COASTAL FINANCIAL CORP

Disclosure Controls and Procedures.

An evaluation was performed under the supervision and with the participation of the Company's management, including the Chief Executive Officer and the Chief Financial Officer, of the effectiveness of the design and operation of the Company's disclosure controls and procedures (as defined in Rule 13a-15(e) promulgated under the Securities Exchange Act of 1934, as amended (the “Exchange Act”)). Based on that evaluation, the Company's Chief Executive Officer and the Chief Financial Officer concluded that, as of the end of the period covered by this report, the Company's disclosure controls and procedures were effective for the purpose of ensuring that the information required to be disclosed in the reports that the Company files or submits under the Exchange Act with the SEC (1) is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and (2) is accumulated and communicated to the Company’s management, including its principal executive and principal financial officers, as appropriate, to allow timely decisions regarding required disclosure.

Previously Identified Material Weaknesses

As previously reported in our Annual Report on Form 10-K filed with the SEC on March 17, 2025, we have identified material weaknesses in internal control over financial reporting. These material weaknesses resulted from (i) an ineffective control environment, which did not maintain the risk assessment and control activities components of the COSO framework resulting in the Company not appropriately designing and implementing sufficient internal controls around the accounting and financial reporting related to information provided by BaaS partners; (ii) a deficiency in the design of controls related to the BaaS lending partner accounting policies reflected in BaaS partner reports that could impact the Company’s use of such reports to record interest income, BaaS loan expense and the related balance sheet accounts; and (iii) a deficiency in the design of controls related to the proper presentation of BaaS partner interchange fees on point of sale transactions that conforms with the Company’s adopted accounting policies. As a result, certain amounts included in interest income, non-interest income, BaaS loan expense, non-interest expense, and the related balance sheet accounts were not recognized in accordance with U.S. generally accepted accounting principles, which required a restatement of the financial statements for the year ended December 31, 2023, and the interim quarterly periods in 2024 and 2023.

Remediation Plan

Since identifying the material weaknesses, management, under the oversight of the Audit Committee has committed to remediate these deficiencies. The Company continues to execute on its remediation plan, which includes implementing controls to:

•Enhance our risk assessment procedures over third-party reports to identify whether additional control activities are needed to conform third party reports to the Company’s accounting policies.

•Periodically verify the accounting policies used by a specific BaaS partner

•Evaluate whether any entries are needed to adjust the interest income and BaaS loan expense reflected on the specific BaaS partner’s system reports

•Evaluate whether any adjustments are needed to third party revenue reports to comply with the Company’s accounting policies.

Change in Internal Control over Financial Reporting.

Other than the remediation efforts described above, there were no changes in the Company’s internal control over financial reporting occurred during the six months ended June 30, 2025, that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.