BayFirst Financial Corp.

Evaluation of Disclosure Controls and Procedures

An evaluation of the Company’s disclosure controls and procedures (as defined in Rules 13(a)-15(e) and 15(d)-15(e) of the Exchange Act), was carried out under the supervision and with the participation of the Company’s Chief Executive Officer and Chief Financial Officer as of June 30, 2026, the last day of the period covered by this Quarterly Report. The Company’s Chief Executive Officer and Chief Financial Officer concluded that, as a result of the material weakness in internal control over financial reporting described below, our disclosure controls and procedures were not effective as of June 30, 2026.

Notwithstanding the conclusion that our disclosure controls and procedures were not effective as of June 30, 2026, and notwithstanding the material weakness in our internal control over financial reporting described below, management believes that the condensed consolidated financial statements and related financial information included in this Quarterly Report on Form 10-Q, fairly present in all material respects our financial condition, results of operations, and cash flows as of the dates presented and for the periods ended on such dates, in conformity with accounting principles generally accepted in the United States of America.

Management’s Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act). Internal control over financial reporting is a process designed by, or under the supervision of, our principal executive and principal financial officers, and effected by our Board of Directors, management, and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles and includes those policies and procedures that:

•pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of our assets;

•provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that our receipts and expenditures are being made only in accordance with authorizations of our management and directors; and

•provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of our assets that could have a material effect on the financial statements.

Under the supervision and with the participation of our management, including our Chief Executive Officer, Chief Financial Officer, and Chief Risk Officer, we conducted an evaluation of the effectiveness of our internal control over financial reporting as of June 30, 2026, based on the framework in Internal Control — Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis.

Based on that evaluation, management concluded that our internal control over financial reporting was not effective as of June 30, 2026 due to the material weakness described below.

We identified a material weakness in our internal control over financial reporting related to operating effectiveness of control activities and monitoring of how loans are placed in nonaccrual status and charged off as well as how origination costs are recognized on loans after a portion of the loan has been sold and the resulting gain on sale of government guaranteed loans is calculated. Insufficient review of expense and charge off entries by personnel without appropriate subject matter expertise, management of the same personnel and internal audit. Specifically, procedures used with the system of record were incomplete or incorrect.

This material weakness resulted in a reasonable possibility that a material misstatement of our annual or interim financial statements would not be prevented or detected on a timely basis.

Remediation Plan

Management has begun implementing the following measures to remediate the material weakness:

•Reviews of all related procedures for completeness and correctness

•Training of personnel and management

•Escalation process to senior management

•Evaluating automating steps to insure consistent and correct processes

Management expects this plan to be implemented in the third quarter of 2026.

We will not consider the material weakness remediated until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these controls are designed and operating effectively. The Audit Committee of our Board of Directors is monitoring these remediation efforts.