ARROW FINANCIAL CORP

Management, under the supervision and with the participation of the Chief Executive Officer (who is our principal executive officer) and Chief Financial Officer (who is our principal financial officer), evaluated the effectiveness of our disclosure controls and procedures, as defined in Rule 13a-15(e) and 15d-15(e) of the Securities Exchange Act of 1934, as amended (the "Exchange Act"), as of December 31, 2024.

Based on that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that as of December 31, 2024, our disclosure controls and procedures over financial reporting were effective. The previously disclosed material weaknesses in Arrow's controls and procedures over financial reporting have been remediated and are further described below under the heading "Management's Report on Internal Control Over Financial Reporting."

Management’s Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting as such term is defined in Exchange Act Rules 13a-15(f) and 15d-15(f).

As of December 31, 2024, our management, under the oversight of our Board of Directors, evaluated the effectiveness of our internal control over financial reporting based on the criteria for effective internal control over financial reporting established by the Committee of Sponsoring Organization of the Treadway Commission (COSO) in Internal Control – Integrated Framework (2013). Based on this evaluation, our management concluded that our internal control over financial reporting was effective as of December 31, 2024 due to the remediation of the material weaknesses previously disclosed in the 2022 Form 10-K and in the 2023 Annual Report on Form 10-K, (the “2023 Form 10-K”). The remediation of the material weaknesses previously disclosed are described below under the header "Remediation of Prior Material Weaknesses in Internal Control Over Financial Reporting.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Management assessed the effectiveness of the Company’s internal control over financial reporting as of December 31, 2024. In making this assessment, management used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control-Integrated Framework. Based on our assessment and those criteria, management concluded that the Company maintained effective internal control over financial reporting as of December 31, 2024.

Remediation of Prior Material Weaknesses in Internal Control Over Financial Reporting

Management of the Company previously identified and disclosed material weaknesses that existed as of December 31, 2022 and December 31, 2023 related to maintaining effective monitoring and oversight of controls including testing of management’s internal control over financial reporting and the completeness and accuracy of information presented to the Audit Committee as well as effectively performing risk assessment procedures to identify the impact of the September 2022 core banking system conversion on our internal controls over financial reporting.

The material weaknesses noted above did not result in misstatements to our consolidated financial statements as of December 31, 2022 or December 31, 2023. As of December 31, 2023, certain remediation measures for these existing material weaknesses were implemented and operating but were not in place for a sufficient amount of time for the material weakness to be considered remediated. KPMG LLP, the Company’s independent registered public accounting firm, who audited the consolidated financial statements included in the 2023 Form 10-K, has issued an attestation report on the Company’s internal control over financial reporting. KPMG LLP’s attestation report contains an adverse opinion on the effectiveness of the Company’s internal control over financial reporting. KPMG LLP’s report is included in Item 8 of the 2023 Form 10-K.

During the year ended December 31, 2024, management completed the following remedial actions:

•The Company evaluated the assignment of responsibilities of internal and external resources associated with the performance of internal control over financial reporting and hired additional resources, contracted external resources, and/or provided additional training to existing resources as appropriate. In addition, we have a process in place to identify and maintain the information required to support the functioning of internal control.

•Audit Committee and management implemented the following actions to improve the monitoring activities related to Audit Committee oversight over Internal Audit’s testing of management’s internal control over financial reporting:

◦Increased the frequency and depth of reporting to the Audit Committee through the creation of a sub-committee of Audit Committee members that meet in the months in which the full Audit Committee does not have scheduled meetings or as needed.

◦Instituted more frequent Audit Committee meetings to facilitate timely review of matters related to the results of the Company’s monitoring program and Internal Audit’s progress against their plan as well as status of control testing results.

◦Developed a comprehensive internal audit strategy and program to test management’s controls over financial reporting.

◦Developed a robust reporting mechanism to ensure the completeness, accuracy and improved effectiveness of information which is presented on a timely basis to the Audit Committee to help fulfill the Audit Committee's oversight responsibilities.

◦Utilized monthly dashboards to report status and results of internal audits as well as operations of internal controls over financial reporting.

◦Engaged a professional services firm to review the Company’s control program required by the Sarbanes-Oxley Act of 2002, as amended, and assist Management with its overall Company-wide processes and with selecting and developing control activities designed to mitigate risks and support achievement of control objectives.

•Performed a thorough risk assessment to identify the impact of the core banking system conversion on our internal control over financial reporting. As a result, the company identified the need for additional controls to mitigate risks and support the achievement of control objectives. These controls have been implemented as part of the overall remediation.

Management has assessed the executed remediation of previously disclosed material weaknesses and concluded that the remediation was successful and internal controls over financial reporting were operating effectively as of December 31, 2024.

The Company’s independent registered public accounting firm, Crowe LLP, has also assessed the remediation and reached the same conclusion as the Company's management. Crowe issued their report on the Company’s internal control over financial reporting, shown under the heading, Report of Independent Registered Public Accounting Firm.

Changes in Internal Control Over Financial Reporting

Except for the remediation of the previously disclosed material weaknesses described above, there were no changes in our internal control over financial reporting, as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act, during the year ended December 31, 2024 that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.