Armour Residential REIT Inc

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) that are designed to ensure that information required to be disclosed in our reports filed or submitted under the Exchange Act, is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and to ensure that information required to be disclosed in our reports filed or furnished under the Exchange Act, is accumulated and communicated to our management, including our CEO and CFO, as appropriate, to allow timely decisions regarding required disclosures.

Internal Control Over Financial Reporting

Our CEO and CFO participated in an evaluation by our management of the effectiveness of our disclosure controls and procedures as of the end of our fiscal year that ended on December 31, 2023. Based on their participation in that evaluation, our CEO and CFO concluded that our disclosure controls and procedures were not effective as of December 31, 2023 due to the material weaknesses identified below.

Management Report On Internal Control Over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting for the Company. Internal control over financial reporting is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act as a process designed by, or under the supervision of, our principal executive and principal financial officers and effected by our Board, management and other personnel to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP and includes those policies and procedures that:

•pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of our assets;

•provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with GAAP and that our receipts and expenditures are being made only in accordance with authorizations of our management and directors; and

•provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. As a result, even systems determined to be effective can provide only reasonable assurance regarding the preparation and presentation of financial statements. Moreover, projections of any evaluation of effectiveness to future periods are subject to the risks that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

Management assessed the effectiveness of the Company’s internal control over financial reporting as of December 31, 2023. Management used criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) in Internal Control-Integrated Framework (2013) when making this assessment.

Based on management’s assessment, management concluded that, as of December 31, 2023, the Company’s internal control over financial reporting was not effective due to the material weaknesses identified and described below. The Company’s independent registered public accounting firm, Deloitte & Touche LLP, has issued its attestation report on the Company’s internal control over financial reporting. This report appears on page 75 of this Annual Report on Form 10-K.

Based on our evaluation, we have concluded that we have material weaknesses in each of the following areas:

Control Environment

We did not maintain an effective control environment based on the criteria established in the COSO framework which resulted in deficiencies in principles associated with the control environment. Specifically, these control deficiencies constitute material weaknesses, either individually or in the aggregate, relating to: (i) our commitment to integrity and ethical values; (ii) our Board demonstrating independence from management and exercising oversight of the development and performance of internal control; (iii) establishment, with Board oversight, of structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives; and (iv) demonstration of a commitment to attract, develop, and retain competent individuals in alignment with objectives.

Risk Assessment

We did not maintain effective risk assessment based on the criteria established in the COSO framework which resulted in deficiencies in principles associated with risk assessment. Specifically, this control deficiency constitutes a material weakness, relating to: considering the potential for fraud in assessing risks to the achievement of objectives.

Information and Communication

We did not generate and provide quality information and communication based on the criteria established in the COSO framework, which resulted in deficiencies in the principles associated with the information and communication component. Specifically, these control deficiencies constitute material weaknesses, either individually or in the aggregate, relating to: (i) internal communication of information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control and (ii) communicating with external parties regarding matters affecting the functioning of internal control.

The following was a contributing factor to the material weaknesses in the control environment, risk assessment and information and communication:

Certain members of senior management and the Board did not maintain an appropriate tone at the top. Specifically, certain members of senior management and the Board engaged in inappropriate conduct during the course of the investigation of issues raised internally at the Company in late January 2024 that did not comport with the Company’s culture of compliance and Code of Business Conduct and Ethics, Whistleblower Policy and the Board’s Corporate Governance Guidelines. The tone set by these individuals was insufficient to create the proper environment for effective internal control over financial reporting, to ensure compliance with the Company’s policies, and to further the Company’s commitment to integrity and ethical values.

After giving full consideration to these material weaknesses, and the additional analyses and other procedures that we performed to ensure that our consolidated financial statements included in this Annual Report on Form 10-K were prepared in accordance with GAAP, our management has concluded that our consolidated financial statements present fairly, in all material respects, our financial position, results of operations and cash flows for the periods disclosed in conformity with GAAP. However, these control deficiencies could have resulted in material misstatements to the annual consolidated financial statements that would not have been prevented or detected on a timely basis.

Changes in Internal Control Over Financial Reporting

Except for the changes described above, there has been no change in the Company’s internal control over financial reporting during the fourth quarter ended December 31, 2023 that has materially affected or is reasonably likely to materially affect its internal control over financial reporting as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act.

Remediation Plan and Status

With oversight and input from the Board, management has begun designing and implementing changes in processes and controls to remediate the material weaknesses and to enhance our internal control over financial reporting as noted below. Management and the Board, including the independent members of the Board, have begun to and are continuing to work to remediate the material weaknesses identified herein. While the Company expects to take other remedial actions, including tone at the top training, as described in more detail below, to date, the Company has streamlined the Company’s senior management structure such that the Company now has a single CEO and Vice Chair following the retirement of Jeffrey Zimmer, who will serve as an ex-officio, non-voting special advisor to the Board.

In addition, the Company plans to take the following actions to enhance its internal control over financial reporting and its corporate culture:

a. Cause ACM to instruct certain employees of ACM that their behavior during the investigation that contributed to the determination of the material weaknesses is not acceptable and will count against a two-strike policy, enter adverse written entries to such individuals’ human resources files and provide counseling to such individuals regarding how to comport themselves in the future;

b. Revise the Company’s Whistleblower Policy to provide for an independent third-party whistleblower hotline, where complaints can be raised anonymously, without attribution (in addition to the existing avenue of anonymous reporting to the Company’s outside legal counsel);

c. Add a tone-at-the-top assessment to the internal audit function at the Company, as an area for regular examination and assessment, including certifications from senior management to confirm that each senior manager is aware of “tone-at-the-top” and that such individual has not witnessed any incidents of concern, or, if such an incident has occurred, that it has been dealt with appropriately;

d. Provide, and cause ACM to provide, regular (at least annual) training conducted by an independent, third-party consultant to all management level personnel regarding “tone-at-the-top,” and best practices to ensure a positive tone at the top, with Board members joining such sessions annually;

e. Host town hall meetings on a regular basis, where all Company and ACM personnel will be provided an opportunity to participate in an open discussion and contribute to determining agenda topics for future meetings.

Management believes the foregoing efforts will effectively remediate the material weaknesses described above. However, as the Company continues to evaluate and work to improve its internal control over financial reporting, management may determine to take additional measures to improve controls or determine to modify the remediation plan described above. The Company is working to remediate the material weaknesses identified above as efficiently and effectively as possible. At this time, the Company cannot provide an estimate of the timing or costs expected to be incurred in connection with implementing this remediation plan.

As of the filing of this Form 10-K, the material weaknesses described above have not been remediated in full. The material weaknesses described above cannot be considered remediated until the applicable controls have operated for a sufficient period of time and management has concluded, through testing, that these controls are designed and operating effectively. Accordingly, management will continue to monitor and evaluate the effectiveness of our internal control over financial reporting in the activities affected by the material weaknesses described above.