COASTAL FINANCIAL CORP

Evaluation of Disclosure Controls and Procedures

At December 31, 2025, the end of the period covered by this Annual Report on Form 10-K, our management, with the participation of our Chief Executive Officer and Chief Financial Officer, evaluated the effectiveness of our disclosure controls and procedures as defined in Rule 13a-15(e) under the Securities Exchange Act of 1934. Based on that evaluation, both the Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were effective as of December 31, 2025.

Management’s Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rule 13a-15(f) and 15d-15(f) of the Exchange Act). Our internal control over financial reporting is designed to provide reasonable assurance to our management and board of directors regarding the preparation and fair presentation of published financial statements in accordance with GAAP. Internal control over financial reporting includes self-monitoring mechanisms, and actions are taken to correct deficiencies as they are identified.

An effective internal control system can provide only reasonable assurance with respect to financial statement preparation. Further, because of changes in conditions, the effectiveness of an internal control system may vary over time. There are inherent limitations in any internal control over financial reporting, no matter how well designed, misstatements due to error or fraud may occur and not be detected, including the possibility of circumvention or overriding of controls.

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, conducted an evaluation of the effectiveness of our internal control over financial reporting based on the Internal Control—Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this evaluation, management has concluded that our internal control over financial reporting, as defined in Exchange Act Rule 13a-15(f), was effective as of December 31, 2025.

Existence of Material Weaknesses

A material weakness exists when there is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement in the Company’s annual or interim financial statements will not be prevented or detected on a timely basis.

As previously disclosed in the Company’s Annual Report on Form 10-K for the year ended December 31, 2024, management identified material weaknesses in internal control over financial reporting related to the control environment and the risk assessment and control activities components of the COSO framework associated with accounting and financial reporting for information provided by Banking-as-a-Service (“BaaS”) partners. These material weaknesses resulted in the restatement of the Company’s financial statements for the year ended December 31, 2023 and interim quarterly periods in 2024 and 2023.

Remediation of Previously Identified Material Weaknesses

During 2025, management, under the oversight of the Audit Committee, designed and implemented a comprehensive remediation plan to address the previously identified material weaknesses. Remediation actions included enhancements to the Company’s risk assessment procedures over third-party reports, implementation of new and enhanced controls over partner accounting policies, funds flow documentation, partner journal entries, partner data and information produced by the entity, financial statement impact assessments and the establishment of a formal Partner ICFR Program.

All remediation actions were fully implemented as of December 31, 2025 and operated for a sufficient period to allow management to evaluate their design and operating effectiveness. Management tested the effectiveness of the remediated controls, and Internal Audit independently evaluated the design and operating effectiveness of the Partner ICFR Program and related controls. The controls were determined to be operating effectively during the period tested.

Based on these evaluations, management concluded that the previously identified material weaknesses have been remediated as of December 31, 2025.

Changes in Internal Control over Financial Reporting

In connection with the remediation of the previously identified material weaknesses described above, management implemented enhancements to our internal control over financial reporting during 2025. Except for the remediation activities described above, there were no changes in our internal control over financial reporting during the most recently completed fiscal quarter that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Auditor Attestation

Baker Tilly, an independent registered public accounting firm, has audited the effectiveness of our internal control over financial reporting as of December 31, 2025, and their report is included in Item 8. Financial Statements and Supplementary Data.