FLAGSTAR BANK, NATIONAL ASSOCIATION

(a) Evaluation of Disclosure Controls and Procedures

Under the supervision, and with the participation, of our management including our Chief Executive Officer and Chief Financial Officer, we evaluated the effectiveness of the design and operation of the Bank’s disclosure controls and procedures pursuant to Rule 13a-15(b), as adopted by the Securities and Exchange Commission (the “SEC”) under the Securities Exchange Act of 1934 (the “Exchange Act”). Based upon that evaluation, as of the end of the period covered by this report, the Bank's Chief Executive Officer and Chief Financial Officer concluded that the Bank’s disclosure controls and procedures were effective, in all material respects, to ensure that information required to be disclosed in the reports the Bank files and submits under the Exchange Act are recorded, processed, summarized and reported as and when required and information is accumulated and communicated to management including our Chief Executive Officer and Chief Financial Officer, as appropriate to allow timely decisions regarding disclosure.

(b) Management’s Assessment as to the Effectiveness of Internal Control Over Financial Reporting

Management of the Bank is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act). Our system of internal control is designed under the supervision of management, including our Chief Executive Officer and Chief Financial Officer, to provide reasonable assurance regarding the reliability of our financial reporting and the preparation of the Bank’s financial statements for external reporting purposes in accordance with generally accepted accounting principles in the United States of America. Management of the Bank assessed the effectiveness of the Bank's internal control over financial reporting as of December 31, 2025. Management's assessment is based upon the framework established in Internal Control—Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) and was designed to provide reasonable assurance that the Bank maintained effective internal control over financial reporting as of December 31, 2025. Based on this assessment, management believes that the Bank maintained effective internal control over financial reporting as of December 31, 2025. The effectiveness of our internal control over financial reporting has been audited by KMPG LLP (PCAOB ID: 185), an independent registered public accounting firm, as stated in its report included herein.

Remediation of Previously Disclosed Material Weaknesses

As disclosed in Part II - Item 9A. of the Bank's Annual Report on Form 10-K for the year ended December 31, 2024, management previously identified the following material weaknesses in our internal control over financial reporting:

Risk assessment – We lacked effective periodic risk assessment processes to identify and timely respond to emerging risks in certain financial reporting processes and related internal controls, including independent Credit Review, that were responsive to changes in the business operations and regulatory and economic environments in which the Bank operates.

Monitoring – Our recurring monitoring activities over process level control activities, including independent Credit Review, were not operating effectively.

Control activities – We did not sufficiently maintain effective control activities related to independent Credit Review processes and certain loan data reconciliations. Specifically, our independent Credit Review process controls were ineffective as the Bank lacked the consistent application of an appropriate framework to validate that the ratings were accurate, timely, and appropriately challenged. These ineffective controls impact the Bank's ability to accurately disclose loan rating classifications, identify problem loans, and ultimately recognize the allowance for credit losses on loans and leases.

As a result of these ineffective risk assessment, monitoring, and control activities, the Board was not able to exercise sufficient oversight.

In early 2024, we appointed several new members to the Board with extensive experience as financial experts in our industry and backgrounds in risk management, including a new Lead Independent Director, a new Chairman of the Audit Committee (the "Audit Committee") of the Board and a new Chairman of the RAC. The frequency of Audit Committee meetings have increased substantially, with both the Audit and RAC dedicating sessions related to evaluating credit risk in the portfolio. In addition, we have added a combined joint session of the RAC and the Audit Committee that occurs at least quarterly to discuss our ACL methodology and results.

Management implemented the following actions to address the material weakness in our risk assessment processes:

•Appointed a Chief Risk Officer, a Chief Credit Officer and a new Senior Director of Credit Review, all with large commercial bank credit experience.

•Enhanced the depth and breadth of our independent Credit Review program to make the necessary changes to the scoping approach, risk assessment and related processes, and elevated the overall stature of the independent Credit Review function. We have improved the experience-level of the personnel performing credit reviews.

Management has taken the following actions to address the material weaknesses in our monitoring activities:

•Increased the frequency and nature of reporting from our independent Credit Review function and First-Line Business Units to the Board's RAC.

In support of the Board's risk oversight, management implemented the following actions to address the material weaknesses in our control activities:

•Expanded the use of independent credit analysis and reduced our reliance on tools and analyses prepared by First-Line Business Units.

•Increased the Credit Review team's ability and elevated its stature within the organization to independently challenge risk rating methodologies and results.

•Enhanced the expertise and capacity of the Independent Credit Review function considering the size, complexity and risk profile of the loan portfolios.

•Provided comprehensive risk rating process training to all employees involved in the lending and credit review processes.

•Enhanced processes to identify and assess risks associated with estimating the ACL and improving data governance processes.

•Increased credit review coverage of the portfolio.

Management has completed testing of the implemented controls and found them to be operating effectively. As a result, management has concluded that the material weaknesses in internal control over financial reporting have been remediated as of December 31, 2025.

(c) Changes in Internal Control over Financial Reporting

Other than the remediation of the previously identified material weaknesses described in "Remediation of Previously Disclosed Material Weaknesses" above, there have not been any changes in the Bank's internal control over financial reporting (as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the fiscal quarter to which this report relates that have materially affected, or are reasonably likely to materially affect, the Bank's internal control over financial reporting.