Greenlane Holdings, Inc.

Evaluation of Disclosure Controls and Procedures

Under the supervision and with the participation of our management, including our principal executive officer and principal financial officer, we conducted an evaluation (pursuant to Rule 13a-15(b) of the Exchange Act) of the effectiveness of our disclosure controls and procedures, as defined in Rule 13a-15(e) under the Exchange Act as of December 31, 2025.

Disclosure controls and procedures are controls and other procedures that are designed to ensure that information required to be disclosed in our reports filed or submitted under the Exchange Act is recorded, processed, summarized, and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include controls and procedures designed to ensure that information required to be disclosed in our company’s reports filed under the Exchange Act is accumulated and communicated to management, including our Chief Executive Officer and Chief Financial Officer, to allow timely decisions regarding required disclosure. During the fourth quarter of 2025, management began implementing additional controls related to digital asset custody, wallet access authorization, fair value measurement, and reconciliation between blockchain records and the general ledger. These controls were not fully implemented as of December 31, 2025.

Based on the evaluation of our disclosure controls and procedures, our Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were ineffective as of December 31, 2025 due to the material weaknesses identified and described below.

Management’s Report on Internal Control Over Financial Reporting

Our management, including our Chief Executive Officer and Chief Financial Officer, is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act). Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with U.S. GAAP. Our internal control over financial reporting includes those policies and procedures that: (i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of our assets; (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with U.S. GAAP, and that our receipts and expenditures are being made only in accordance with authorizations of our management and directors; and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of our assets that could have a material effect on the financial statements.

Under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer, we conducted an evaluation of the effectiveness of our internal control over financial reporting as of December 31, 2025, based on the framework in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) (2013 framework). Based on this evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that as of December 31, 2025, the Company has not maintained effective internal control over financial reporting due to the material weaknesses identified and described below.

Material Weaknesses

The following material weaknesses have been identified by management and will serve as the basis of active remediation efforts during 2026:

Information Systems (IT) Access Controls

Among the previously reported design and operating deficiencies which contributed to material weaknesses in our control activities, management noted ineffective user access controls over certain IT systems to appropriately segregate duties and adequately restrict user access to financial applications and data to the appropriate personnel. While certain compensating control activities have been designed and implemented to mitigate the risks related to ineffective user access controls, these compensating control activities are not expected to operate at a level of precision that would prevent or detect a misstatement that could be material.

Digital Asset Treasury Controls

Upon completion of the Company’s transformation to a digital asset treasury strategy in October 2025, management began implementing additional controls related to digital asset custody, wallet access authorization, fair value measurement, and reconciliation between blockchain records and the general ledger. In this regard, effective controls must be established related to the processing, recording and valuation of digital assets. Such controls were not fully implemented by December 31, 2025.

Control Environment

We did not maintain an effective control environment to enable the identification and mitigation of risks of material accounting errors and ensure corrective activities were appropriately applied, prioritized, and implemented in a timely manner.

Control Activities

As part of our remediation efforts related to the material weaknesses identified in the prior year, we continued our efforts during 2025 to design and implement control activities, however, design efforts relating to control activities were not fully implemented. Control deficiencies were identified associated with control activities. Specifically, these control deficiencies constitute material weaknesses, either individually or in the aggregate, relating to: (i) selecting, developing, and documenting control activities that contribute to the mitigation of risks and support achievement of objectives, (ii) selecting and developing general control activities over technology to support the achievement of objectives, and (iii) effectively communicating and deploying control activities within the organization through policies that establish what is expected and procedures that put policies into action.

Information and Communication

We did not implement effective information and communication control activities. A control deficiency was identified which constitutes a material weakness relating to information technology controls, which includes information security, systems change management and computer operations for systems and applications that are critical to processing financial transactions and capturing and reporting information in the financial reporting process. These ineffective information technology controls contributed to ineffective data validation of spreadsheets and system-generated reports utilized in the preparation of the financial statements and disclosures.

Monitoring

We did not implement effective monitoring activities. Control deficiencies were identified which constitute material weaknesses, individually and in the aggregate, relating to: (i) selecting, developing, and performing ongoing evaluation to ascertain whether the components of internal controls are present and functioning, and (ii) evaluating and communicating internal control deficiencies in a timely manner to those parties responsible for taking corrective action.

Remediation Plan and Status

Management is committed to remediating the material weaknesses in internal control over financial reporting described above and has developed a comprehensive remediation plan to be implemented throughout fiscal year 2026. The remediation efforts are focused on strengthening the Company’s control environment, enhancing information technology general controls, formalizing control activities, and implementing robust processes over the Company’s digital asset treasury operations. As part of this plan, the Company intends to enhance its finance, accounting, and information technology resources, including the hiring of additional personnel with expertise in internal controls and digital asset accounting, upgrading its ERP system, and engaging third-party specialists to assist in the design, implementation, and testing of controls.

With respect to information systems and access controls, the Company will be upgrading its ERP system and implementing improvements to user access management, including the establishment of role-based access controls, enhanced segregation of duties, and formalized processes for provisioning, modifying, and terminating user access. The Company is also implementing multi-factor authentication, performing periodic user access reviews, and strengthening controls over system changes and computer operations. These efforts are intended to establish effective information technology general controls that support the reliability of financial reporting.

To address the material weaknesses related to its digital asset treasury activities, the Company is designing and implementing controls over digital asset custody, wallet access authorization, transaction processing, valuation, and reconciliation. These enhancements include the implementation of multi-signature authorization protocols, independent reconciliation processes between blockchain records and the general ledger, and formalized fair value methodologies using approved pricing sources. The Company will also be implementing enhanced review controls over digital asset transactions and balances.

In addition, the Company plans to strengthen its overall control environment and control activities by formalizing accounting policies and procedures, improving the financial statement close process, and reducing reliance on manual and off-platform tools through increased use of system-based solutions. The Company is implementing standardized processes for account reconciliations, journal entry preparation and review, and financial reporting, supported by enhanced documentation and training of personnel. Further, the Company is improving information and communication controls by establishing controls over the completeness and accuracy of system-generated reports and spreadsheets utilized in financial reporting.

The Company is also enhancing its monitoring activities by implementing ongoing evaluation processes, including periodic management reviews and internal control testing, to assess the effectiveness of its internal control over financial reporting. Deficiencies identified through these monitoring activities will be evaluated and communicated in a timely manner, and remediation actions will be tracked to completion. The Company will provide regular updates to senior management and the Audit Committee regarding the status of its remediation efforts.

While management believes the measures described above will remediate the identified material weaknesses, the implementation and testing of these enhancements will require time, and the material weaknesses will not be considered remediated until the applicable controls have been designed, implemented, and have operated effectively for a sufficient period of time.

Changes in Internal Control Over Financial Reporting

Upon completion of the Company’s transformation to a digital asset treasury strategy in October 2025, management began implementing additional controls related to digital asset custody, wallet access authorization, fair value measurement, and reconciliation between blockchain records and the general ledger. In this regard, effective controls must be established related to the processing, recording and valuation of digital assets. Such controls were not fully implemented by December 31, 2025.

Inherent Limitations on Effectiveness of Controls

Management recognizes that a control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud or error, if any, have been detected. These inherent limitations include the realities that judgments in decision making can be faulty, and that breakdowns can occur because of a simple error or mistake. Additionally, controls can be circumvented by the individual acts of some persons, by collusion of two or more people, or by management override of the controls. The design of any system of controls is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions; over time, controls may become inadequate because of changes in conditions, or the degree of compliance with policies or procedures may deteriorate. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected.