Velocity Financial Inc

Cybersecurity Risk Management and Strategy

The Company has processes in place for assessing, identifying and managing material risks from cybersecurity threats. Our processes include, but are not limited to, the following:

•

Engaging cyber security consultants, auditors, and other third parties to assess and enhance our cybersecurity practices;

•

Providing periodic training and testing, including phishing tests, to help our employees understand cybersecurity risks and their responsibility in mitigating those risks; and

•

Employing a variety of preventative and detective tools designed to monitor and block suspicious activity.

Our Chief Information Officer (the "CIO") is primarily responsible for this cybersecurity component, reporting directly to the Chief Executive Officer, who periodically reports to our Board of Directors. To date, risks from cybersecurity threats or incidents have not materially affected our company. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents and protect our systems and information may not successfully protect against all cybersecurity threats and incidents.