Armour Residential REIT, Inc.: Form 10-K for the period ended Dec 31, 2025

Risk Management

We recognize the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the integrity and confidentiality of our data. ACM has established the ITSC to help mitigate technology risks including those relating to cybersecurity. One of the roles of the ITSC is to oversee cyber risk assessments, monitor applicable key risk indicators, review cybersecurity training procedures, oversee the Company’s Cybersecurity Incident Response Plan and engage third-party service providers to conduct periodic penetration testing, advise on current best practices and review policies and procedures.

Third-party Service Providers

The ITSC engages with external experts, including cybersecurity assessors and consultants in evaluating and testing our cyber risk systems. These engagements enable leveraging specialized knowledge and provides insight to attempt to ensure the cybersecurity strategies and processes are industry best practices. Our collaboration with these third-party service providers includes regular audits, threat assessments, and consultation on security enhancements.

Because of the risks associated with third-party service providers, the ITSC has implemented processes to oversee and manage these risks. Security assessments of key third-party providers are performed before engagement with ongoing monitoring performed to attempt to ensure compliance with cybersecurity standards. The monitoring includes quarterly assessments by the ITSC. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. Our cybersecurity risk assessment includes an evaluation of cyber risk related to sensitive data held by third parties on their systems. There is no assurance that these efforts will effectively mitigate cybersecurity risk and mitigation efforts are not an assurance that no cybersecurity incidents will occur.

Risks from Cybersecurity Threats

We rely on our financial, accounting and other data processing systems. Computer malware, viruses, computer hacking and phishing attacks have become more prevalent in our industry and may occur on our systems. Although we have not detected a material cybersecurity breach to date, or encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition, other financial services institutions have reported material breaches of their systems, some of which have been significant. Even with all reasonable security efforts, not every breach can be prevented or even detected. It is possible that we have experienced an undetected breach. There is no assurance that we, or the third parties that facilitate our business activities, have not or will not experience a breach. It is difficult to determine what, if any, negative impact may directly result from any specific interruption or cyber-attacks or security breaches of our networks or systems (or the networks or systems of third parties that facilitate our business activities), any failure to maintain performance or any other risk from cybersecurity threats.See Item 1A. Risk Factors of this Form 10-K for further discussion.

Governance

Our Board is aware of the critical nature of managing risks associated with cybersecurity threats and has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats. Our Audit Committee periodically monitors and oversees our information and cybersecurity risks including reviewing and approving any information and cybersecurity policies, procedures and resources, and reviewing our information and cybersecurity risk assessment, detection, protection, and mitigation systems.

We do not own or lease any real estate or other physical properties. Pursuant to the management agreement, ACM maintains our executive offices at 3001 Ocean Drive, Suite 201, Vero Beach, Florida 32963. We consider our current office space adequate for our current operations.

We seek to create stockholder value through thoughtful investment and risk management of a leveraged and diversified portfolio of MBS. While we do not seek to avoid risk completely, we believe the risk can be quantified from historical experience and seek to actively manage that risk, to earn sufficient compensation to justify taking those risks and to maintain capital levels consistent with the risks we undertake.

Interest Rate Risk

Our primary market risk is interest rate risk. Interest rates are highly sensitive to many factors, including governmental monetary and tax policies, domestic and international economic and political considerations and other factors beyond our control. Changes in the general level of interest rates can affect net interest income, which is the difference between the interest income earned on our assets and the interest expense incurred in connection with our liabilities, by affecting the spread between the interest-earning assets and interest-bearing liabilities. Changes in the level of interest rates also can affect the value of MBS and our ability to realize gains from the sale of these assets. A decline in the value of the MBS pledged as collateral for borrowings under repurchase agreements could result in the counterparties demanding additional collateral pledges or liquidation of some of the existing collateral to reduce borrowing levels.

Our borrowings are not subject to similar restrictions and are generally repurchase agreements of limited duration that track the Federal Funds Rate and SOFR and are periodically refinanced at current market rates. Therefore, on average, our cost of funds may rise or fall more quickly than our earnings rate on our assets. Hence, in a period of increasing interest rates, interest rates on our borrowings could increase without limitation, while the changes in the interest rates on our mortgage related assets could be limited. These factors could lower our net interest income or cause a net loss during periods of rising interest rates, which would negatively impact our liquidity, net income and our ability to make distributions to stockholders.

We anticipate that in most cases the interest rates, interest rate indices and repricing terms of our mortgage assets and our funding sources will not be identical, thereby creating an interest rate mismatch between assets and liabilities. These indices generally move in the same direction, but there can be no assurance that this will continue to occur. Furthermore, our net income may vary somewhat as the spread between one-month interest rates, the typical term for our repurchase agreements, and the interest rates on our mortgage assets varies. During periods of changing interest rates, such interest rate mismatches could negatively impact our net interest income, dividend yield and the market price of our stock.

Another component of interest rate risk is the effect changes in interest rates will have on the market value of our MBS. We face the risk that the market value of our MBS will increase or decrease at different rates than that of our liabilities, including our derivative instruments and obligations to return securities received as collateral.

We primarily assess our interest rate risk by estimating the effective duration of our assets and the effective duration of our liabilities and by estimating the time difference between the interest rate adjustment of our assets and the interest rate adjustment of our liabilities. Effective duration essentially measures the market price volatility of financial instruments as interest rates change. We generally estimate effective duration using various financial models and empirical data. Different models and methodologies can produce different effective duration estimates for the same securities.

The sensitivity analysis tables presented below reflect the estimated impact of an instantaneous parallel shift in the yield curve, up and down 50 and 100 basis points, on the market value of our interest rate-sensitive investments and net interest income, at December 31, 2025 and December 31, 2024. It assumes that the mortgage spread on our MBS remains constant. Actual interest rate movements over time will likely be different, and such differences may be material. When evaluating the impact of changes in interest rates, prepayment assumptions and principal reinvestment rates are adjusted based on ACM’s expectations. Interest rates for interest rate swaps

Market Risk Disclosures (continued)

and repurchase agreements are assumed to remain positive. The analysis presented utilized assumptions, models and estimates of ACM based on ACM's judgment and experience.

While the tables above reflect the estimated immediate impact of interest rate increases and decreases on a static securities portfolio, we rebalance our securities portfolio from time to time either to seek to take advantage of or reduce the impact of changes in interest rates. It is important to note that the impact of changing interest rates on market value and net interest income can change significantly when interest rates change beyond 100 basis points from current levels. Therefore, the volatility in the market value of our assets could increase significantly when interest rates change beyond amounts shown in the tables above. In addition, other factors impact the market value of and net interest income from our interest rate-sensitive investments and derivative instruments, such as the shape of the yield curve, market expectations as to future interest rate changes and other market conditions. Accordingly, interest income would likely differ from that shown above and such difference might be material and adverse to our stockholders.

Mortgage Spread Risk

Weakness in the mortgage market may adversely affect the performance and market value of our investments. This could negatively impact our book value. Furthermore, if our lenders are unwilling or unable to provide additional financing, we could be forced to sell our MBS at an inopportune time when prices are depressed.

The table below quantifies the estimated changes in the fair value of our securities portfolio and in our stockholders' equity as of December 31, 2025 and December 31, 2024. The estimated impact of changes in spreads is in addition to our interest rate sensitivity presented above. Our securities portfolio's sensitivity to mortgage spread changes will vary with changes in interest rates and in the size and composition of our securities portfolio. Therefore, actual results could differ materially from our estimates.

Market Risk Disclosures (continued)

67

Prepayment Risk

As we receive payments of principal on our MBS, premiums paid on such securities are amortized against interest income and discounts are accreted to interest income as realized. Premiums arise when we acquire MBS at prices in excess of the principal balance of the mortgage loans underlying such MBS. Conversely, discounts arise when we acquire MBS at prices below the principal balance, adjusted for expected impairment losses, of the mortgage loans underlying such MBS. Volatility in actual prepayment speeds will create volatility in the amount of premium amortization we recognize. Higher speeds will reduce our interest income and lower speeds will increase our interest income.

Credit Risk

We have limited our exposure to impairment losses on our securities portfolio of Agency Securities. The payment of principal and interest on the Freddie Mac and Fannie Mae Agency Securities are guaranteed by those respective agencies and the payment of principal and interest on the Agency Securities guaranteed by Ginnie Mae are backed by the full faith and credit of the U.S. Government. Fannie Mae and Freddie Mac remain in conservatorship of the U.S. Government. There can be no assurances as to how or when the U.S. Government will end these conservatorships or how the future profitability of Fannie Mae and Freddie Mac and any future credit rating actions may impact the credit risk associated with Agency Securities and, therefore, the value of the Agency Securities. All of our Agency Securities are issued and guaranteed by GSEs or Ginnie Mae. The GSEs have a long term credit rating of AA+.

Liquidity Risk

Our primary liquidity risk arises from financing long-maturity MBS with short-term debt. The interest rates on our borrowings adjust frequently while the interest rates on our MBS are fixed. Accordingly, in a period of rising interest rates, our borrowing costs will usually increase faster than our interest earnings from MBS. Our repurchase agreements require that we maintain adequate pledged collateral. A decline in the value of the MBS pledged as collateral for borrowings under repurchase agreements could result in the counterparties demanding additional collateral pledges or liquidation of some of the existing collateral to reduce borrowing levels.

Market Risk Disclosures (continued)

Operational Risk

We rely on our financial, accounting and other data processing systems. Computer malware, viruses, computer hacking and phishing attacks have become more prevalent in our industry and may occur on our systems. Although we have not detected a material cybersecurity breach to date, other financial services institutions have reported material breaches of their systems, some of which have been significant. Even with all reasonable security efforts, not every breach can be prevented or even detected. It is possible that we have experienced an undetected breach. There is no assurance that we, or the third parties that facilitate our business activities, have not or will not experience a breach. It is difficult to determine what, if any, negative impact may directly result from any specific interruption or cyber-attacks or security breaches of our networks or systems (or the networks or systems of third parties that facilitate our business activities) or any failure to maintain performance.

ACM has established an ITSC to help mitigate technology risks including cybersecurity. One of the roles of the ITSC is to oversee cyber risk assessments, monitor applicable key risk indicators, review cybersecurity training procedures, oversee the Company’s Cybersecurity Policies, including an incident response plan, and engage third parties to conduct periodic penetration testing. Our cybersecurity risk assessment includes an evaluation of cyber risk related to sensitive data held by third parties on their systems. There is no assurance that these efforts will effectively mitigate cybersecurity risk and mitigation efforts are not an assurance that no cybersecurity incidents will occur.

In addition, our Audit Committee periodically monitors and oversees our information and cybersecurity risks including reviewing and approving any information and cybersecurity policies, procedures and resources, and reviewing our information and cybersecurity risk assessment, detection, protection, and mitigation systems.

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) that are designed to ensure that information required to be disclosed in our reports filed or submitted under the Exchange Act, is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and to ensure that information required to be disclosed in our reports filed or furnished under the Exchange Act, is accumulated and communicated to our management, including our CEO and CFO, as appropriate, to allow timely decisions regarding required disclosures. Our CEO and CFO participated in an evaluation by our management of the effectiveness of our disclosure controls and procedures as of the end of our fiscal year that ended on December 31, 2025. Based on their participation in that evaluation, our CEO and CFO concluded that our disclosure controls and procedures were effective as of December 31, 2025.

Internal Control Over Financial Reporting

Our CEO and CFO also participated in an evaluation by our management of any changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) that occurred during the quarter ended December 31, 2025. That evaluation did not identify any changes that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Management Report On Internal Control Over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting for the Company. Internal control over financial reporting is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act as a process designed by, or under the supervision of, our principal executive and principal financial officers and effected by our Board, management and other personnel to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP and includes those policies and procedures that:

• pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of our assets;
• provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with GAAP and that our receipts and expenditures are being made only in accordance with authorizations of our management and directors; and
• provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. As a result, even systems determined to be effective can provide only reasonable assurance regarding the preparation and presentation of financial statements. Moreover, projections of any evaluation of effectiveness to future periods are subject to the risks that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

There have been no changes in our internal controls over financial reporting that occurred during the year ended December 31, 2025 that have materially affected, or are reasonably likely to affect our internal control over financial reporting.

Management assessed the effectiveness of the Company’s internal control over financial reporting as of December 31, 2025. Management used criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) in Internal Control-Integrated Framework (2013) when making this assessment.

Based on management’s assessment, management concluded that, as of December 31, 2025, the Company’s internal control over financial reporting was effective. The Company’s independent registered public accounting firm, Deloitte & Touche LLP, has issued its attestation report on the Company’s internal control over financial reporting. This report appears on page 71 of this Annual Report on Form 10-K.