be sufficient through evidence of sustainability and Management concludes the remedial efforts are effective based upon validation testing.

Changes in Internal Control over Financial Reporting

Except for the actions noted above related to remediation of our material weaknesses, there have been no changes in our system of Internal Control over Financial Reporting (as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the three months ended September 30, 2025 to which this report relates, which materially affect, or are reasonably likely to materially affect, our system of Internal Control over Financial Reporting.