FLAGSTAR BANK, NATIONAL ASSOCIATION

We are involved in various legal actions arising in the ordinary course of its business. Except as set forth below, all such actions in the aggregate involve amounts that are believed by management to be immaterial to the financial condition and results of operations of Flagstar.

Flagstar and certain former executive officers of Flagstar and certain current and former directors of Flagstar have been named as defendants in a consolidated purported shareholder class action captioned Lemm, Jr. v. New York Community Bancorp, Inc., et al., Case No. 1:24-cv-00903, filed on February 6, 2024 (and later amended on September 6, 2024) in the United States District Court for the Eastern District of New York. This action seeks unspecified compensatory damages to be proven at trial, alleges violations of the federal securities laws, including Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 (the “Exchange Act”) and SEC Rule 10b-5, with respect to disclosures concerning our business, operations and prospects, particularly regarding the impact of the Flagstar Bancorp and Signature transactions and the Bank’s CRE loan portfolio and related matters, that were made in our public SEC filings and press releases during the period beginning on July 27, 2022 and ending on February 29, 2024. In addition, plaintiffs allege claims of violations of various federal securities laws related to the registration statement filed by NYCB in connection with its merger with Flagstar in 2022.

On December 19, 2024, another purported shareholder of Flagstar filed an additional purported shareholder class action, captioned Garfield v. Flagstar Financial, Inc. et al., Case No. 1:24-cv-08655, in the United States District Court for the Eastern District of New York against the Company and certain current and former directors and executive officers of Flagstar. This additional purported class action alleged substantially the same claims as those set forth in the Lemm complaint and the plaintiff has filed a motion to consolidate this matter with the Lemm matter. On April 28, 2025, the Court entered a stipulated order consolidating the Lemm and Garfield matters. The action formerly known as Lemm was then recaptioned by the Court to In re: New York Community Bancorp, Inc. Securities Litigation. We are vigorously defending the allegations set forth in the purported class action complaints and also intend to vigorously defend any related actions.

Flagstar and certain former executive officers of Flagstar and certain current and former directors of Flagstar were also been named as defendants in a consolidated shareholder class action captioned In re New York Community Bancorp and filed in the Commercial Division of the Supreme Court of New York State. This matter consolidates two separate actions brought by two different purported shareholders of the Company, which were consolidated into a single matter on October 8, 2024. The action sought unspecified compensatory damages to be proven at trial and alleged substantially the same claims as those set forth in the Lemm complaint. This matter was voluntarily dismissed with prejudice on May 12, 2025.

Flagstar's former President and Chief Executive Officer and former Senior Executive Vice President and Chief Financial Officer, as well as all of Flagstar’s directors as of January 31, 2024, have also been named as defendants in the following purported shareholder derivative actions: Hauser v. Cangemi, et al., Case No. 1:24-cv-01207, filed on February 15, 2024 in the United States District Court for the Eastern District of New York; Pierce v. Cangemi, et al., Case No. 1:24-cv-01408, filed on February 26, 2024 in the United States District Court for the Eastern District of New York; Karp v. Cangemi et al., Case No. 1:24-cv-01421, filed on February 26, 2024 in the United States District Court for the Eastern District of New York; Wang v. Cangemi et al. Case No. 1:24-cv-01422, filed on February 26, 2024 in the United States District Court for the Eastern District of New York; and Podems v. Cangemi, et al., Case No. 608697/2024, filed on May 17, 2024 in the Supreme Court of the New York State (Nassau County). These actions, which also name Flagstar as a nominal defendant and seek unspecified compensatory damages and certain corporate governance and internal procedures reforms, allege claims of breach of fiduciary duty, gross mismanagement, waste of corporate assets, unjust enrichment, and aiding and abetting with respect to the director defendants, and violations of Sections 10(b) and 21D of the Exchange Act with respect to the officer defendants. The allegations in the complaints relate to disclosures concerning our business, operations and prospects, particularly regarding the impact of the Flagstar Bancorp and Signature transactions and the Bank’s CRE loan portfolio and related matters, that were made in our public SEC filings and press releases during the period beginning on March 1, 2023 and ending on January 31, 2024, as well as the defendants’ management of Flagstar during such period. The parties filed a stipulated motion to consolidate and stay the related matters, pending the entry of a decision on the defendants' motions to dismiss in the related federal securities class action, which was granted by the court on August 18, 2025. The order re-captioned the action as In Re: New York Community Bank Stockholder Derivative Litigation. Plaintiffs filed a consolidated compliant on October 29, 2025. Flagstar has filed a notice to remove the Podems state derivative action to federal court. On March 3, 2025, the federal magistrate granted Podems’ motion to remand the derivative case back to New York state court. Flagstar filed an objection. On April 9, 2025, the judge entered an order adopting the Magistrate Judge’s Report and Recommendation recommending that the Court grant Plaintiff’s motion to remand the case to state court. Therefore, the Podems matter will now proceed in the Supreme Court of New York, Nassau County. On May 27, 2025, the court entered a stipulated order to stay the Podems action in New York State court until the resolution of the motion to dismiss the federal securities class action. Flagstar and the named defendants are vigorously defending these actions and also intend to vigorously defend any related actions.

Flagstar has been named as a defendant in three different sets of purported class actions related to three separate cyber breach incidents. Flagstar has vigorously defended these actions and also intends to vigorously defend any future or related actions. The first set, captioned Phillip Angus et al v. Flagstar Bank, Case No. 2:21-cv-10657-MFL-DRG, filed in the United States District Court for the Eastern District of Michigan, relates to a data breach that occurred in January 2021, after threat actors exploited vulnerabilities in a File Transfer Appliance (FTA) used by Flagstar Bancorp, which was acquired by Flagstar in December 2022, to gain access to confidential customer information. The action seeks unspecified compensatory damages to be proven at trial and alleges breach of implied-in-fact contract, breach of confidence and public disclosure of private fact and also violations of various California consumer protection laws. On March 27, 2025, the court granted Flagstar’s motion to dismiss as to certain allegations and denied Flagstar’s motion to dismiss as to certain other allegations. On April 4, 2025, the court entered a stipulated Order to Stay Proceedings Pending Mediation. The order stayed the matter for 90 days, to allow the parties to participate in mediation to resolve both this matter and the In re: Flagstar December 2021 Data Security Incident Litigation matter, discussed below.

The second set, captioned In re: Flagstar December 2021 Data Security Incident Litigation, Case No. 2:22-cv-11385 is comprised of twenty purported class action lawsuits that were consolidated into a single action filed on June 23, 2023, in the United States District Court for the Eastern District of Michigan, and relates to a cyber breach of Flagstar Bancorp’s information technology system that occurred in December 2021. The action seeks unspecified compensatory damages to be proven at trial and alleges common law and statutory claims associated with the exposure of customers’ Personally Identifiable Information (PII) as a result of the data breach and seeks class certification. On September 30, 2024, the court dismissed 17 of the 18 claims in the plaintiff’s consolidated complaint, allowing only the claim under the California Consumer Privacy Act to proceed, thereby limiting participation in the action to California class members. On April 4, 2025, the court entered a stipulated Order to Stay Proceedings Pending Mediation. The order stayed the matter for 90 days, to allow the parties to participate in mediation to resolve this matter and the Phillip Angus et al v. Flagstar Bank matter, discussed above.

On August 8, 2025, the parties reached a global settlement for both In re: Flagstar December 2021 Data Security Incident Litigationand Phillip Angus et al v. Flagstar Bank. The settlement, which requires court approval would fully resolve the common law and statutory claims of all potential claimants associated with the combined lawsuits. In order to consolidate the two data breach cases, In re: Flagstar December 2021 Data Security Incident Litigation was reassigned to the judge presiding over Phillip Angus et al v. Flagstar Bank. An order was issued on August 25, 2025, closing out In re: Flagstar December 2021 Data Security Incident Litigation and consolidating the two cases into the Angus matter (Case No. 2:21-cv-10657 (E.D. Mich.). As part of the global settlement process, Plaintiffs first filed a consolidated class action complaint on September 24, 2025 and then, on October 1, 2025, filed an unopposed Motion for Preliminary Approval of Class Settlement with the Court. We await the Court's approval of the Motion for Preliminary Approval.

The third set, captioned In re: MOVEit customer data Security Breach Litigation, MDL No.1:23-md-03083-ADB-PGL, is comprised of four purported class action lawsuits filed in October 2023 that were consolidated with other MOVEit class action litigation involving other defendants and later transferred in December 2023 to the United States District Court for the District of Massachusetts for coordinated pretrial and trial proceedings. The class actions involving Flagstar allege claims of negligence, breach of contract and unjust enrichment, among others, and seek unspecified compensatory and punitive damages. Litigation involving Flagstar is currently stayed pending ongoing court proceedings against a representative group of the larger class actions and which are intended to address critical legal and factual issues common to the parties.

The outcome of the pending litigation described above is uncertain. There can be no assurance (i) that we will not incur material losses due to damages, penalties, costs and/or expenses as a result of such litigation, (ii) that the reserves we have established will be sufficient to cover such losses, or (iii) that such losses will not materially exceed such reserves and have a material impact on our financial condition or results of operations. Flagstar may incur significant legal expenses in defending the litigation described above during the pendency of these matters, and in connection with any other potential cases, including expenses for the potential reimbursement of legal fees of officers and directors under indemnification obligations.