CF BANKSHARES INC.

Evaluation of disclosure controls and procedures. Management is responsible for establishing and maintaining effective disclosure controls and procedures, as defined under Rules 13a-15(e) and 15d-15(e) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Management's assessment of the effectiveness of internal control over financial reporting is expressed at the level of reasonable assurance because a control system, no matter how well designed and operated, can provide only reasonable, but not absolute, assurance that the control system's objectives will be met. As of December 31, 2025, an evaluation was performed under the supervision and with the participation of management, including the Company's Chief Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of our disclosure controls and procedures. Based on that evaluation, management concluded that our internal controls over financial reporting as of December 31, 2025 were effective.

Management’s Report on Internal Control Over Financial Reporting. Information required by Item 308 of Regulation S-K is included on page 54 of this Form 10-K; the information appears under the caption “Management’s Report on Internal Control over Financial Reporting”.

Changes in internal control over financial reporting. There were no changes in our internal controls over financial reporting (as defined in Rule 13a-15(f) under the Exchange Act) in the fourth quarter of 2025 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.