Marygold Companies, Inc.

The Company recognizes that cybersecurity threats may pose significant business risks and has developed processes for identifying, assessing, and managing these threats. The Company has implemented a plan for cybersecurity and cyber-related management across its varied business units. This plan allows each business unit to tailor solutions to identify, manage, and mitigate risks based on their own assessment of their unique cybersecurity risks in conjunction with each business unit’s overall risk management process. Having each business unit implement its own plan helps enable appropriate compliance in reporting material cyber events and risks across the Company.

Each business unit’s Chief Information Security Officer (“CISO”) on at least an annual basis is to provide a report to the Company’s senior management, regarding the state of their cybersecurity program and its material cyber risks. These reports are then shared with the Company’s cybersecurity oversight committee to inform and augment the Company’s risk management processes. Additionally, each business unit is required to maintain an incident reporting process to report significant cybersecurity events to the Company. The Company and its business units discuss and partner with third parties to assess, mitigate, audit, educate, implement, operate, protect, and remediate various cybersecurity related elements.

The Company and its business units rely onthird-party service providers for its products and services to run their information systems. This dependence exposes us, along with others who use these service providers, of a cyber breach on their service providers. It’s possible that a cyber-attack at a third-party service provider may have a material financial, operational or reputational impact to the Company. The Company and its business units will continuously monitor these risks associated with its service providers.

Currently, the Corporate Governance & Nominating Committee (“CGNC”) has oversight of the Company’s cybersecurity risk management program. The CGNC will receive reports regarding a cybersecurity breach and impact incidents through the Company’s cybersecurity incident reporting process. Moreover, the CGNC is updated on cybersecurity trends and common deficiencies.

In addition tothe CGNC’s oversight, senior management of the Company’s business units are responsible for the day-to-day operations of protecting their businesses’ information systems. Each business unit is required to report material cybersecurity events to the Company. The Company’s senior management reviews incident reports to determine whether a cyber incident report should be filed with the SEC.

For the fiscal year ending June 30, 2026, the Company had no cyber events requiring disclosure on Form 8-K, Item 1.05 as required under the Securities Exchange Act, Regulation S-K, Item 106.