Krystal Biotech, Inc.

Evaluation of Disclosure Controls and Procedures

Our Chief Executive Officer and our Chief Accounting Officer, with the participation of other members of the Company’s management, have evaluated the effectiveness of the Company’s “disclosure controls and procedures” (as such term is defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the “Exchange Act”)) as of the end of the period covered by this quarterly report, and our Chief Executive Officer and our Chief Accounting Officer have concluded that our disclosure controls and procedures are effective based on their evaluation of these controls and procedures as required by paragraph (b) of Exchange Act Rules 13a-15 or 15d-15.

Changes in Internal Control over Financial Reporting

In June 2025, we implemented a new procure to pay (“P2P”) system that integrates with our existing enterprise resource planning system. As necessary, we are adding to or modifying the design and documentation of internal control processes and procedures relating to the new P2P system to simplify and strengthen our internal control over financial reporting.

Other than as discussed above, no change in our internal control over financial reporting occurred during the quarter ended September 30, 2025 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.