What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-02-27 compared with 2024-03-21 · 58 added, 32 removed, 1145 unchanged (7% of the section changed)

1 unchanged sentence

Investing in our common stock involves a high degree of risk.

You should carefully consider the risks described below together with all of the other information in this Annual Report on Form 10-K ("Form 10-K"), including our financial statements and the related notes and the information described in the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and in our other filings with the SEC.

You should carefully consider the risks described below together with all of the other information in this Annual Report on Form 10-K ("Form 10-K"), including our financial statements and the related notes and the information described in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and in our other filings with the SEC.

If any of the events described below actually occurs, our business, results of operations, financial conditions, cash flows or prospects could be harmed.

65 unchanged sentences

As of December 31, 2024, we had $126.7 million in cash, cash equivalents and marketable securities.

Based on our research and development plans, we expect that these cash resources will enable us to fund our operating expenses and capital expenditure requirements into mid-2026.

Based on our research and development plans, we expect that these cash resources will enable us to fund our operating expenses and capital expenditure requirements into the first quarter of 2027.

This estimate is based on assumptions that may prove to be wrong, and we could use our available capital resources sooner than we expect.

6 unchanged sentences

If we are unable to obtain additional financing on favorable terms when needed, we may be required to delay, limit, reduce or terminate preclinical studies, clinical trials, or other research and development activities or one or more of our development programs.

The current economic downturn and inflationary environment may harm our business and results of operations.

Our overall performance depends, in part, on worldwide economic conditions.

In recent months, we have observed increased economic uncertainty in the United States and abroad.

Impacts of such economic weakness include reduced credit availability, higher borrowing costs, reduced liquidity, volatility in credit, equity and foreign exchange markets, and bankruptcies.

These developments could lead to supply chain disruption, inflation, higher interest rates, and uncertainty about business continuity, which may adversely affect our business.

Recent volatility in capital markets and lower market prices for our securities may affect our ability to access new capital through sales of shares of our common stock or issuance of indebtedness, which may harm our liquidity and limit our ability to grow our business, pursue acquisitions, or improve our operating infrastructure.

62 unchanged sentences

the supply, quality or timeliness of delivery of materials for product candidates we develop or other materials necessary to conduct clinical trials may be insufficient or inadequate;

we may need to change the manufacturing site and potentially the CDMO for our product candidates from those that are able to produce clinical supply for our Phase 1 clinical trials to those with the capacity and ability to perform commercial manufacturing and/or the production of clinical material for our later stage clinical trials.

we may need to change the manufacturing site and potentially the contract development manufacturing organizations ("CDMO") for our product candidates from those that are able to produce clinical supply for our Phase 1 clinical trials to those with the capacity and ability to perform commercial manufacturing and/or the production of clinical material for our later stage clinical trials.

We could encounter delays if a clinical trial is suspended or terminated by us, or by the IRBs of the institutions in which such trials are being conducted, ethics committees or the Data and Safety Monitoring Board ("DSMB"), for such trial or by the FDA or other regulatory authorities.

56 unchanged sentences

Differences between preliminary or interim data and final data could significantly harm our business prospects and may cause the trading price of our common stock to fluctuate significantly.

Our agonist monoclonal antibody product candidates are a new potential class of therapeutics, which makes it difficult to predict the time and cost of development and of subsequently obtaining regulatory approval, if at all.

Our agonist monoclonal antibody technology is relatively new and no agonist monoclonal antibodies to any target have been approved to date.

Our bispecific and monoclonal antibody product candidates are a new potential class of therapeutics, which makes it difficult to predict the time and cost of development and of subsequently obtaining regulatory approval, if at all.

Our bispecific and monoclonal antibody technology is relatively new.

As such it is difficult to accurately predict the developmental challenges we may incur for our product candidates as they proceed through product discovery or identification, preclinical studies and clinical trials.

92 unchanged sentences

As a result, we may fail to capitalize on viable commercial products or profitable market opportunities, be required to forego or delay pursuit of opportunities with other product candidates or other diseases and disease pathways that may later prove to have greater commercial potential than those we choose to pursue, or relinquish valuable rights to such product candidates through collaboration, licensing or other royalty arrangements in cases in which it would have been advantageous for us to invest additional resources to retain development and commercialization rights.

Certain of our clinical trials are conducted in overseas jurisdictions, which may subject us to delays and expenses.

We are currently conducting and plan to conduct certain clinical trials in overseas jurisdictions.

For example, clinical trials for CTX-009 are currently being conducted in South Korea.

Our clinical trials may be conducted in overseas jurisdictions, which may subject us to delays and expenses.

We may conduct certain clinical trials in overseas jurisdictions.

Regulators in the United States, such as the FDA, or in other foreign jurisdictions, may not support our trial design and protocol, which would delay our clinical development plans and increase our expenses.

60 unchanged sentences

government has shut down several times and certain regulatory agencies, such as the FDA, have had to furlough critical FDA employees and stop critical activities.

Currently, federal agencies in the United States are operating under a continuing resolution that is set to expire on March 14, 2025.

Without appropriation of additional funding to federal agencies, our business operations related to our product development activities for the U.S.

market could be impacted.

We may be required to suspend, repeat or terminate our clinical trials if they are not conducted in accordance with regulatory requirements, the results are negative or inconclusive or the trials are not well designed.

165 unchanged sentences

pharmaceutical industry.

See the section entitled, “Business — Government Regulation — Current and future healthcare reform legislation”.

See the section titled, “Business — Government Regulation — Current and future healthcare reform legislation”.

Moreover, increasing efforts by governmental and other third-party payors in the United States and abroad to cap or reduce healthcare costs may cause such organizations to limit both coverage and the level of reimbursement for newly approved products and, as a result, they may not cover or provide adequate payment for our product candidates.

18 unchanged sentences

Our current and future arrangements with healthcare providers, third-party payors, customers, and others may expose us to broadly applicable fraud and abuse and other healthcare laws and regulations, which may constrain the business or financial arrangements and relationships through which we research, as well as sell, market and distribute any products for which we obtain marketing approval.

See the section entitled, “Business — Government Regulation — Other Healthcare Laws and Compliance Requirements”.

See the section titled, “Business — Government Regulation — Other Healthcare Laws and Compliance Requirements”.

It is possible that governmental authorities will conclude that our business practices may not comply with current or future statutes, regulations or case law involving applicable fraud and abuse or other healthcare laws and regulations.

8 unchanged sentences

The loss of our third-party manufacturing partners or our, or our partners ’ , failure to comply with applicable regulatory requirements or to supply sufficient quantities at acceptable quality levels or prices, or at all, would materially and adversely affect our business.

We have contracted with qualified third-party contract development manufacturing organizations ("CDMOs"), to manufacture our product candidates for preclinical and clinical trials.

We have contracted with qualified third-party CDMOs, to manufacture our product candidates for preclinical and clinical trials.

If approved, commercial supply of any product candidates may also be manufactured at one or more CDMOs.

273 unchanged sentences

We depend on our information technology systems, and any failure of these systems could harm our business.

Security breaches, loss of data, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, results of operations and financial condition.

Cybersecurity incidents, data breaches, loss of data, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, results of operations and financial condition.

We collect and maintain information in digital form that is necessary to conduct our business, and we are dependent on our information technology systems and those of third parties to operate our business.

4 unchanged sentences

Our internal information technology systems and infrastructure, and those of our current and any future collaborators, contractors and consultants and other third parties on which we rely, are vulnerable to damage from computer viruses, malware, natural disasters, terrorism, war, telecommunication and electrical failures, cyber-attacks or cyber-intrusions, phishing, persons inside our organization or persons with access to systems inside our organization.

The risk of a security breach or disruption or data loss, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased.

We, like other organizations in our industry, may experience cybersecurity incidents.

The risk of cybersecurity incidents, data breaches or disruption or data loss, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased.

In addition, the prevalent use of mobile devices that access confidential information increases the risk of data security breaches, which could lead to the loss of confidential information or other intellectual property.

4 unchanged sentences

Moreover, if a computer security breach affects our systems or results in the unauthorized release of personally identifiable information, our reputation could be materially damaged.

In addition, such a breach may require notification to governmental agencies, the media or individuals pursuant to various federal and state privacy and security laws, if applicable, including the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and its implementing rules and regulations, as well as regulations promulgated by the Federal Trade Commission and state breach notification laws.

In addition, such a breach may require notification to impacted stakeholders (including affected individuals, regulators and investors pursuant to various federal and state privacy and security laws, if applicable, including the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and its implementing rules and regulations, as well as regulations promulgated by the Federal Trade Commission and state breach notification laws.

We would also be exposed to a risk of loss or litigation and potential liability, which could materially adversely affect our business, results of operations and financial condition.

Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations.

We are or may become subject to other U.S.

federal and state laws governing the privacy and security of health information, many of which differ from each other in significant ways and may not be preempted by HIPAA.

For example, the California Consumer Privacy Act (CCPA) created individual privacy rights for California residents, including requiring covered businesses to provide notice regarding how personal information is collected and how individuals can limit the sharing of their personal information.

The California Privacy Rights Act (CPRA) amended the CCPA and requires specific disclosures and safeguarding requirements around sensitive personal information.

The CPRA also establishes a state agency vested with the authority to enforce the CCPA.

The CCPA also applies to personal information collected about employees, applicants and retirees, as well as that which is collected in a business-to-business capacity.

While there is currently an exception in the CCPA for protected health information that is subject to HIPAA, the CCPA may nevertheless impact our data use and sharing practices and require significant investment in our effort to comply with its obligations.

More than a dozen other U.S.

states have enacted legislation similar to the CCPA, but contain key differences in their scope, application, and enforcement.

Clear enforcement guidelines, as well as associated penalties for noncompliance, are likely to be unpredictable for the foreseeable future.

Moreover, certain states have advanced privacy laws focused on protecting consumer health information, such as Washington’s My Health My Data Act, which contains a private right of action and my increase the risk of litigation.

and this remains a rapidly changing legislative and regulatory environment.

Any actual or perceived noncompliance with privacy and data protection laws by us or our partners may damage to our reputation, lead to loss of existing or future business, require us to change our data practices and increase our expenses related to litigation and compliance ongoing compliance, any of which could adversely affect our business, results of operations and financial condition.

In December 2024, the U.S.

Department of Justice issued regulations implementing Executive Order (“EO”) 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United Stated Government-Related Data by Countries of Concern,” which are expected to become effective in April 2025.

These regulations prohibit transactions involving access to bulk sensitive data by countries of concern, such as China (including Hong Kong).

In the life sciences sector, the regulations prohibit investment agreements, employment agreements, vendor agreements, and other transactions involving human genomic data and biospecimens, except where necessary for specified exempt activities.

Tracking and complying with these regulations may require significant time and expense.

Our use of new and evolving technologies, such as artificial intelligence, may present risks and challenges that can impact our business, including by posing cybersecurity and other risks to our confidential and/or proprietary information, including personal information, and as a result we may be exposed to reputational harm and liability.

We may use and integrate artificial intelligence into our business processes.

Use of this rapidly evolving technology will require the application of significant resources to design, develop, test, and maintain such systems to help ensure that artificial intelligence is implemented in accordance with applicable law and in a socially responsible manner.

If we enable or use solutions that draw controversy due to perceived or actual negative societal impact, we may experience brand or reputational harm, competitive harm, or legal liability.

A growing number of legislators and regulators are adopting laws and regulations and have focused enforcement efforts on the adoption of artificial intelligence, and use of such technologies in compliance with ethical standards and societal expectations.

These developments may increase our compliance burden and costs in connection with use of artificial intelligence and lead to legal liability if we fail to meet evolving legal standards or if use of such technologies results in harms or other causes of action we did not predict.

For example, the EU’s Artificial Intelligence Act (“AI Act”) entered into force on August 1, 2024, with most provisions becoming effective on August 2, 2026.

This legislation imposes significant obligations on providers and deployers of artificial intelligence systems and encourages providers and deployers of artificial intelligence systems to account for EU ethical principles in their development and use of these systems.

The scope of requirements depends on legal and risk determinations that rely on novel legal provisions that have not yet been interpreted by courts or regulators, and non-compliance can lead to significant fines.

Likewise, in the U.S., several states, including Colorado and California, passed laws that will take effect in 2026, to regulate various uses of artificial intelligence, including to make consequential decisions.

In addition, various federal regulators have issued guidance and focused enforcement efforts on the use of AI in regulated sectors.

If we develop or use AI systems governed by these laws or regulations, we will need to meet higher standards of data quality, transparency, monitoring, and human oversight, and we would need to adhere to specific and potentially burdensome and costly ethical, accountability, and administrative requirements, with the potential for significant enforcement or litigation in the event of any perceived non-compliance.

Our vendors may in turn incorporate artificial intelligence tools into their offerings, and the providers of these artificial intelligence tools may not meet existing or rapidly evolving regulatory or industry standards, including with respect to privacy and data security.

Further, global threat actors are using increasingly sophisticated methods, including artificial intelligence, to engage in the theft and misuse of confidential information and proprietary information.

Any of these effects could damage our reputation, result in the loss of valuable property and information, cause us to breach applicable laws and regulations, and adversely impact our business.

European data collection is governed by restrictive regulations governing the use, processing and cross-border transfer of personal information.

10 unchanged sentences

Compliance with the GDPR will be a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our European activities.

has announced plans to reform the country’s data protection legal framework in its Data Reform Bill, which will introduce significant changes from the EU GDPR.

plans to reform the country’s data protection legal framework in its Data Use and Access Bill, which was introduced into the U.K.

legislative process on October 23, 2024 and, if passed, will introduce significant changes.

This may lead to additional compliance costs and could increase our overall risk exposure as we may no longer be able to take a unified approach across the EU and the U.K.

7 unchanged sentences

Transfers made pursuant to these new mechanisms need to be assessed on a case-by-case basis to ensure the law in the recipient country provides “essentially equivalent” protections to safeguard the transferred personal data as the EU, and businesses are required to adopt supplementary measures if such standard is not met.

Further, the EU and United States have adopted its adequacy decision for the EU-U.S.

Further, the EU has adopted its adequacy decision for the EU-U.S.

Data Privacy Framework ("Framework"), which entered into force on July 11, 2023.

This Framework provides that the protection of personal data transferred between the EU and the U.S.

is comparable to that offered in the EU.

This Framework provides that the protection of personal data transferred from the EU to companies which are certified to the Framework in the United States is comparable to that offered in the EU.

This provides a further avenue to ensuring transfers to the United States are carried out in line with GDPR.

3 unchanged sentences

We will be required to implement these new safeguards when conducting restricted data transfers under the GDPR and doing so will require significant effort and cost.

The use of new and evolving technologies, such as artificial intelligence, in our business may result in spending material resources and presents risks and challenges that can impact our business including by posing security and other risks to our confidential and/or proprietary information, including personal information, and as a result we may be exposed to reputational harm and liability.

Risks Related to Our Work with Third Parties

90 unchanged sentences

The loss of the services of any of them may adversely impact the achievement of our objectives.

Any of our executive officers— Vered Bisker-Leib, our Chief Executive Officer and Thomas J.

Schuetz, our co-founder and President of R&D —could leave our employment at any time, as all of our employees are “at-will” employees.

The loss of the services of Dr.

Bisker-Leib or Dr.

Schuetz could impede the achievement of our research, development and commercialization objectives.

Any of our executive officers could leave our employment at any time, as all of our employees are “at-will” employees.

The loss of the services of these officers could impede the achievement of our research, development and commercialization objectives.

Historically, we have experienced significant turnover in our research and development workforce and have operated with a limited team of scientific and technical personnel.

28 unchanged sentences

This concentration of ownership could have the effect of entrenching our management and/or the board of directors, delaying or preventing a change in our control or otherwise discouraging a potential acquirer from attempting to obtain control of us, which in turn could have a material and adverse effect on the fair market value of our common stock.

Because we became a reporting company under the Exchange Act by means other than a traditional underwritten initial public offering, we may not be able to attract the attention of research analysts at major brokerage firms.

Because we did not become a reporting company by conducting an underwritten initial public offering of our common stock, security analysts of brokerage firms may not provide coverage of our company.

In addition, investment banks may be less likely to agree to underwrite secondary offerings on our behalf than they might if we became a public reporting company by means of an underwritten initial public offering, because they may be less familiar with our company as a result of more limited coverage by analysts and the media, and because we became public at an early stage in our development.

The failure to receive research coverage or support in the market for our shares will have an adverse effect on our ability to develop a liquid market for our common stock.

Future issuances of common or preferred stock to fund our operations may substantially dilute your investment and reduce your equity interest in our company.

155 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors