Pathfinder Bancorp, Inc.

Overview of Internal Control

Internal control processes and procedures help entities achieve important objectives and sustain and improve performance. The COSO Framework (as defined below) enables organizations to effectively and efficiently develop systems of internal control that adapt to changing business and operating environments, mitigate risks at acceptable levels and support sound decision making and governance of organizations. The COSO Framework defines internal control as “a process, effected by an entity’s Board of Directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting and compliance.” The COSO Framework provides three categories of objectives, which allow organizations to focus on differing aspects of internal control: (a) Operations Objectives, (b) Reporting Objectives and (c) Compliance Objectives.

Management’s Report on Internal Control over Financial Reporting

Management is responsible for establishing and maintaining effective internal control over financial reporting, as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act. Our internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP.

Management evaluates the effectiveness of internal control over financial reporting and tests for reliability of recorded financial information through a program of ongoing internal audits. Any system of internal control, no matter how well designed, has inherent limitations, including the possibility that a control can be circumvented or overridden and misstatements due to error or fraud may occur and not be detected. Also, because of changes in conditions, internal control effectiveness may vary over time. Accordingly, even an effective system of internal control will provide only reasonable assurance with respect to financial statement preparation. Under applicable SEC accounting related rules, a material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements would not be prevented or detected on a timely basis.

Management conducted the Evaluation based on the 2013 framework established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (the COSO Framework).

As a result of the Evaluation as of December 31, 2025, management has determined that there were no material weaknesses in the Company’s internal controls over financial reporting.

This annual report does not include an attestation report of the Company’s independent registered public accounting firm regarding internal control over financial reporting. Management’s report was not subject to attestation by the Company’s independent registered public accounting firm pursuant to rules of the SEC that permit the Company to provide only management’s report in this annual report.

Oswego, New York

March 30, 2026

-55 -