Armour Residential REIT Inc

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) that are designed to ensure that information required to be disclosed in our reports filed or submitted under the Exchange Act, is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and to ensure that information required to be disclosed in our reports filed or furnished under the Exchange Act, is accumulated and communicated to our management, including our CEO and CFO, as appropriate, to allow timely decisions regarding required disclosures. Our CEO and CFO participated in an evaluation by our management of the effectiveness of our disclosure controls and procedures as of the end of our fiscal year that ended on December 31, 2024. Based on their participation in that evaluation, our CEO and CFO concluded that our disclosure controls and procedures were effective as of December 31, 2024.

Management Report On Internal Control Over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting for the Company. Internal control over financial reporting is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act as a process designed by, or under the supervision of, our principal executive and principal financial officers and effected by our Board, management and other personnel to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP and includes those policies and procedures that:

•pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of our assets;

•provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with GAAP and that our receipts and expenditures are being made only in accordance with authorizations of our management and directors; and

•provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. As a result, even systems determined to be effective can provide only reasonable assurance regarding the preparation and presentation of financial statements. Moreover, projections of any evaluation of effectiveness to future periods are subject to the risks that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

Management assessed the effectiveness of the Company’s internal control over financial reporting as of December 31, 2024. Management used criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) in Internal Control-Integrated Framework (2013) when making this assessment.

Based on management’s assessment, management concluded that, as of December 31, 2024, the Company’s internal control over financial reporting was effective. The Company’s independent registered public accounting firm, Deloitte & Touche LLP, has issued its attestation report on the Company’s internal control over financial reporting. This report appears on page 75 of this Annual Report on Form 10-K.

Remediation of Previously Reported Material Weaknesses

As previously disclosed in Part II, Item 9A-Controls and Procedures, in our Annual Report on Form 10-K for the fiscal year ended December 31, 2023 and Part 1, Item 4-Controls and Procedures, in our subsequent Quarterly Reports on Form 10-Q for the fiscal quarters ended March 31, 2024, June 30, 2024 and September 30, 2024, we identified material weaknesses in our internal control over financial reporting as of such periods. These material weaknesses consisted of:

•Deficiencies associated with the control environment, relating to (i) our commitment to integrity and ethical values; (ii) our Board demonstrating independence from management and exercising oversight of the development and performance of internal control; (iii) establishment, with Board oversight, of structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives; and (iv) demonstration of a commitment to attract, develop, and retain competent individuals in alignment with objectives;

•Deficiencies associated with risk assessment, relating to considering the potential for fraud in assessing risks to the achievement of objectives; and

•Deficiencies associated with information and communication, relating to: (i) internal communication of information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control and (ii) communicating with external parties regarding matters affecting the functioning of internal control.

As previously disclosed the Company has streamlined the Company’s senior management structure such that the Company now has a single CEO and Vice Chair -Scott Ulm - following the retirement of Jeffrey Zimmer. Also, as previously disclosed, the Company has entered into an advisory agreement with Mr. Zimmer, which documents Mr. Zimmer’s ongoing service to the Company as an ex-officio, non-voting special advisor to the Board, since immediately following his retirement.

In addition, during 2024, management implemented the following actions to enhance its internal control over financial reporting and its corporate culture:

a. Caused ACM to provide a written reminder to all ACM employees of ACM’s and the Company’s policies and procedures that address workplace conduct, professionalism and integrity, including procedures for the submission of complaints without retaliation, and the investigatory process. Such notice also reiterated to employees the need to conduct themselves ethically and professionally and to comply with the Company’s policies and laws and regulations, or face disciplinary action;

b. Revised the Company’s Whistleblower Policy and Code of Business Conduct and Ethics to provide for an independent third-party whistleblower hotline, where complaints can be raised anonymously, without attribution;

c. The Company has added a regular review and assessment of “tone-at-the-top”. The assessment is examined and tested by the internal audit function and includes certifications from senior management to confirm that each senior manager is aware of tone-at-the-top and that such individual has not witnessed any incidents of concern, or, if such an incident has occurred, that it has been dealt with appropriately;

d. Engaged an independent, third-party consultant to provide regular (at least annual) training to all management level personnel regarding tone-at-the-top, and best practices to ensure a positive tone-at-the-top, with Board members invited and encouraged to join such sessions. Management and all of the Board members completed this training during the third quarter of 2024;

e. Hosted town hall meetings in May and November 2024, with plans to continue to conduct additional town hall meetings on a regular basis in 2025, where all ACM personnel will be provided an opportunity to participate in an open discussion with management and have a forum to raise any issues or concerns.

During the fourth quarter of 2024, we completed our testing of the operating effectiveness of the implemented controls and found them to be effective. As a result, we have concluded the material weaknesses have been remediated as of December 31, 2024.

Changes in Internal Control Over Financial Reporting

Except for the changes described above, there has been no change in the Company’s internal control over financial reporting during the fourth quarter ended December 31, 2024 that has materially affected or is reasonably likely to materially affect its internal control over financial reporting as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act.