Gouverneur Bancorp IncMD

Evaluation of Disclosure Controls and Procedures

Under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer, we evaluated the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rule 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934) as of the end of the period covered by this report. Based upon that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that, as of the end of the period covered by this report, our disclosure controls and procedures were effective to ensure (1) that information required to be disclosed in the reports that the Company files or submits under the Securities Exchange Act of 1934, is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms; and (2) that they are alerted in a timely manner about material information relating to the Company required to be filed in its periodic Securities and Exchange Commission filings.

Evaluation of Internal Control Over Financial Reporting

The Company’s management is responsible for establishing and maintaining adequate internal control over financial reporting. The internal control process has been designed under our supervision to provide reasonable assurance regarding

the reliability of financial reporting and the preparation of the Company’s financial statements for external reporting purposes in accordance with accounting principles generally accepted in the United States of America.

Management conducted an assessment of the effectiveness of the Company’s internal control over financial reporting as of September 30, 2024, utilizing the framework established in the 2013 Internal Control – Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Based on this assessment, management has determined that the Company’s internal control over financial reporting as of September 30, 2024 were effective.

Our internal control over financial reporting includes policies and procedures that pertain to the maintenance of records that accurately and fairly reflect, in reasonable detail, transactions and dispositions of assets; and provide reasonable assurances that: (1) transactions are recorded as necessary to permit preparation of financial statements in accordance with accounting principles generally accepted in the United States; (2) receipts and expenditures are being made only in accordance with authorizations of management and the directors of the Company; and (3) unauthorized acquisition, use, or disposition of the Company’s assets that could have a material effect on the Company’s financial statements are prevented or timely detected.

All internal control systems, no matter how well designed, have inherent limitations. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

This annual report does not include an attestation report of the Company’s registered public accounting firm regarding internal control over financial reporting. Management’s report was not subject to attestation by the Company’s registered public accounting firm pursuant to rules of the Securities and Exchange Commission that permit the Company to provide only management’s report in this annual report.

Changes in Internal Control Over Financial Reporting

During the quarter and year ended September 30, 2024, there were no changes in the Company’s internal controls over financial reporting that have materially affected, or are reasonably likely to materially affect, the Company’s internal controls over financial reporting.