Krystal Biotech, Inc. 10-Q

ITEM 1A. RISK FACTORS There are a number of risks and uncertainties that may have a material effect on the operating results of our business and our financial condition. The risk factors below reflect material changes to risks to our business following Japan’s Ministry of Health, Labour and Welfare (“MHLW”) approval of VYJUVEK on July 24, 2025, and should be reviewed in conjunction with “Summary Risk Factors” and “Part I, Item 1A. Risk Factors” in our 2024 10-K, and “Part II, Item 1A. Risk Factors” in our Quarterly Report on Form 10-Q for the quarter ended March 31, 2025, filed with the Securities and Exchange Commission (the “SEC”) on May 6, 2025 (“Q1 2025 10-Q”). Except as set forth below, the above referenced risk factors included in our 2024 10-K and our Q1 2025 10-Q remain unchanged. Risks Related to Our Business and Industry We are substantially dependent on the commercial success of VYJUVEK To date, we have invested substantial efforts and financial resources in the research and development of VYJUVEK and our product candidates. Our near-term prospects, including our ability to develop our product candidates and generate revenue, and our future growth is substantially dependent on the commercial success of VYJUVEK. Although we received approval from the FDA, the European Commission, and Japan’s MHLW for VYJUVEK for the treatment of DEB, we can provide no assurances that we will obtain regulatory approval in any other jurisdiction, which would have an adverse impact on our results of operations. In addition, the successful commercialization of VYJUVEK will depend on a number of factors and involves risk, including some of the risks that are set forth under the caption “Risk Factors” in our annual and quarterly reports on file with the SEC. One or more of these factors, many of which are beyond our control could cause significant delays or an inability to successfully commercialize VYJUVEK. The increasing use of social media platforms presents new risks and challenges. Social media is increasingly being used by us, our employees, or others to communicate about our business, VYJUVEK, our clinical development programs, DEB, and the diseases our product candidates are being developed to treat. We use social media in connection with our commercialization efforts of VYJUVEK and intend to use it in connection with our commercialization efforts of our product candidates, if approved. Social media practices in the biotechnology and biopharmaceutical industries continue to evolve, and regulations and regulatory guidance relating to such use are evolving and not always clear. This evolution creates uncertainty and risk of noncompliance with regulations applicable to our business, resulting in potential regulatory actions against us, along with the potential for litigation and heightened scrutiny by the FDA, the EMA, the MHLW, the SEC, and other regulators. For example, patients may use social media channels to comment on their experience in an ongoing clinical trial of our product candidates, or to report an alleged adverse event. If such disclosures occur, there is a risk that clinical trial enrollment may be adversely impacted, that we may fail to monitor and comply with applicable adverse event reporting obligations, or that we may not be able to defend our business or the public’s legitimate interests in the face of the political and market pressures generated by social media due to restrictions on what we may say about our product 31 candidates. There is also a risk of inappropriate disclosure of sensitive information, loss of trade secrets or other intellectual property, public exposure of personal information of our employees, patients who use VYJUVEK, clinical trial patients, and others, or negative or inaccurate posts or comments about us on any social networking website. In addition, we may encounter attacks on social media regarding our company, management, VYJUVEK, or our product candidates that seriously damage our reputation, brand image, and goodwill. If any of these events were to occur or we otherwise fail to comply with applicable regulations, we could incur liability, face regulatory actions, or incur other harm to our business that could have a material adverse effect on our business, prospects, operating results, and financial condition, and could adversely affect the price of our common stock. Our employees, principal investigators and advisors may engage in misconduct or other improper activities, including non-compliance with regulatory standards and requirements. We are exposed to the risk of fraud or other misconduct by our employees, principal investigators, and advisors. Misconduct by these parties could include intentional failures to comply with FDA regulations, regulations applicable in the EU, Japan, and other jurisdictions, provide accurate information to the FDA, the EMA, the MHLW, and other regulatory authorities, comply with healthcare fraud and abuse laws and regulations in the United States and abroad, report financial information or data accurately or disclose unauthorized activities. Sales, marketing, and business arrangements in the healthcare industry are subject to extensive laws and regulations intended to prevent fraud, misconduct, kickbacks, self-dealing, and other abusive practices. These laws and regulations restrict or prohibit a wide range of pricing, discounting, marketing and promotion, sales commission, customer incentive programs, and other business arrangements. It is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from government investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations. If any such actions are instituted against us and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, financial condition, results of operations, and prospects, including the imposition of significant fines, criminal penalties, or other sanctions. In addition, principal investigators for our clinical trials may serve as scientific advisors or consultants to us from time to time and receive compensation in connection with such services. Under certain circumstances, we may be required to report some of these relationships to the FDA or regulators in other jurisdiction if we conduct clinical trials outside of the United States. The FDA or other applicable regulators may conclude that a financial relationship between us and a principal investigator has created a conflict of interest or otherwise affected interpretation of the clinical trial. The FDA or other applicable regulators may therefore question the integrity of the data generated at the applicable clinical trial site and the utility of the clinical trial itself may be jeopardized. This could result in a delay in approval, or rejection, of our marketing applications by the FDA or foreign regulators and may ultimately lead to the denial of marketing approval of our current and future product candidates. Healthcare legislative reform measures may have a material adverse effect on our business and results of operations. In the United States and some foreign jurisdictions, there have been, and continue to be, several legislative and regulatory changes and proposed changes regarding the healthcare system that could prevent or delay marketing approval of our product candidates, restrict or regulate post-approval activities, and affect our ability to profitably sell VYJUVEK and any product candidates for which we obtain marketing approval. In the United States, there have been and continue to be a number of legislative efforts to contain healthcare costs. Any legislative changes that result in price controls, reduce access to and reimbursement for care, or add additional regulations may have an adverse effect on our financial condition and results of operations. Any changes that reduce, or impede the ability to obtain, reimbursement for VYJUVEK or our product candidates that we intend to commercialize in the United States could adversely affect successful commercialization of VYJUVEK and our plans to introduce our product candidates in the United States. The Budget Control Act of 2011, among other things, created measures for spending reductions by Congress. A Joint Select Committee on Deficit Reduction, tasked with recommending a targeted deficit reduction of at least $1.2 trillion for the years 2012 through 2021, was unable to reach required goals, thereby triggering the legislation’s automatic reduction to several government programs. This includes aggregate reductions of Medicare payments to providers of up to 2% per fiscal year, which went into effect in April 2013 and will remain in effect through 2032 unless additional Congressional action is taken. In January 2013, the American Taxpayer Relief Act of 2012, among other things, further reduced Medicare payments to certain providers, and increased the time for Medicare contractors to recoup Medicare overpayments to providers from three to five years. In August 2022, the Inflation Reduction Act (“IRA”) was signed into law. The IRA includes several provisions to lower prescription drug costs for people with Medicare and reduce drug spending by the federal government. In relevant part, the IRA allows Medicare to negotiate prices for certain prescription drugs, requires drug manufacturers to pay a rebate to the federal government if prices for single-source drugs and biologicals covered under Medicare Part B and nearly all covered drugs under 32 Part D increase faster than the rate of inflation, caps out of pocket spending for Medicare Part D enrollees, and makes other benefit design changes to Medicare Part D intended to lower drug costs for enrollees and Medicare. Implementation of these changes began in 2023 and will continue to be implemented over the next several years. Beginning January 1, 2025, Medicare Part D enrollees now have a new annual out-of-pocket cap of $2,000 on prescription drugs. Other 2025 Medicare Part D changes include the elimination of the coverage gap phase and the replacement of the Coverage Gap Discount Program with the Manufacturer Discount Program, which requires drug manufacturers to pay a 10% discount for brand-name drugs and biologics during the initial coverage period and a 20% discount during the catastrophic phase. Multiple pharmaceutical manufacturers have challenged the law in court, largely on constitutional grounds. These suits will likely continue and the ultimate effects of such legal challenges are unclear. On April 15, 2025, President Trump issued an executive order directing the Secretary of the Department of Health and Human Services to take certain actions on drug pricing reform, including working with Congress on amendments to the IRA and rule making to establish new Medicare payment models for so-called “high-cost” prescription drugs and biological products. At this time, we continue to evaluate the effect of the IRA on our business operations and financial condition and results as the full impact of the IRA remains uncertain. Furthermore, on July 4, 2025, legislation commonly referred to as the One Big Beautiful Bill Act was signed into law, which reduces funding to federal healthcare programs and imposes additional requirements to be eligible for healthcare, which may result in decreased access to healthcare, particularly in Medicaid programs. Further, there has been heightened governmental scrutiny in recent years over the manner in which manufacturers set prices for their marketed products and the cost of prescription drugs to consumers and government healthcare programs, which have resulted in several recent Congressional inquiries and proposed and enacted bills designed to, among other things, reduce the cost of prescription drugs, bring more transparency to product pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for products. In addition, the United States government, state legislatures, and foreign governments have shown significant interest in implementing cost containment programs, including price-controls, restrictions on reimbursement and requirements for substitution of generic products for branded prescription drugs to limit the growth of government paid health care costs. For example, the United States government has passed legislation requiring pharmaceutical manufacturers to provide rebates and discounts to certain entities and governmental payors to participate in federal healthcare programs. Individual states in the United States have also been increasingly passing legislation and implementing regulations designed to control pharmaceutical product pricing, including price or patient reimbursement constraints, discounts, restrictions on certain product access and marketing cost disclosure and transparency measures, and, in some cases, designed to encourage importation from other countries and bulk purchasing. Additional changes may affect our business, including those governing enrollment in federal healthcare programs, reimbursement changes, fraud and abuse enforcement, and expansion of new programs, such as Medicare payment for performance initiatives. Healthcare reform measures that may be adopted in the future, may result in more rigorous coverage criteria and in additional downward pressure on the price that we receive for any approved product. Any reduction in reimbursement from Medicare or other government programs may result in a similar reduction in payments from private payors. The implementation of cost containment measures or other healthcare reforms could result in reduced demand for our product and product candidates or additional pricing pressures and may adversely impact our ability to generate sufficient revenue, attain consistent profitability, or commercialize our product candidates, if approved. We are subject, directly or indirectly, to federal and state healthcare fraud and abuse laws, false claims laws, and health information privacy and security laws. If we are unable to comply, or have not fully complied, with such laws, we could face substantial penalties. With the FDA approval of VYJUVEK, our operations are directly, or indirectly through our prescribers, customers, and purchasers, subject to various federal and state fraud and abuse laws and regulations, including, without limitation, the federal Anti-Kickback Statute, federal civil and criminal false claims laws and the Physician Payments Sunshine Act and regulations. These laws impact, among other things, our sales, marketing, access assistance, sponsored genetic patient testing, and educational programs. In addition, we are subject to patient privacy laws by both the federal government and the states in which we conduct our business, as well as by foreign jurisdictions. The laws that affect our operations include, but are not limited to: • the federal Anti-Kickback Statute, which prohibits, among other things, persons or entities from knowingly and willfully soliciting, receiving, offering, or paying any remuneration (including any kickback, bribe, or rebate), directly or indirectly, overtly or covertly, in cash or in kind, in return for the purchase, recommendation, leasing, or furnishing of an item or service reimbursable under a federal healthcare program, such as the Medicare and Medicaid programs. This statute has been interpreted to apply to arrangements between pharmaceutical manufacturers on the one hand, and prescribers, purchasers, and formulary managers on the other. The Patient Protection and Affordable Care Act (the “ACA”) amended the intent requirement of the federal Anti-Kickback Statute to clarify that a person or entity does not have to have actual knowledge of this statute or specific intent to violate it; 33 • federal civil and criminal false claims laws and civil monetary penalty laws which prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, claims for payment or approval from Medicare, Medicaid, or other government payors that are false or fraudulent. The ACA provides that a claim for items or services resulting from an Anti-Kickback Statute violation is a false claim under the False Claims Act (“FCA”). Cases against pharmaceutical manufacturers support the view that certain marketing practices, including off-label promotion, may implicate the FCA; • the federal Health Care Fraud statute imposes criminal and civil liability for executing or attempting to execute a scheme to defraud any healthcare benefit program or making false statements relating to healthcare matters; • the Health Insurance Portability and Accountability Act of 1996 Rules (“HIPAA Rules”), which impose certain requirements relating to the privacy, security, and transmission of individually identifiable health information by certain entities subject to the HIPAA Rules, such as health plans, health care clearinghouses, and health care providers that engage in certain covered transactions, known as covered entities, as well as their business associates that perform certain services that involve the use or disclosure of individually identifiable health information for or on behalf of covered entities; • federal transparency laws, including the federal Physician Payment Sunshine Act, that require certain manufacturers of drugs, devices, biologics, and medical supplies for which payment is available under Medicare, Medicaid, or the Children’s Health Insurance Program, with specific exceptions, to report annually to the United States Centers for Medicare and Medicaid Services (“CMS”) information related to: (i) payments or other “transfers of value” made to physicians and teaching hospitals, and (ii) ownership and investment interests held by physicians and their immediate family members; • our operations in Europe and Japan may be directly or indirectly subject to European and Japanese law equivalents of each of the above U.S. federal laws, some of which may not have been applicable prior to the recent European Commission and MHLW approvals of VYJUVEK; • U.S. state and foreign law equivalents of each of the above federal laws, state laws that require drug manufacturers to report information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures; and • state and foreign laws governing data privacy and security of health information, many of which differ from each other and require attention to frequently changing regulatory requirements, thus complicating compliance efforts in certain circumstances and increasing exposure to liability. Because of the breadth of these laws and the narrowness of the statutory exceptions and safe harbors available, it is possible that some of our business activities could be subject to challenge under one or more of such laws. If our operations are found to be in violation of any of the laws described above or any other government regulations that apply to us, we may be subject to penalties, including civil and criminal penalties, damages, fines, exclusion from participation in government health care programs, such as Medicare and Medicaid, imprisonment, and the curtailment or restructuring of our operations, any of which could adversely affect our ability to operate our business and our results of operations. Often, to avoid the threat of treble damages and penalties under the FCA, health care providers and drug manufacturers will resolve allegations in a settlement without admitting liability. Any such settlement could materially affect our business, financial operations, and reputation. Efforts to ensure that our business arrangements with third parties comply with applicable healthcare laws and regulations involve substantial costs. It is possible that governmental authorities will conclude that our business practices may not comply with current or future statutes, regulations or case law involving applicable fraud and abuse or other healthcare laws and regulations. The risk of our being found in violation of these laws is increased by the fact that many of them have not been fully interpreted by the regulatory authorities or the courts, and their provisions are open to a variety of interpretations. Any action against us for violation of these laws, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management’s attention from the operation of our business. The shifting compliance environment and the need to build and maintain a robust and expandable systems to comply with multiple jurisdictions with different compliance and/or reporting requirements increases the possibility that we may run afoul of one or more of the requirements. We are subject to stringent and evolving U.S. and foreign laws, regulations and other obligations related to privacy and data security. Our actual or perceived failure to comply with such obligations could lead to regulatory inquiries or actions, litigation, fines and penalties, disruptions to our business operations, reputational harm, loss of revenue, and other adverse business consequences. Privacy and data security have become significant areas of legal and regulatory focus in the United States, European Union, Japan, and in many other jurisdictions where we conduct or may conduct our operations. In our ordinary course of 34 business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, “process”) personal information and other sensitive information, including, but not limited to, health information, individuals’ financial information, as well as proprietary and confidential business data, including trade secrets, intellectual property, and sensitive third-party data (collectively, “sensitive data”). The legislative and regulatory landscape for privacy and data security continues to evolve, and there has been an increasing focus on privacy and data security issues, which may affect our business and is expected to increase our compliance costs and exposure to liability. Our data processing activities may subject us to numerous privacy and data security obligations, including, but not limited to, domestic and international laws, regulations, guidance, industry standards, external and internal privacy and security policies, and contractual requirements. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal information privacy laws, consumer protection laws, and other similar laws. Notably, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, imposes requirements on covered entities, as well as their business associates regarding the privacy, security, and transmission of individually identifiable health information. Further, states continue to adopt new laws or amend existing laws related to data privacy, requiring attention to frequently changing regulatory requirements. For example, and the California Consumer Privacy Act of 2018 (“CCPA”) requires businesses to provide specific disclosures in their privacy notices and honor residents’ privacy rights. The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA does not apply to certain data that we process in the context of clinical trials, efforts to comply with the CCPA may increase our annual compliance costs and subject us to potential liability with respect to other personal information we may maintain about California residents. In addition, the California Privacy Rights Act of 2020 (“CPRA”), which came into effect on January 1, 2023, expanded the CCPA’s requirements, extending it to cover personal information of business representatives and employees and the CPRA established a new regulatory agency to implement and enforce the law. Other states, such as Virginia, Nevada, Connecticut, Utah, Texas, and Colorado, have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels, which impose similar obligations to those in the CCPA. Further, other states, such as Nevada and Washington, have enacted privacy laws specifically governing consumer health information, with Washington providing for a private right of action. Although many of these laws currently exempt certain health-related information, the laws may increase our potential liability related to our data processing activities, complicate our compliance efforts, and increase both legal risk and compliance costs for us and the third parties upon whom we rely. Outside of the United States, there are an increasing number of laws, regulations, and industry standards regarding privacy and data security. For example, the EU General Data Protection Regulation (“GDPR”), the Japanese Act on the Protection of Personal Information, and UK GDPR impose strict requirements for processing personal information, and companies that violate the GDPR may face temporary or permanent bans on certain data processing activities and they may be subject to other penalties such as fines of up to 20 million Euros under the EU GDPR / 17.5 million pounds sterling under the UK GDPR or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized to represent data subjects’ interests. In some circumstances, we may be unable to transfer personal information between certain jurisdictions due to data localization requirements or other limitations on cross-border data flows. Europe, Japan, and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal information to other countries. In particular, the European Economic Area (“EEA”) and the UK have significantly restricted the transfer of personal information to the United States and other countries whose privacy laws they consider inadequate. Although there are various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with the law, such as the EEA and UK’s standard contractual clauses, these mechanisms are subject to legal challenges, and we may be unable to rely on these measures to lawfully transfer personal information to the United States in all cases. If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally compliant transfer are too onerous, we could face significant adverse consequences, including increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors, and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal information to recipients outside Europe for allegedly violating the EU GDPR’s cross-border data transfer limitations. Additionally, companies that transfer personal information to recipients outside of the EEA and/or UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Compliance with applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms ensuring compliance with new data protection rules. Failure to comply with any such laws or regulations puts us at risk of facing significant fines and penalties that could adversely affect our business, financial condition, reputation, and results of our operations. Furthermore, conflicting requirements across applicable 35 privacy and data security laws would complicate our compliance efforts and increase both legal risk and compliance costs for us and the third parties upon whom we rely. In addition to any applicable privacy and data security laws and regulations, we may be subject to industry standards adopted by industry groups or bound by other contractual obligations related to privacy and data security. We may publish privacy policies, marketing materials, and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials, or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to regulatory inquiries, regulatory enforcement actions, and other adverse consequences. Our obligations related to privacy and data security are quickly changing, becoming increasingly stringent, and creating regulatory uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent between jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources and may necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal information or other sensitive data on our behalf. We may at times fail (or be perceived to have failed) in our efforts to comply with our privacy and data security obligations. Moreover, despite our efforts, our personnel or third parties on whom we rely on may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties that process personal information or other sensitive data our behalf fail, or are perceived to have failed, to address or comply with applicable privacy and data security obligations, we could face significant consequences, including but not limited to government enforcement actions (e.g., investigations, fines, penalties, audits, and inspections), litigation (including class-action claims), additional reporting requirements and/or oversight, bans on processing personal information, and orders to destroy or not use personal information. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to loss of customers, significant reputational harm, an inability to process personal information or to operate in certain jurisdictions, limited ability to commercialize VYJUVEK or develop and commercialize our product candidates, expenditures of time and resources to defend ourselves against claims or inquiries, adverse publicity, or substantial changes to our business model or operations. Increased attention to, and evolving expectations for, environmental, social, and governance (“ESG”) initiatives could increase our costs, harm our reputation, or otherwise adversely impact our business. Companies across industries are facing increasing scrutiny from a variety of stakeholders related to their ESG, including diversity, equity, and inclusion (“DEI”), and sustainability practices. Investor advocacy groups, certain institutional investors, investment funds, and other influential investors have increasingly focused on ESG practices and have placed increasing importance on the non-financial impacts of their investments. Expectations regarding voluntary ESG initiatives and disclosures may result in increased costs (including but not limited to increased costs related to compliance, stakeholder engagement, contracting, and insurance), enhanced compliance or disclosure obligations, or other adverse impacts to our business, financial condition, or results of operations. While we may at times engage in voluntary initiatives (such as voluntary disclosures, certifications, or goals, among others) to improve the ESG profile of our company and/or VYJUVEK and our product candidates, such initiatives may be costly and may not have the desired effect. Moreover, we may not be able to successfully complete such voluntary initiatives due to factors that are within or outside of our control. Even if this is not the case, our actions may subsequently be determined to be insufficient by various stakeholders, and we may be subject to investor or regulator engagement on our ESG efforts, even if such initiatives are currently voluntary. Certain market participants, including major institutional investors and capital providers, use third-party benchmarks and scores to assess companies’ ESG profiles in making investment or voting decisions. Unfavorable ESG ratings could lead to increased negative investor sentiment towards us or our industry, which could negatively impact the price of our common stock. In addition, in recent years “anti-ESG” sentiment has gained momentum across the United States, with several states and Congress having proposed or enacted “anti-ESG” policies, legislation, or initiatives or issued related legal opinions, and the President having recently issued an executive order opposing DEI initiatives in the private sector. Such anti-ESG and anti-DEI-related policies, legislation, initiatives, litigation, legal opinions, and scrutiny could result in us facing additional compliance obligations, becoming the subject of investigations and enforcement actions, or sustaining reputational harm. Therefore, to the extent we take actions that are seen as positive to some investors, other investors may take issue with such actions or face regulatory pressure to refrain from investing in, or divest from, our business. To the extent ESG matters negatively impact our reputation, it may also impede our ability to compete as effectively to attract and retain employees, customers, or business partners which may adversely impact our operations. In addition, there may be increasing levels of regulation, disclosure-related and otherwise, with respect to ESG matters. For example, in 2024 the SEC adopted new rules that require companies to provide significantly expanded climate-related disclosures in their periodic reporting. The new climate disclosure rules were the subject of multiple legal challenges, 36 and the SEC voluntarily stayed the climate disclosure rules pending the completion of judicial review. In March 2025, the SEC voted to cease defending the climate disclosure rules in court, and in April 2025, the U.S. Court of Appeals for the Eighth Circuit ordered the litigation challenging the SEC’s climate disclosure rules to be held in abeyance. The court directed the SEC to file a status report by July 23, 2025, indicating whether it intends to review or reconsider the rules. On July 23, 2025, the SEC declined to review or reconsider the climate disclosure rules adopted in 2024, and directed the court to proceed with litigation and indicated it would not pre‑judge whether it would enforce the rules if the court ultimately upholds them. Therefore, it is unknown whether the new rules will go into effect and if they do, whether there will be significant changes. If the new rules go into effect and are not substantially different than the rules adopted by the SEC, we may be required to incur significant additional costs to comply, including the implementation of significant additional internal controls processes and procedures regarding matters that have not been subject to such controls in the past, and impose increased oversight obligations on our management and board of directors. Even if the SEC rules are not adopted, states or ex-U.S. jurisdictions in which we currently or may in the future operate may also have or adopt ESG or climate-related disclosure rules requiring similar or broader disclosure obligations. These and other changes in stakeholder expectations will likely lead to increased costs as well as scrutiny that could heighten all of the risks identified in this risk factor. Additionally, our customers and suppliers may be subject to similar expectations, which may augment or create additional risks, including risks that may not be known to us. Our international operations may expose us to business, regulatory, political, operational, financial, pricing and reimbursement, and economic risks associated with doing business outside of the United States. On April 23, 2025, the European Commission granted marketing authorization to VYJUVEK, and we are planning for our first European launch in Germany in mid-2025. On July 24, 2025, Japan’s MHLW granted marketing authorization to VYJUVEK, and we expect to launch in Japan before the end of 2025. We currently have operations and employees located outside the United States and our business strategy incorporates potential additional international expansion to target patient populations outside the United States. Doing business internationally involves a number of risks, including, but not limited to: • compliance with multiple, conflicting, and changing laws and regulations such as privacy regulations, tax laws, export and import restrictions, employment laws, regulatory requirements, and other governmental approvals, permits, and licenses; • failure by us to obtain and maintain regulatory approvals for the use of our product candidates in various countries; • complexities and difficulties in obtaining protection and enforcing our intellectual property, and additional potentially relevant third-party patent rights; • difficulties in staffing and managing foreign operations, including language barriers and translation; • complexities associated with managing multiple payor reimbursement regimes, government payors, or patient self-pay systems; • limits in our ability to penetrate international markets; • financial risks, such as longer payment cycles, increased expenses for travel, translation, and insurance, difficulty collecting accounts receivable, the impact of local and regional financial crises on demand and payment for our products that are approved for sale, and exposure to foreign currency exchange rate fluctuations; • risks from or relating to natural disasters, political and economic instability, including wars, terrorism, and political unrest, outbreak of disease, boycotts, curtailment of trade, and other business restrictions; and • regulatory and compliance risks that relate to maintaining accurate information and control over sales and activities that may fall within the purview of the U.S. Foreign Corrupt Practices Act, its books and records provisions, or its anti-bribery provisions. Any of these factors could significantly harm our potential international expansion and operations and, consequently, our results of operations. Inadequate funding for the FDA and other government agencies, including from government shut downs, or other disruptions to these agencies’ operations, could hinder their ability to hire and retain key leadership and other personnel, prevent new products and services from being developed or commercialized in a timely manner or otherwise prevent those agencies from performing normal business functions on which the operation of our business may rely, which could negatively impact our business. The ability of the FDA to review and approve new products can be affected by a variety of factors, including government budget and funding levels, ability to hire and retain key personnel and accept the payment of user fees, and statutory, regulatory and policy changes. Disruptions at the FDA and other agencies may also slow the time necessary for new product candidates to be reviewed and/or approved by necessary government agencies, which could adversely affect our business. For example, when the U.S. government has shut down in the past, certain regulatory agencies, such as the FDA and 37 the United States Securities and Exchange Commission have had to furlough critical employees and stop critical activities. If a prolonged government shutdown occurs, it could significantly impact the ability of the FDA to review and process our regulatory submissions in a timely manner, which could have a material adverse effect on our business. Further, future government shutdowns could impact our ability to access the public markets and obtain necessary capital. In addition, government funding of government agencies on which our operations may rely is subject to the political process, which is inherently fluid and unpredictable. There remains substantial uncertainty as to how the current U.S. administration will seek to or continue to modify or revise the requirements and policies of the FDA and other regulatory agencies with jurisdiction over our product candidates. This uncertainty could present new challenges or potential opportunities as we navigate the clinical development and approval process for our product candidates. If we experience delays in obtaining approval or if we fail to obtain approval of our product candidates, the commercial prospects for our product candidates may be harmed and our ability to generate revenue could be materially impaired. Risks Related to the Development, Regulatory Review and Approval of Our Product Candidates Our gene therapy platform is based on a novel technology, which makes it difficult to predict the time and cost of obtaining regulatory approvals for our product candidates. The clinical trial requirements of the FDA, EMA. MHLW, and other regulatory authorities and the criteria these regulators use to determine the safety and efficacy of a product candidate vary substantially according to the type, complexity, novelty and intended use and market of such product candidates. The regulatory approval process for novel product candidates such as ours, including approvals of or changes to manufacturing processes, can be more expensive and take longer than for other, better known or more extensively studied product candidates. It is difficult to determine how long it will take or how much it will cost to obtain regulatory approvals for our product candidates in the United States, the European Union, Japan, or elsewhere, or how long it will take to commercialize our product candidates. Approvals by the European Commission or MHLW may not be indicative of what the FDA may require for approval and approval by the FDA may not be indicative of what the European Commission or MHLW would require for approval. Regulatory requirements and policy governing gene and cell therapy products have changed frequently and may continue to change in the future. In 2016, the FDA established the Office of Tissues and Advanced Therapies (“OTAT”) within its Center for Biologics Evaluation and Research to consolidate the review of gene therapy and related products, and has established the Cellular, Tissue and Gene Therapies Advisory Committee, among others, to advise this review. In September 2022, the FDA announced retitling of OTAT to the Office of Therapeutic Products, or OTP, and elevation of OTP to a “Super Office” to meet its growing cell and gene therapy workload. If we engage a National Institutes of Health funded institution to conduct a clinical trial, that institution’s Institutional Biosafety Committee as well as its Institutional Review Board would need to review the proposed clinical trial to assess the safety and ethics of the trial. Similarly, the EMA or MHLW may issue new guidelines concerning the development and marketing authorization for gene therapy medicinal products and require that we comply with these new guidelines. These regulatory review committees and advisory groups and the new guidelines they promulgate may lengthen the regulatory review process, require us to perform additional studies, increase our development costs, lead to changes in regulatory positions and interpretations, delay or prevent approval and commercialization of our product candidates, or lead to significant post-approval limitations or restrictions. These additional processes may result in a review and approval process that is longer than we otherwise would have expected. Delay or failure to obtain, or unexpected costs in obtaining, the regulatory approval necessary to bring a potential product to market could decrease our ability to generate sufficient product revenue, and our business, financial condition, results of operations, and prospects would be materially and adversely affected. VYJUVEK and our product candidates that receive marketing approvals remain subject to regulatory oversight even after regulatory approval. We will continue to incur costs related to regulatory compliance and are subject to risks related to non-compliance with or changes to applicable laws and regulations, which could cause VYJUVEK or any of our product candidates that obtain regulatory approval to lose that approval. VYJUVEK, our first FDA, EMA, and MHLW-approved product, and any other product candidates that obtain regulatory approval in the future, will remain subject to ongoing regulatory requirements for manufacturing, labeling, packaging, storage, advertising, promotion, sampling, record-keeping, and submission of safety and other post-market information. Any regulatory approvals that we receive for our product candidates may also be subject to a post-approval safety monitoring program, limitations on the approved indicated uses for which the product may be marketed or to the conditions of approval, or contain requirements for potentially costly post-marketing testing, including Phase 4 clinical trials, and surveillance to monitor the quality, safety, and efficacy of the product. For example, the holder of an approved Biologics License Application, or BLA, is obligated to monitor and report adverse events and any failure of a product to meet the specifications in the BLA. The holder of an approved BLA also must submit new or supplemental applications and obtain FDA 38 approval for certain changes to the approved product, product labeling, or manufacturing process. For example, if demand for an approved product increases more than we previously estimate, we may need or desire to scale up an existing FDA-approved manufacturing process and the scaled-up manufacturing process would be subject to FDA review and approval. Advertising and promotional materials must comply with FDA rules and are subject to FDA review, in addition to other potentially applicable federal and state laws. There remains substantial uncertainty as to how the current U.S. administration will seek to or continue to modify or revise the requirements and policies of the FDA and other regulatory agencies with jurisdiction over VYJUVEK and our product candidates. This uncertainty could present new challenges or potential opportunities as we navigate the clinical development and approval process for our product candidates. We cannot predict the likelihood, nature or extent of government regulation that may arise from future legislation or administrative action or as a result of legal challenges, either in the United States or abroad. If we are slow or unable to adapt to changes in existing requirements or the adoption of new requirements or policies, or if we are not able to maintain regulatory compliance, our business could be materially harmed. In addition, product manufacturers and their facilities are subject to payment of user fees and continual review and periodic inspections by the FDA and other regulatory authorities for compliance with CGMP requirements and adherence to commitments made in the BLA or foreign marketing application. If we, or a regulatory authority, discover previously unknown problems with an approved product, such as adverse events of unanticipated severity or frequency, or problems with the facility where the product is manufactured or a regulatory authority disagrees with the promotion, marketing, or labeling of that product, a regulatory authority may impose restrictions relative to that product, the manufacturing facility or us, including requiring recall or withdrawal of the product from the market or suspension of manufacturing. If we fail to comply with applicable regulatory requirements, a regulatory authority may, among other actions: • issue a warning letter asserting that we are in violation of the law; • seek an injunction or impose administrative, civil, or criminal penalties or monetary fines; • suspend or withdraw regulatory approval; • suspend any ongoing clinical trials; • refuse to approve a pending BLA or comparable foreign marketing application (or any supplements thereto) submitted by us or our strategic partners, if any; • restrict the marketing or manufacturing of the product; • seize or detain the product or otherwise require the withdrawal of the product from the market; • refuse to permit the import or export of product candidates; or • refuse to allow us to enter into government contracts. Any government investigation of alleged violations of law could require us to expend significant time and resources in response and could generate negative publicity. The occurrence of any event or penalty described above may inhibit our ability to commercialize our approved product, VYJUVEK, and any product candidates that obtain regulatory approval and adversely affect our business, financial condition, results of operations, and prospects. The FDA’s policies, and those of equivalent foreign regulatory agencies, may change and additional government regulations may be enacted that could negatively impact the existing marketing approval for VYJUVEK and prevent, limit, or delay regulatory approval of our product candidates. We cannot predict the likelihood, nature, or extent of government regulation that may arise from future legislation or administrative action, either in the United States or abroad. If we are slow or unable to adapt to changes in existing requirements or the adoption of new requirements or policies, or if we are not able to maintain regulatory compliance, we may lose any marketing approval that we may have obtained, which would materially and adversely affect our business, financial condition, results of operations, and prospects. Risks Related to Commercialization of VYJUVEK and Our Product Candidates We have limited experience as a commercial company and the sales, marketing, and distribution of VYJUVEK or any future approved products may be unsuccessful or less successful than anticipated. We received FDA approval of VYJUVEK in May 2023, European Commission approval of VYJUVEK in April 2025, and MHLW approval in July 2025, and initiated a commercial launch of VYJUVEK in the United States in the second quarter of 2023. As a company, we have no prior experience commercializing a biologic. The success of our commercialization efforts 39 is difficult to predict and subject to the effective execution of our business plan, including, among other things, the continued development of our internal sales, marketing, manufacturing, and distribution capabilities and our ability to navigate the significant expenses and risks involved with the development and management of such capabilities. For example, our commercial launch of VYJUVEK in the United States, the European Union, or Japan may not develop as planned or anticipated, which may require us to, among others, adjust or amend our business plan and incur significant expenses. Further, given our lack of experience commercializing products, we do not have a track record of successfully executing a commercial launch. There is a risk that we underestimate the level of demand for a product, which could require us to change a manufacturing process to increase production yields and changes to a manufacturing process are time consuming and subject to regulatory, financial, and operational risks. If we are unsuccessful in accomplishing our objectives and executing on our business plan, or if our commercialization efforts do not develop as planned, we may not be able to successfully commercialize VYJUVEK and any future approved products, we may require significant additional capital and financial resources, we may not be profitable on a consistent basis, and we may not be able to compete against more established companies in our industry. In connection with the commercial launch of VYJUVEK in the United States and planned commercial launches in Europe and Japan, we have recruited a sales force and established marketing, market access, and medical affairs teams and distribution capabilities and if the commercial launch of VYJUVEK is not successful for any reason, we could incur substantial costs and our investment would be lost if we cannot retain or reposition our sales, marketing, market access, and medical affairs personnel. To achieve commercial success for VYJUVEK, we have devoted and anticipate that we will continue to devote significant resources to support our sales force, marketing, market access, and medical affairs teams and distribution capabilities. There are risks involved with establishing our own sales, marketing, distribution, training, and support capabilities. For example, recruiting and training sales and marketing personnel is expensive and time-consuming and could delay our ability to focus on other priorities. If the commercial launch of VYJUVEK in the United States, Europe, or Japan is not successful for any reason, this would be costly, and our investment would be lost if we cannot retain or reposition our sales, marketing, market access, and medical affairs personnel or terminate on favorable terms any agreements entered into with third parties to support our commercialization efforts. Factors that may inhibit our efforts to commercialize VYJUVEK or any other product candidates, if approved, on our own in the United States or elsewhere include: • our inability to train and retain adequate numbers of effective sales, marketing, training, and support personnel; • the inability of sales personnel to obtain access to physicians, including key opinion leaders, or to educate an adequate number of physicians of the benefits of VYJUVEK or any approved product candidate; • the lack of complementary products to be offered by our sales personnel, which may put us at a competitive disadvantage relative to companies with more extensive or integrated product offerings; and • unforeseen costs and expenses associated with establishing and maintaining an independent sales, marketing, training, and support organization. If our sales force, marketing, market access, and medical affairs teams and distribution capabilities fail, or are otherwise unsuccessful, it would materially adversely impact the commercial launch of VYJUVEK in the United States, Europe, or Japan, impact our ability to generate revenue, and harm our business. The commercial success of VYJUVEK and our product candidates will depend upon their degree of market acceptance by physicians, patients, third-party payors, and others in the medical community. Even with the requisite approvals from the FDA in the United States, from the European Commission in the European Union, and the MHLW in Japan, and other regulatory authorities internationally (and potential approvals of any of our product candidates by regulatory authorities), the commercial success of VYJUVEK and our product candidates will depend, in part, on the acceptance of physicians, patients, and health care payors of gene therapy products in general, and VYJUVEK and our product candidates, in particular, as medically necessary, cost-effective, and safe. VYJUVEK and any product candidate that we commercialize may not gain acceptance by physicians, patients, health care payors, and others in the medical community. If these products do not achieve an adequate level of acceptance, we may not generate significant product revenue and may not become consistently profitable. The degree of market acceptance of gene therapy products and VYJUVEK and our product candidates, if approved for commercial sale, will depend on several factors, including: • the efficacy and safety of VYJUVEK and our product candidates as demonstrated in clinical trials; • the potential and perceived advantages of VYJUVEK and our product candidates over alternative treatments, if available; 40 • the cost of VYJUVEK and our product candidates relative to alternative treatments if any are available; • the clinical indications for which VYJUVEK and our product candidates are approved by the FDA and other regulatory authorities; • the willingness of physicians to prescribe new therapies; • the willingness of the target patient population to try new therapies; • the prevalence and severity of any side effects; • product labeling or product insert requirements of the FDA, the EMA, the MHLW, or other regulatory authorities, including any limitations or warnings contained in a product’s approved labeling; • relative convenience and ease of administration; • the strength of marketing and distribution support; • the timing of market introduction of competitive products; • the availability of products and their ability to meet market demand; • publicity concerning VYJUVEK and our product candidates or competing products and treatments; • any restrictions on the use of VYJUVEK and our products together with other medications; and • favorable third-party payor coverage and adequate reimbursement. Even if a product candidate displays a favorable efficacy and safety profile in preclinical studies and clinical trials, market acceptance of the product will not be fully known until after it is launched. Risks Related to Our Financial Position and Need for Additional Capital We have incurred net losses in the past and may not sustain profitability. Although we generated net income starting with the year ended December 31, 2023, we previously incurred recurring losses and negative cash flows from operations since our inception. Our transition to consistent operating profitability depends on our ability to (i) successfully commercialize VYJUVEK in the United States and obtain the necessary regulatory approvals to commercialize VYJUVEK outside of the United States and then successfully commercialize VYJUVEK outside the United States, and (ii) complete the development of, and obtain the regulatory approvals necessary to successfully commercialize our product candidates with significant market potential. We have devoted substantially all our efforts to date to (i) research and development of our gene therapy platform, product candidates and our manufacturing infrastructure, and, more recently, (ii) commercializing VYJUVEK in the United States. We expect to continue to incur significant expenses for the foreseeable future and our operating results may fluctuate significantly from quarter to quarter. We anticipate that our expenses will increase substantially if, and as, we: • manufacture, market, and sell our lead product, VYJUVEK, in the United States and market and sell VYJUVEK in the EU and Japan; • continue our research, preclinical studies, and the clinical development of our current product candidates, including our current clinical trials and planned clinical trials; • initiate preclinical studies and clinical trials for any additional product candidates that we may pursue in the future; • prepare for regulatory approvals for our product candidates in the United States, EU and in other key geographies; • continue to operate our in-house commercial-scale CGMP manufacturing facilities, ANCORIS and ASTRA, and as we seek to obtain FDA approval for commercial manufacture of VYJUVEK at ASTRA, which approval may not be granted; • manufacture material for commercial sales of VYJUVEK and clinical trials or potential commercial sales of our product candidates; • further develop our gene therapy platform; • further establish our sales, marketing, and distribution infrastructure to commercialize VYJUVEK and product candidates for which we may obtain marketing approval; • develop, maintain, expand, and protect our intellectual property portfolio; and 41 • acquire or in-license other product candidates and technologies. To remain profitable, we must be successful in a range of challenging activities, including designing, initiating, and completing clinical trials for our product candidates, developing, validating, and maintaining commercial scale manufacturing processes, obtaining marketing approvals, manufacturing, marketing, and selling VYJUVEK and any product candidates for which we may obtain marketing approval, and satisfying any post-marketing requirements. If we were required to discontinue development of any of our product candidates, if VYJUVEK does not receive regulatory approvals outside the United States, the EU, or Japan, or any of our product candidates do not receive regulatory approvals, or if VYJUVEK or any of our product candidates, if approved, fails to achieve sufficient market acceptance for any indication, our ability to remain profitable and our business prospects and financial condition could be materially adversely affected. Moreover, if we decide to leverage any success with VYJUVEK or any of our current product candidates to develop other product opportunities, we may not be successful in such efforts. In any such event, our business may be materially adversely affected. We currently have one product, VYJUVEK, approved by the FDA, the EMA, and MHLW and several product candidates in the clinical trials stages. However, we may never develop, acquire or in-license additional product candidates. We may never generate revenue from any of our product candidates. We may not be able to sustain or increase profitability on a quarterly or annual basis. Our failure to remain profitable would decrease the value of our company and could impair our ability to raise capital, maintain our research and development efforts, expand our business, or continue our operations. A decline in the value of our company also could cause stockholders to lose all or part of their investment. Because of the numerous risks and uncertainties associated with pharmaceutical product and biological development, we are unable to accurately predict the timing or amount of increased expenses. If we are required by the FDA, the EMA, the MHLW, or other regulatory authorities to perform studies in addition to those currently expected, or if there are any delays in completing our clinical trials or the development of our product candidates, our expenses could increase and potential revenue from product candidates in development could be delayed. 42 ITEM 2. UNREGISTERED SALES OF EQUITY SECURITIES AND USE OF PROCEEDS None. ITEM 3. DEFAULTS UPON SENIOR SECURITIES None. ITEM 4. MINE SAFETY DISCLOSURES Not applicable.