Metropolitan Bank Holding Corp.

Evaluation of Disclosure Controls and Procedures

An evaluation was performed under the supervision and with the participation of the Company’s management, including the President and Chief Executive Officer and the Executive Vice President and Chief Financial Officer, of the effectiveness of the design and operation of the Company’s disclosure controls and procedures (as defined in Rule 13a-15(e) promulgated under the Securities and Exchange Act of 1934, as amended) as of December 31, 2025. Based on that evaluation, the Company’s management, including the President and Chief Executive Officer and the Executive Vice President and Chief Financial Officer, concluded that the Company’s disclosure controls and procedures were effective.

The Company’s management is responsible for establishing and maintaining adequate internal control over financial reporting. The Company’s system of internal control over financial reporting is designed under the supervision of management, including our Chief Executive Officer and Chief Financial Officer, to provide reasonable assurance regarding the reliability of our financial reporting and the preparation of the Company’s consolidated financial statements for external reporting purposes in accordance with GAAP.

Our internal control over financial reporting includes policies and procedures that pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect transactions and dispositions of assets; provide reasonable assurances that transactions are recorded as necessary to permit preparation of consolidated financial statements in accordance with GAAP and that receipts and expenditures are made only in accordance with the authorization of management and the Board of Directors; and provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the Company’s assets that could have a material effect on our consolidated financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Projections on any evaluation of effectiveness to future periods are subject to the risk that the controls may become inadequate because of changes in conditions or that the degree of compliance with policies and procedures may deteriorate.

As of December 31, 2025, management assessed the effectiveness of the Company’s internal control over financial reporting based upon the framework established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”). Based upon its assessment, management believes that the Company’s internal control over financial reporting as of December 31, 2025 was effective using these criteria.

The Company’s internal control over financial reporting as of December 31, 2025 has been audited by Crowe LLP, the independent registered public accounting firm that has also audited the Company’s consolidated financial statements of financial condition as of December 31, 2025 and 2024, and the related consolidated statements of operations, comprehensive income, changes in stockholders’ equity, and cash flows for each of the years in the three-year period ended December 31, 2025. Crowe LLP has issued an attestation report with respect to the effectiveness of our internal control over financial reporting as of December 31, 2025. See Part II, Item 8.,*“*Financial Statements and Supplementary Data.”

There were no changes made in the Company’s internal control over financial reporting during the fourth quarter of the year ended December 31, 2025 that had materially affected, or was reasonably likely to materially affect, the Company’s internal control over financial reporting.