MUNCY COLUMBIA FINANCIAL Corp

Our Chief Executive Officer (CEO) and Chief Financial Officer (CFO) have concluded that our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended), based on their evaluation of these controls and procedures as of the end of the period covered by this Report, were effective as of such date at the reasonable assurance level as discussed below to ensure that information required to be disclosed by us in the reports we file under the Securities Exchange Act of 1934, as amended, is recorded, processed, summarized and reported within the time periods specified in the rules and forms of the Securities and Exchange Commission and that such information is accumulated and communicated to our management, including its principal executive officer and principal financial officer, as appropriate to allow timely decisions regarding required disclosure.

Our management, including the CEO and CFO, does not expect that our disclosure controls and internal controls will prevent all errors and all fraud. A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the system are met. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, within our company have been detected. These inherent limitations include the realities that judgments in decision-making can be faulty, and that breakdowns can occur because of simple error or mistake. In addition, controls can be circumvented by the individual acts of some persons, by collusion of two or more people or by management override of the controls.

The CEO and CFO have evaluated the changes to our internal controls over financial reporting that occurred during our fiscal Quarter Ended December 31, 2024, as required by Rules 13a-15(d) and 15d-15(d) under the Securities Exchange Act of 1934, as amended. There were no significant changes in the Corporation’s internal control over financial reporting that occurred during the period covered by this report that have materially affected, or that are reasonably likely to affect, our internal control over financial reporting.

Management’s Report on Internal Control Over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting for Muncy Columbia Financial Corporation (the “Corporation”). Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles in the United States and is not intended to provide absolute assurance that a misstatement of the Corporation’s financial statements would be prevented or detected.

Internal control over financial reporting includes those policies and procedures that pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the Corporation; provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the Corporation are only being made in accordance with authorizations of management and directors of the Corporation; and provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the Corporation’s assets that could have a material effect on the financial statements.

Any control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. The design of a control system inherently has limitations and the benefits of controls must be weighed against their costs. Additionally, controls can be circumvented by the individual acts of some persons, by collusion of two or more people, or by management override of the controls. Therefore, no assessment of a cost-effective system of internal controls can provide absolute assurance that all control issues and instances of fraud, if any, will be detected.

As of December 31, 2024, management of the Corporation conducted an assessment of the effectiveness of the Corporation’s internal control over financial reporting based on criteria established inInternal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this evaluation under the criteria in the Framework, management concluded that the Corporation’s system of internal control over financial reporting was effective as of December 31, 2024.