FIRST UNITED CORP/MD/

The Corporation maintains disclosure controls and procedures that are designed to ensure that information required to be disclosed in the Corporation’s reports filed under the Exchange Act with the SEC, such as this annual report, is recorded, processed, summarized and reported within the time periods specified in those rules and forms, and that such information is accumulated and communicated to the Corporation’s management, including the principal executive officer (“PEO”) and the principal financial officer (“PFO”), as appropriate, to allow for timely decisions regarding required disclosure. A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. These inherent limitations include the realities that judgments in decision-making can be faulty, and that breakdowns can occur because of simple error or mistake. Additionally, controls can be circumvented by the individual acts of some persons, by collusion of two or more people, or by management override of the control. The design of any system of controls also is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions; over time, a control may become inadequate because of changes in conditions, or the degree of compliance with the policies or procedures may deteriorate.

Pursuant to Item 308(b) of the SEC’s Regulation S-K, this annual report does not include an attestation report of the Corporation’s registered public accounting on the Corporation’s internal control over financial reporting because the Corporation is not an “accelerated filer” or a “large accelerated filer” as such terms are defined in Rule 12b-2 promulgated under the Exchange Act.

An evaluation of the effectiveness of these disclosure controls and procedures as of December 31, 2025 was carried out under the supervision and with the participation of the Corporation’s management, including the PEO and the PFO. Based on that evaluation, the Corporation’s management, including the PEO and the PFO, has concluded that the Corporation’s disclosure controls and procedures are, in fact, effective at the reasonable assurance level.

During the fourth quarter of 2025, there was no change in the Corporation’s internal control over financial reporting that has materially affected, or is reasonably likely to materially affect, the Corporation’s internal control over financial reporting.

As required by Section 404 of the Sarbanes-Oxley Act of 2002, management has performed an evaluation and testing of the Corporation’s internal control over financial reporting as of December 31, 2025. Management’s report on the Corporation’s internal control over financial reporting is included on the following page.

Management’s Report on Internal Control Over Financial Reporting

The Board of Directors and Shareholders

First United Corporation

First United Corporation’s management is responsible for establishing and maintaining adequate internal control over financial reporting. This internal control system was designed to provide reasonable assurance to management and the Board of Directors as to the reliability of First United Corporation’s financial reporting and the preparation and presentation of financial statements for external purposes in accordance with accounting principles generally accepted in the United States, as well as to safeguard assets from unauthorized use or disposition.

An internal control system, no matter how well designed, has inherent limitations. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation and may not prevent or detect misstatements in the financial statements or the unauthorized use or disposition of First United Corporation’s assets. Also, projections of any evaluation of effectiveness of internal controls to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with policies and procedures may deteriorate.

Management assessed the effectiveness of First United Corporation’s internal control over financial reporting as of December 31, 2025, based on the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control--Integrated Framework (2013 Framework). Based on this assessment and on the foregoing criteria, management has concluded that, as of December 31, 2025, First United Corporation’s internal control over financial reporting is effective.