Rafael Holdings, Inc.

Evaluation of Disclosure Controls and Procedures

An evaluation was performed under the supervision and with the participation of the Company’s management, including the Chief Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of the Company’s disclosure controls and procedures (as defined in Rule 13a-15(e) promulgated under the Securities and Exchange Act of 1934, as amended) as of July 31, 2025. On March 25, 2025, the Company acquired Cyclo Therapeutics, Inc. (Cyclo) in a business combination as described in Note 3 –Cyclo Merger to our audited Consolidated Financial Statements. Management has excluded the acquired business from its assessment of the effectiveness of the disclosure controls and procedures as of July 31, 2025. Based on that evaluation, the Company’s management, including the President and Chief Executive Officer and Chief Financial Officer, concluded that the Company’s disclosure controls and procedures were effective.

Management’s Annual Report on Internal Control over Financial Reporting

The Company’s management is responsible for establishing and maintaining adequate internal control over financial reporting. The internal control process has been designed under management’s supervision to provide reasonable assurance regarding the reliability of financial reporting and the preparation of the Company’s financial statements for external reporting purposes in accordance with U.S. GAAP.

Management conducted an assessment of the effectiveness of the Company’s internal control over financial reporting as of July 31, 2025 utilizing the framework established in Internal Control - Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The scope of management’s assessment of the effectiveness of the Company’s internal control over financial reporting as of July 31, 2025 did not include the internal control over financial reporting of Cyclo, which the Company acquired on March 25, 2025. Cyclo is a wholly owned subsidiary of the Company whose total assets, total liabilities, total revenues and total operating expenses represent approximately 48%, 39%, 53% and 40%, respectively, of the related consolidated financial statement amounts as of and for the year ended July 31, 2025.

Based on this assessment, management has determined that the Company’s internal control over financial reporting as of July 31, 2025, is effective.

The Company’s internal control over financial reporting includes policies and procedures that pertain to the maintenance of records that accurately and fairly reflect, in reasonable detail, transactions and dispositions of assets; and provide reasonable assurances that: (1) transactions are recorded as necessary to permit preparation of financial statements in accordance with U.S. GAAP; (2) receipts and expenditures are being made only in accordance with authorizations of management and the directors of the Company; and (3) unauthorized acquisition, use, or disposition of the Company’s assets that could have a material effect on the Company’s financial statements are prevented or timely detected.

All internal control systems, no matter how well designed, have inherent limitations. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Changes in Internal Control over Financial Reporting

On March 25, 2025, the Company completed a business combination with Cyclo as described in Note 3 –Cyclo Merger to our audited Consolidated Financial Statements. As a result of the acquisition, the Company is reviewing the internal controls of Cyclo and is making appropriate changes as deemed necessary.

Except for the changes in internal controls related to Cyclo, there has been no significant change in the Company’s internal control over financial reporting during the fourth quarter of the year ended July 31, 2025 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.

Material Weakness in the Acquired Business’s Internal Control Over Financial Reporting

As discussed above, on March 25, 2025, the Company acquired Cyclo in a business combination and has excluded the acquired entity from the July 31, 2025 evaluation of the effectiveness of internal control over financial reporting and disclosure controls and procedures. However, management has identified a material weakness in internal control over financial reporting related to the accruals and expenses recognized at Cyclo, a wholly-owned subsidiary, as of July 31, 2025.

A material weakness is a deficiency, or combination of deficiencies, in internal controls over financial reporting such that there is a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements will not be prevented or detected on a timely basis.

The internal controls over financial reporting at Cyclo were not appropriately designed or operating effectively to ensure accruals and associated expenses were recorded completely and accurately, due to inadequately designed controls surrounding the month end accrual identification, measurement and recognition process, including in the area of clinical trial accruals;

The material weakness described above resulted in the identification of immaterial misstatements, which were corrected within the consolidated financial statements for the year ended July 31, 2025.

Remediation Plan for Material Weakness in Internal Control Over Financial Reporting

In response to the material weakness identified above, the Company developed a plan, which will be updated as deemed necessary, to remediate the material weakness at Cyclo, including enhancing the design of and implementing additional process-level control activities and ensuring they are properly evidenced and operating effectively. Such design and implementation control activities will include, but not be limited to:

Because the reliability of the internal control process requires repeatable execution, the successful on-going remediation of the material weakness will require on-going review and evidence of effectiveness prior to concluding that the controls are effective. The Company's remediation efforts are underway; however, there is no assurance that the remediation efforts will be effective in the future or that additional material weaknesses will not develop or be identified.