Velocity Financial, Inc.

Cybersecurity Risk Management and Strategy

The Company hasprocesses in place for assessing, identifying and managing material risks from cybersecurity threats. Our processes include, but are not limited to, the following:

•

Engaging cyber security consultants, auditors, and other third parties to assess and enhance our cybersecurity practices;

•

Providing periodic training and testing, including phishing tests, to help our employees understand cybersecurity risks and their responsibility in mitigating those risks; and

•

Employing a variety of preventative and detective tools designed to monitor and block suspicious activity.

Our interim Chief Information Officer (the “CIO”) is primarily responsible for this cybersecurity component, reporting directly to the Chief Executive Officer, who periodically reports to our Board of Directors. Our interim CIO has over 10 years of prior work experience in cybersecurity. To date, risks from cybersecurity threats or incidents havenot materially affected us. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents and protect our systems and information may not successfully protect against all cybersecurity threats and incidents.