PATRIOT NATIONAL BANCORP INC

Evaluation of Disclosure Controls and Procedures

As of December 31, 2025, the Company carried out an evaluation, under the supervision and with the participation of its Chief Executive Officer and Chief Financial Officer, of the effectiveness of the Company’s disclosure controls and procedures as defined in Rules 13a 15(e) and 15d 15(e) under the Securities Exchange Act of 1934. Based on that evaluation, and in light of the findings described below, the Company’s Chief Executive Officer and Chief Financial Officer concluded that the Company’s disclosure controls and procedures were not effective as of December 31, 2025.

Management’s Report on Internal Control Over Financial Reporting

Management is responsible for establishing and maintaining adequate internal controls over financial reporting (“ICFR”), as defined in rules 13a-15(f) and 15d-15f under the Exchange Act. Management has based its assessment of the effectiveness of ICFR on the Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO 2013”).

During 2025, the Company and the Bank experienced significant changes in leadership, responsibilities, and processes—including turnover in key operational, finance, information technology, and credit roles, and the previously disclosed death of the Bank’s Chief Information Officer in December 2025.

In connection with its evaluation of ICFR as of December 31, 2025, management considered the results of an internal audit review of ICFR performed with the assistance of an independent third-party firm, as well as observations from the Company’s independent registered public accounting firm made in the course of the audit of the Company’s 2025 consolidated financial statements. That review and other procedures identified deficiencies concentrated in documentation, evidential support, and consistent execution of controls—including information technology general controls, financial close and reconciliation controls, and controls over certain third party and digital payments activities. Although no single deficiency rose to a material weakness, due to the breadth and extent of these deficiencies, management concluded that the deficiencies collectively constituted a material

2025 FORM 10-K 102 weakness in the Company’s internal control over financial reporting existed as of December 31, 2025 and, therefore the Company’s internal control over financial reporting was not effective as of that date.

Notwithstanding this conclusion, management believes that the Company’s consolidated financial statements as of and for the year ended December 31, 2025, are fairly presented in all material respects, and the Company’s independent registered public accounting firm has issued an unqualified opinion on those financial statements.

Remediation of Findings

Management has initiated and is executing remediation efforts designed to address the identified material weakness, including enhancing documentation, evidencing, and monitoring of information technology general controls, financial close and reconciliation controls, and controls over certain third party and digital payments activities. While many of these efforts have already been implemented, management will continue to monitor and test the effectiveness of these enhancements, will continue to assess the need for any additional steps to remediate the underlying causes that gave rise to the material weakness, and will not consider the material weakness remediated until controls have operated effectively for a sufficient period and management has obtained evidence to support such a conclusion. Although we believe that the foregoing measures will result in the remediation of the identified material weakness, there can be no assurances that additional remedial steps will not be necessary.

Changes in Internal Control Over Financial Reporting

As discussed above under “Management’s Report on Internal Control Over Financial Reporting” and “Remediation of Findings,” the Company implemented and is implementing certain changes to its internal control over financial reporting during 2025 in connection with the material weakness described therein. Other than such changes, there were no changes in the Company’s internal control over financial reporting (as defined in Rules 13a‑15(f) and 15d‑15(f) under the Securities Exchange Act of 1934) that occurred during the quarter ended December 31, 2025 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.