Krystal Biotech, Inc.

Previous wording

Although we received approval from the FDA and the European Commission for VYJUVEK for the treatment of DEB, we can provide no assurances that we will obtain regulatory approval in any other jurisdiction, which would have an adverse impact on our results of operations. In addition, the successful commercialization of VYJUVEK will depend on a number of factors and involves risk, including some of the risks identified in these “Risk Factors.” One or more of these factors, many of which are beyond our control could cause significant delays or an inability to successfully commercialize VYJUVEK.

Current wording

Although we received approval from the FDA, the European Commission, and Japan’s MHLW for VYJUVEK for the treatment of DEB, we can provide no assurances that we will obtain regulatory approval in any other jurisdiction, which would have an adverse impact on our results of operations. In addition, the successful commercialization of VYJUVEK will depend on a number of factors and involves risk, including some of the risks that are set forth under the caption “Risk Factors” in our annual and quarterly reports on file with the SEC. One or more of these factors, many of which are beyond our control could cause significant delays or an inability to successfully commercialize VYJUVEK.

Previous wording

Social media is increasingly being used by us, our employees, or others to communicate about our business, VYJUVEK, our clinical development programs, DEB, and the diseases our product candidates are being developed to treat. We use social media in connection with our commercialization efforts of VYJUVEK and intend to use it in connection with our commercialization efforts of our product candidates, if approved. Social media practices in the biotechnology and biopharmaceutical industries continue to evolve, and regulations and regulatory guidance relating to such use are evolving and not always clear. This evolution creates uncertainty and risk of noncompliance with regulations applicable to our business, resulting in potential regulatory actions against us, along with the potential for litigation and heightened scrutiny by the FDA, the EMA, the Securities and Exchange Commission, or the SEC, and other regulators. For example, patients may use social media channels to comment on their experience in an ongoing clinical trial of our product candidates, or to report an alleged adverse event. If such disclosures occur, there is a risk that clinical trial enrollment may be adversely impacted, that we may fail to monitor and comply with applicable adverse event reporting obligations, or that we may not be able to defend our business or the public’s legitimate interests in the face of the political and market pressures generated by social media due to restrictions on what we may say about our product candidates. There is also a risk of inappropriate disclosure of sensitive information, loss of trade secrets or other intellectual property, public exposure of personal information of our employees, patients who use VYJUVEK, clinical trial patients, and others, or negative or inaccurate posts or comments about us on any social networking website. In addition, we may encounter attacks on social media regarding our company, management, VYJUVEK, or our product candidates that seriously damage our reputation, brand image, and goodwill. If any of these events were to occur or we otherwise fail to comply with applicable regulations, we could incur liability, face regulatory actions, or incur other harm to our business that could have a material adverse effect on our business, prospects, operating results, and financial condition, and could adversely affect the price of our common stock.

Current wording

Social media is increasingly being used by us, our employees, or others to communicate about our business, VYJUVEK, our clinical development programs, DEB, and the diseases our product candidates are being developed to treat. We use social media in connection with our commercialization efforts of VYJUVEK and intend to use it in connection with our commercialization efforts of our product candidates, if approved. Social media practices in the biotechnology and biopharmaceutical industries continue to evolve, and regulations and regulatory guidance relating to such use are evolving and not always clear. This evolution creates uncertainty and risk of noncompliance with regulations applicable to our business, resulting in potential regulatory actions against us, along with the potential for litigation and heightened scrutiny by the FDA, the EMA, the MHLW, the SEC, and other regulators. For example, patients may use social media channels to comment on their experience in an ongoing clinical trial of our product candidates, or to report an alleged adverse event. If such disclosures occur, there is a risk that clinical trial enrollment may be adversely impacted, that we may fail to monitor and comply with applicable adverse event reporting obligations, or that we may not be able to defend our business or the public’s legitimate interests in the face of the political and market pressures generated by social media due to restrictions on what we may say about our product candidates. There is also a risk of inappropriate disclosure of sensitive information, loss of trade secrets or other intellectual property, public exposure of personal information of our employees, patients who use VYJUVEK, clinical trial patients, and others, or negative or inaccurate posts or comments about us on any social networking website. In addition, we may encounter attacks on social media regarding our company, management, VYJUVEK, or our product candidates that seriously damage our reputation, brand image, and goodwill. If any of these events were to occur or we otherwise fail to comply with applicable regulations, we could incur liability, face regulatory actions, or incur other harm to our business that could have a material adverse effect on our business, prospects, operating results, and financial condition, and could adversely affect the price of our common stock.

Previous wording

We are exposed to the risk of fraud or other misconduct by our employees, principal investigators, and advisors. Misconduct by these parties could include intentional failures to comply with FDA regulations or the regulations applicable in the EU and other jurisdictions, provide accurate information to the FDA, the EMA, and other regulatory authorities, comply with healthcare fraud and abuse laws and regulations in the United States and abroad, report financial information or data accurately or disclose unauthorized activities. Sales, marketing, and business arrangements in the healthcare industry are subject to extensive laws and regulations intended to prevent fraud, misconduct, kickbacks, self-dealing, and other abusive practices. These laws and regulations restrict or prohibit a wide range of pricing, discounting, marketing and promotion, sales commission, customer incentive programs, and other business arrangements. It is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from government investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations. If any such actions are instituted against us and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, financial condition, results of operations, and prospects, including the imposition of significant fines, criminal penalties, or other sanctions.

Current wording

We are exposed to the risk of fraud or other misconduct by our employees, principal investigators, and advisors. Misconduct by these parties could include intentional failures to comply with FDA regulations, regulations applicable in the EU, Japan, and other jurisdictions, provide accurate information to the FDA, the EMA, the MHLW, and other regulatory authorities, comply with healthcare fraud and abuse laws and regulations in the United States and abroad, report financial information or data accurately or disclose unauthorized activities. Sales, marketing, and business arrangements in the healthcare industry are subject to extensive laws and regulations intended to prevent fraud, misconduct, kickbacks, self-dealing, and other abusive practices. These laws and regulations restrict or prohibit a wide range of pricing, discounting, marketing and promotion, sales commission, customer incentive programs, and other business arrangements. It is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from government investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations. If any such actions are instituted against us and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, financial condition, results of operations, and prospects, including the imposition of significant fines, criminal penalties, or other sanctions.

Previous wording

In addition, principal investigators for our clinical trials may serve as scientific advisors or consultants to us from time to time and receive compensation in connection with such services. Under certain circumstances, we may be required to report some of these relationships to the FDA. The FDA may conclude that a financial relationship between us and a principal investigator has created a conflict of interest or otherwise affected interpretation of the clinical trial. The FDA may therefore question the integrity of the data generated at the applicable clinical trial site and the utility of the clinical trial itself may be jeopardized. This could result in a delay in approval, or rejection, of our marketing applications by the FDA and may ultimately lead to the denial of marketing approval of our current and future product candidates.

Current wording

In addition, principal investigators for our clinical trials may serve as scientific advisors or consultants to us from time to time and receive compensation in connection with such services. Under certain circumstances, we may be required to report some of these relationships to the FDA or regulators in other jurisdiction if we conduct clinical trials outside of the United States. The FDA or other applicable regulators may conclude that a financial relationship between us and a principal investigator has created a conflict of interest or otherwise affected interpretation of the clinical trial. The FDA or other applicable regulators may therefore question the integrity of the data generated at the applicable clinical trial site and the utility of the clinical trial itself may be jeopardized. This could result in a delay in approval, or rejection, of our marketing applications by the FDA or foreign regulators and may ultimately lead to the denial of marketing approval of our current and future product candidates.

Previous wording

The Budget Control Act of 2011, among other things, created measures for spending reductions by Congress. A Joint Select Committee on Deficit Reduction, tasked with recommending a targeted deficit reduction of at least $1.2 trillion for the years 2012 through 2021, was unable to reach required goals, thereby triggering the legislation’s automatic reduction to several government programs. This includes aggregate reductions of Medicare payments to providers of up to 2% per fiscal year, which went into effect in April 2013 and will remain in effect through 2032 unless additional Congressional action is taken. In January

Current wording

The Budget Control Act of 2011, among other things, created measures for spending reductions by Congress. A Joint Select Committee on Deficit Reduction, tasked with recommending a targeted deficit reduction of at least $1.2 trillion for the years 2012 through 2021, was unable to reach required goals, thereby triggering the legislation’s automatic reduction to several government programs. This includes aggregate reductions of Medicare payments to providers of up to 2% per fiscal year, which went into effect in April 2013 and will remain in effect through 2032 unless additional Congressional action is taken. In January 2013, the American Taxpayer Relief Act of 2012, among other things, further reduced Medicare payments to certain providers, and increased the time for Medicare contractors to recoup Medicare overpayments to providers from three to five years.

Previous wording

In August 2022, the Inflation Reduction Act (“IRA”) was signed into law. The IRA includes several provisions to lower prescription drug costs for people with Medicare and reduce drug spending by the federal government. In relevant part, the IRA allows Medicare to negotiate prices for certain prescription drugs, requires drug manufacturers to pay a rebate to the federal government if prices for single-source drugs and biologicals covered under Medicare Part B and nearly all covered drugs under Part D increase faster than the rate of inflation, caps out of pocket spending for Medicare Part D enrollees, and makes other benefit design changes to Medicare Part D intended to lower drug costs for enrollees and Medicare. Implementation of these changes began in 2023 and will continue to be implemented over the next several years. Beginning January 1, 2025, Medicare Part D enrollees now have a new annual out-of-pocket cap of $2,000 on prescription drugs. Other 2025 Medicare Part D changes include the elimination of the coverage gap phase and the replacement of the Coverage Gap Discount Program with the Manufacturer Discount Program, which requires drug manufacturers to pay a 10% discount for brand-name drugs and biologics during the initial coverage period and a 20% discount during the catastrophic phase. Multiple pharmaceutical manufacturers have challenged the law in court, largely on constitutional grounds. These suits will likely continue and the ultimate effects of such legal challenges are unclear. On April 15, 2025, President Trump issued an executive order directing the Secretary of the Department of Health and Human Services to take certain actions on drug pricing reform, including working with Congress on amendments to the IRA and rule making to establish new Medicare payment models for so-called “high-cost” prescription drugs and biological products. At this time, we continue to evaluate the effect of the IRA on our business operations and financial condition and results as the full impact of the IRA remains uncertain.

Current wording

Part D increase faster than the rate of inflation, caps out of pocket spending for Medicare Part D enrollees, and makes other benefit design changes to Medicare Part D intended to lower drug costs for enrollees and Medicare. Implementation of these changes began in 2023 and will continue to be implemented over the next several years. Beginning January 1, 2025, Medicare Part D enrollees now have a new annual out-of-pocket cap of $2,000 on prescription drugs. Other 2025 Medicare Part D changes include the elimination of the coverage gap phase and the replacement of the Coverage Gap Discount Program with the Manufacturer Discount Program, which requires drug manufacturers to pay a 10% discount for brand-name drugs and biologics during the initial coverage period and a 20% discount during the catastrophic phase. Multiple pharmaceutical manufacturers have challenged the law in court, largely on constitutional grounds. These suits will likely continue and the ultimate effects of such legal challenges are unclear. On April 15, 2025, President Trump issued an executive order directing the Secretary of the Department of Health and Human Services to take certain actions on drug pricing reform, including working with Congress on amendments to the IRA and rule making to establish new Medicare payment models for so-called “high-cost” prescription drugs and biological products. At this time, we continue to evaluate the effect of the IRA on our business operations and financial condition and results as the full impact of the IRA remains uncertain.

Previous wording

•the federal Anti-Kickback Statute, which prohibits, among other things, persons or entities from knowingly and willfully soliciting, receiving, offering, or paying any remuneration (including any kickback, bribe, or rebate), directly or indirectly, overtly or covertly, in cash or in kind, in return for the purchase, recommendation, leasing, or furnishing of an item or service reimbursable under a federal healthcare program, such as the Medicare and Medicaid programs. This statute has been interpreted to apply to arrangements between pharmaceutical manufacturers on the one hand, and prescribers, purchasers, and formulary managers on the other. The ACA amended the intent requirement of the federal Anti-Kickback Statute to clarify that a person or entity does not have to have actual knowledge of this statute or specific intent to violate it;

Current wording

•the federal Anti-Kickback Statute, which prohibits, among other things, persons or entities from knowingly and willfully soliciting, receiving, offering, or paying any remuneration (including any kickback, bribe, or rebate), directly or indirectly, overtly or covertly, in cash or in kind, in return for the purchase, recommendation, leasing, or furnishing of an item or service reimbursable under a federal healthcare program, such as the Medicare and Medicaid programs. This statute has been interpreted to apply to arrangements between pharmaceutical manufacturers on the one hand, and prescribers, purchasers, and formulary managers on the other. The Patient Protection and Affordable Care Act (the “ACA”) amended the intent requirement of the federal Anti-Kickback Statute to clarify that a person or entity does not have to have actual knowledge of this statute or specific intent to violate it;

Previous wording

•the Health Insurance Portability and Accountability Actof 1996 (“HIPAA”) Rules, which impose certain requirements relating to the privacy, security, and transmission of individually identifiable health information by certain entities subject to the HIPAA Rules, such as health plans, health care clearinghouses, and health care providers that engage in certain covered transactions, known as covered entities, as well as their business associates that perform certain services that involve the use or disclosure of individually identifiable health information for or on behalf of covered entities;

Current wording

•the Health Insurance Portability and Accountability Act of 1996 Rules (“HIPAA Rules”), which impose certain requirements relating to the privacy, security, and transmission of individually identifiable health information by certain entities subject to the HIPAA Rules, such as health plans, health care clearinghouses, and health care providers that engage in certain covered transactions, known as covered entities, as well as their business associates that perform certain services that involve the use or disclosure of individually identifiable health information for or on behalf of covered entities;

Previous wording

•our operations in Europe may be directly or indirectly subject to European law equivalents of each of the above U.S. federal laws, some of which may not have been applicable prior to the recent EC approval of VYJUVEK;

Current wording

•our operations in Europe and Japan may be directly or indirectly subject to European and Japanese law equivalents of each of the above U.S. federal laws, some of which may not have been applicable prior to the recent European Commission and MHLW approvals of VYJUVEK;

Previous wording

Privacy and data security have become significant areas of legal and regulatory focus in the United States, European Union, and in many other jurisdictions where we conduct or may conduct our operations. In our ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, “process”) personal information and other sensitive information, including, but not limited to, health information, individuals’ financial information, as well as proprietary and confidential business data, including trade secrets, intellectual property, and sensitive third-party data (collectively, “sensitive data”). The legislative and regulatory landscape for privacy and data security continues to evolve, and there has been an increasing focus on privacy and data security issues, which may affect our business and is expected to increase our compliance costs and exposure to liability. Our data processing activities may subject us to numerous privacy and data security obligations, including, but not limited to, domestic and international laws, regulations, guidance, industry standards, external and internal privacy and security policies, and contractual requirements.

Current wording

Privacy and data security have become significant areas of legal and regulatory focus in the United States, European Union, Japan, and in many other jurisdictions where we conduct or may conduct our operations. In our ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, “process”) personal information and other sensitive information, including, but not limited to, health information, individuals’ financial information, as well as proprietary and confidential business data, including trade secrets, intellectual property, and sensitive third-party data (collectively, “sensitive data”). The legislative and regulatory landscape for privacy and data security continues to evolve, and there has been an increasing focus on privacy and data security issues, which may affect our business and is expected to increase our compliance costs and exposure to liability. Our data processing activities may subject us to numerous privacy and data security obligations, including, but not limited to, domestic and international laws, regulations, guidance, industry standards, external and internal privacy and security policies, and contractual requirements.

Previous wording

Outside of the United States, there are an increasing number of laws, regulations, and industry standards regarding privacy and data security. For example, the EU General Data Protection Regulation (“GDPR”) and UK GDPR impose strict requirements for processing personal information, and companies that violate the GDPR may face temporary or permanent bans on certain data processing activities and they may be subject to other penalties such as fines of up to 20 million Euros under the EU GDPR / 17.5 million pounds sterling under the UK GDPR or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized to represent data subjects’ interests.

Current wording

Outside of the United States, there are an increasing number of laws, regulations, and industry standards regarding privacy and data security. For example, the EU General Data Protection Regulation (“GDPR”), the Japanese Act on the Protection of Personal Information, and UK GDPR impose strict requirements for processing personal information, and companies that violate the GDPR may face temporary or permanent bans on certain data processing activities and they may be subject to other penalties such as fines of up to 20 million Euros under the EU GDPR / 17.5 million pounds sterling under the UK GDPR or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized to represent data subjects’ interests.

Previous wording

In some circumstances, we may be unable to transfer personal information between certain jurisdictions due to data localization requirements or other limitations on cross-border data flows. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal information to other countries. In particular, the European Economic Area (“EEA”) and the UK have significantly restricted the transfer of personal information to the United States and other countries whose privacy laws they consider inadequate. Although there are various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with the law, such as the EEA and UK’s standard contractual clauses, these mechanisms are subject to legal challenges, and we may be unable to rely on these measures to lawfully transfer personal information to the United States in all cases. If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally compliant transfer are too onerous, we could face significant adverse consequences, including increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors, and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal information to recipients outside Europe for allegedly violating the EU GDPR’s cross-border data transfer limitations. Additionally, companies that transfer personal information to recipients outside of the EEA and/or UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Current wording

In some circumstances, we may be unable to transfer personal information between certain jurisdictions due to data localization requirements or other limitations on cross-border data flows. Europe, Japan, and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal information to other countries. In particular, the European Economic Area (“EEA”) and the UK have significantly restricted the transfer of personal information to the United States and other countries whose privacy laws they consider inadequate. Although there are various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with the law, such as the EEA and UK’s standard contractual clauses, these mechanisms are subject to legal challenges, and we may be unable to rely on these measures to lawfully transfer personal information to the United States in all cases. If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally compliant transfer are too onerous, we could face significant adverse consequences, including increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors, and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal information to recipients outside Europe for allegedly violating the EU GDPR’s cross-border data transfer limitations. Additionally, companies that transfer personal information to recipients outside of the EEA and/or UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Previous wording

In addition, there may be increasing levels of regulation, disclosure-related and otherwise, with respect to ESG matters. For example, in 2024 the SEC adopted new rules that require companies to provide significantly expanded climate-related disclosures in their periodic reporting. The new climate disclosure rules were the subject of multiple legal challenges, and the SEC voluntarily stayed the climate disclosure rules pending the completion of judicial review. In March 2025, the SEC voted to cease defending the climate disclosure rules in court, and in April 2025, the U.S. Court of Appeals for the Eighth Circuit ordered the litigation challenging the SEC’s climate disclosure rules to be held in abeyance. The court directed the SEC to file a status report by July 23, 2025, indicating whether it intends to review or reconsider the rules. Therefore, it is unknown whether the new rules will go into effect and if they do, whether there will be significant changes. If the new rules go into effect and are not substantially different than the rules adopted by the SEC, we may be required to incur significant additional costs to comply, including the implementation of significant additional internal controls processes and procedures regarding matters that have not been subject to such controls in the past, and impose increased oversight obligations on our management and board of directors. Even if the SEC rules are not adopted, states or ex-U.S. jurisdictions in which we currently or may in the future operate may also have or adopt ESG or climate-related disclosure rules requiring similar or broader disclosure obligations. These and other changes in stakeholder expectations will likely lead to increased costs as well as scrutiny that could heighten all of the risks identified in this risk factor. Additionally, our customers and suppliers may be subject to similar expectations, which may augment or create additional risks, including risks that may not be known to us.

Current wording

In addition, there may be increasing levels of regulation, disclosure-related and otherwise, with respect to ESG matters. For example, in 2024 the SEC adopted new rules that require companies to provide significantly expanded climate-related disclosures in their periodic reporting. The new climate disclosure rules were the subject of multiple legal challenges, and the SEC voluntarily stayed the climate disclosure rules pending the completion of judicial review. In March 2025, the SEC voted to cease defending the climate disclosure rules in court, and in April 2025, the U.S. Court of Appeals for the Eighth Circuit ordered the litigation challenging the SEC’s climate disclosure rules to be held in abeyance. The court directed the SEC to file a status report by July 23, 2025, indicating whether it intends to review or reconsider the rules. On July 23, 2025, the SEC declined to review or reconsider the climate disclosure rules adopted in 2024, and directed the court to proceed with litigation and indicated it would not pre‑judge whether it would enforce the rules if the court ultimately upholds them. Therefore, it is unknown whether the new rules will go into effect and if they do, whether there will be significant changes. If the new rules go into effect and are not substantially different than the rules adopted by the SEC, we may be required to incur significant additional costs to comply, including the implementation of significant additional internal controls processes and procedures regarding matters that have not been subject to such controls in the past, and impose increased oversight obligations on our management and board of directors. Even if the SEC rules are not adopted, states or ex-U.S. jurisdictions in which we currently or may in the future operate may also have or adopt ESG or climate-related disclosure rules requiring similar or broader disclosure obligations. These and other changes in stakeholder expectations will likely lead to increased costs as well as scrutiny that could heighten all of the risks identified in this risk factor. Additionally, our customers and suppliers may be subject to similar expectations, which may augment or create additional risks, including risks that may not be known to us.

Previous wording

On April 23, 2025, the EC granted marketing authorization to VYJUVEK, and we are planning for our first European launch in Germany in mid-2025. We currently have operations and employees located outside the United States and our business strategy incorporates potential additional international expansion to target patient populations outside the United States. Doing business internationally involves a number of risks, including, but not limited to:

Current wording

On April 23, 2025, the European Commission granted marketing authorization to VYJUVEK, and we are planning for our first European launch in Germany in mid-2025. On July 24, 2025, Japan’s MHLW granted marketing authorization to VYJUVEK, and we expect to launch in Japan before the end of 2025. We currently have operations and employees located outside the United States and our business strategy incorporates potential additional international expansion to target patient populations outside the United States. Doing business internationally involves a number of risks, including, but not limited to:

Previous wording

The clinical trial requirements of the FDA, EMA and other regulatory authorities and the criteria these regulators use to determine the safety and efficacy of a product candidate vary substantially according to the type, complexity, novelty and intended use and market of such product candidates. The regulatory approval process for novel product candidates such as ours, including approvals of or changes to manufacturing processes, can be more expensive and take longer than for other, better known or more extensively studied product candidates. It is difficult to determine how long it will take or how much it will cost to obtain regulatory approvals for our product candidates in the United States, the European Union, or elsewhere, or how long it will take to commercialize our product candidates. Approvals by the European Commission may not be indicative of what the FDA may require for approval and approval by the FDA may not be indicative of what the European Commission would require for approval.

Current wording

The clinical trial requirements of the FDA, EMA. MHLW, and other regulatory authorities and the criteria these regulators use to determine the safety and efficacy of a product candidate vary substantially according to the type, complexity, novelty and intended use and market of such product candidates. The regulatory approval process for novel product candidates such as ours, including approvals of or changes to manufacturing processes, can be more expensive and take longer than for other, better known or more extensively studied product candidates. It is difficult to determine how long it will take or how much it will cost to obtain regulatory approvals for our product candidates in the United States, the European Union, Japan, or elsewhere, or how long it will take to commercialize our product candidates. Approvals by the European Commission or MHLW may not be indicative of what the FDA may require for approval and approval by the FDA may not be indicative of what the European Commission or MHLW would require for approval.

Previous wording

Regulatory requirements and policy governing gene and cell therapy products have changed frequently and may continue to change in the future. In 2016, the FDA established the Office of Tissues and Advanced Therapies (“OTAT”) within its Center for Biologics Evaluation and Research to consolidate the review of gene therapy and related products, and has established the Cellular, Tissue and Gene Therapies Advisory Committee, among others, to advise this review. In September 2022, the FDA announced retitling of OTAT to the Office of Therapeutic Products, or OTP, and elevation of OTP to a “Super Office” to meet its growing cell and gene therapy workload. If we engage a National Institutes of Health funded institution to conduct a clinical trial, that institution’s Institutional Biosafety Committee as well as its Institutional Review Board would need to review the proposed clinical trial to assess the safety and ethics of the trial. Similarly, the EMA may issue new guidelines concerning the development and marketing authorization for gene therapy medicinal products and require that we comply with these new guidelines.

Current wording

Regulatory requirements and policy governing gene and cell therapy products have changed frequently and may continue to change in the future. In 2016, the FDA established the Office of Tissues and Advanced Therapies (“OTAT”) within its Center for Biologics Evaluation and Research to consolidate the review of gene therapy and related products, and has established the Cellular, Tissue and Gene Therapies Advisory Committee, among others, to advise this review. In September 2022, the FDA announced retitling of OTAT to the Office of Therapeutic Products, or OTP, and elevation of OTP to a “Super Office” to meet its growing cell and gene therapy workload. If we engage a National Institutes of Health funded institution to conduct a clinical trial, that institution’s Institutional Biosafety Committee as well as its Institutional Review Board would need to review the proposed clinical trial to assess the safety and ethics of the trial. Similarly, the EMA or MHLW may issue new guidelines concerning the development and marketing authorization for gene therapy medicinal products and require that we comply with these new guidelines.

Previous wording

VYJUVEK, our first FDA and EMA-approved product, and any other product candidates that obtain regulatory approval in the future, will remain subject to ongoing regulatory requirements for manufacturing, labeling, packaging, storage, advertising, promotion, sampling, record-keeping, and submission of safety and other post-market information. Any regulatory approvals that we receive for our product candidates may also be subject to a post-approval safety monitoring program, limitations on the approved indicated uses for which the product may be marketed or to the conditions of approval, or contain requirements for potentially costly post-marketing testing, including Phase 4 clinical trials, and surveillance to monitor the quality, safety, and efficacy of the product. For example, the holder of an approved BLA is obligated to monitor and report adverse events and any failure of a product to meet the specifications in the BLA. The holder of an approved BLA also must submit new or supplemental applications and obtain FDA approval for certain changes to the approved product, product labeling, or manufacturing process. For example, if demand for an approved product increases more than we previously estimate, we may need or desire to scale up an existing FDA-approved manufacturing process and the scaled-up manufacturing process would be subject to FDA review and approval. Advertising and promotional materials must comply with FDA rules and are subject to FDA review, in addition to other potentially applicable federal and state laws.

Current wording

VYJUVEK, our first FDA, EMA, and MHLW-approved product, and any other product candidates that obtain regulatory approval in the future, will remain subject to ongoing regulatory requirements for manufacturing, labeling, packaging, storage, advertising, promotion, sampling, record-keeping, and submission of safety and other post-market information. Any regulatory approvals that we receive for our product candidates may also be subject to a post-approval safety monitoring program, limitations on the approved indicated uses for which the product may be marketed or to the conditions of approval, or contain requirements for potentially costly post-marketing testing, including Phase 4 clinical trials, and surveillance to monitor the quality, safety, and efficacy of the product. For example, the holder of an approved Biologics License Application, or BLA, is obligated to monitor and report adverse events and any failure of a product to meet the specifications in the BLA. The holder of an approved BLA also must submit new or supplemental applications and obtain FDA approval for certain changes to the approved product, product labeling, or manufacturing process. For example, if demand for an approved product increases more than we previously estimate, we may need or desire to scale up an existing FDA-approved manufacturing process and the scaled-up manufacturing process would be subject to FDA review and approval. Advertising and promotional materials must comply with FDA rules and are subject to FDA review, in addition to other potentially applicable federal and state laws.

Previous wording

We received FDA approval of VYJUVEK in May 2023 and European Commission approval of VYJUVEK in April 2025 and initiated a commercial launch of VYJUVEK in the United States in the second quarter of 2023. As a company, we have no prior experience commercializing a biologic. The success of our commercialization efforts is difficult to predict and subject to the effective execution of our business plan, including, among other things, the continued development of our internal sales, marketing, manufacturing, and distribution capabilities and our ability to navigate the significant expenses and risks involved with the development and management of such capabilities. For example, our commercial launch of VYJUVEK in the United States and the EU may not develop as planned or anticipated, which may require us to, among others, adjust or amend our business plan and incur significant expenses. Further, given our lack of experience commercializing products, we do not have a track record of successfully executing a commercial launch. There is a risk that we underestimate the level of demand for a product, which could require us to change a manufacturing process to increase production yields and changes to a manufacturing process are time consuming and subject to regulatory, financial, and operational risks. If we are unsuccessful in accomplishing our objectives and executing on our business plan, or if our commercialization efforts do not develop as planned, we may not be able to successfully commercialize VYJUVEK and any future approved products, we may require significant additional capital and financial resources, we may not be profitable on a consistent basis, and we may not be able to compete against more established companies in our industry.

Current wording

We received FDA approval of VYJUVEK in May 2023, European Commission approval of VYJUVEK in April 2025, and MHLW approval in July 2025, and initiated a commercial launch of VYJUVEK in the United States in the second quarter of 2023. As a company, we have no prior experience commercializing a biologic. The success of our commercialization efforts is difficult to predict and subject to the effective execution of our business plan, including, among other things, the continued development of our internal sales, marketing, manufacturing, and distribution capabilities and our ability to navigate the significant expenses and risks involved with the development and management of such capabilities. For example, our commercial launch of VYJUVEK in the United States, the European Union, or Japan may not develop as planned or anticipated, which may require us to, among others, adjust or amend our business plan and incur significant expenses. Further, given our lack of experience commercializing products, we do not have a track record of successfully executing a commercial launch. There is a risk that we underestimate the level of demand for a product, which could require us to change a manufacturing process to increase production yields and changes to a manufacturing process are time consuming and subject to regulatory, financial, and operational risks. If we are unsuccessful in accomplishing our objectives and executing on our business plan, or if our commercialization efforts do not develop as planned, we may not be able to successfully commercialize VYJUVEK and any future approved products, we may require significant additional capital and financial resources, we may not be profitable on a consistent basis, and we may not be able to compete against more established companies in our industry.

Previous wording

In connection with the commercial launch of VYJUVEK in the United States, we recruited a sales force and established marketing, market access, and medical affairs teams and distribution capabilities and if the commercial launch of VYJUVEK is not successful for any reason, we could incur substantial costs and our investment would be lost if we cannot retain or reposition our sales, marketing, market access, and medical affairs personnel.

Current wording

In connection with the commercial launch of VYJUVEK in the United States and planned commercial launches in Europe and Japan, we have recruited a sales force and established marketing, market access, and medical affairs teams and distribution capabilities and if the commercial launch of VYJUVEK is not successful for any reason, we could incur substantial costs and our investment would be lost if we cannot retain or reposition our sales, marketing, market access, and medical affairs personnel.

Previous wording

To achieve commercial success for VYJUVEK, we have devoted and anticipate that we will continue to devote significant resources to support our sales force, marketing, market access, and medical affairs teams and distribution capabilities. There are risks involved with establishing our own sales, marketing, distribution, training, and support capabilities. For example, recruiting and training sales and marketing personnel is expensive and time-consuming and could delay our ability to focus on other priorities. If the commercial launch of VYJUVEK in the United States is not successful for any reason, this would be costly, and our investment would be lost if we cannot retain or reposition our sales, marketing, market access, and medical affairs personnel or terminate on favorable terms any agreements entered into with third parties to support our commercialization efforts.

Current wording

To achieve commercial success for VYJUVEK, we have devoted and anticipate that we will continue to devote significant resources to support our sales force, marketing, market access, and medical affairs teams and distribution capabilities. There are risks involved with establishing our own sales, marketing, distribution, training, and support capabilities. For example, recruiting and training sales and marketing personnel is expensive and time-consuming and could delay our ability to focus on other priorities. If the commercial launch of VYJUVEK in the United States, Europe, or Japan is not successful for any reason, this would be costly, and our investment would be lost if we cannot retain or reposition our sales, marketing, market access, and medical affairs personnel or terminate on favorable terms any agreements entered into with third parties to support our commercialization efforts.

Previous wording

If our sales force, marketing, market access, and medical affairs teams and distribution capabilities fail, or are otherwise unsuccessful, it would materially adversely impact the commercial launch of VYJUVEK, impact our ability to generate revenue, and harm our business.

Current wording

If our sales force, marketing, market access, and medical affairs teams and distribution capabilities fail, or are otherwise unsuccessful, it would materially adversely impact the commercial launch of VYJUVEK in the United States, Europe, or Japan, impact our ability to generate revenue, and harm our business.

Previous wording

Even with the requisite approvals from the FDA in the United States, from the European Commission in the European Union, and potential approval from the PMDA in Japan, and other regulatory authorities internationally (and potential approvals of any of our product candidates by regulatory authorities), the commercial success of VYJUVEK and our product candidates will depend, in part, on the acceptance of physicians, patients, and health care payors of gene therapy products in general, and VYJUVEK and our product candidates, in particular, as medically necessary, cost-effective, and safe. VYJUVEK and any product candidate that we commercialize may not gain acceptance by physicians, patients, health care payors, and others in the medical community. If these products do not achieve an adequate level of acceptance, we may not generate significant product revenue and may not become consistently profitable. The degree of market acceptance of gene therapy products and VYJUVEK and our product candidates, if approved for commercial sale, will depend on several factors, including:

Current wording

Even with the requisite approvals from the FDA in the United States, from the European Commission in the European Union, and the MHLW in Japan, and other regulatory authorities internationally (and potential approvals of any of our product candidates by regulatory authorities), the commercial success of VYJUVEK and our product candidates will depend, in part, on the acceptance of physicians, patients, and health care payors of gene therapy products in general, and VYJUVEK and our product candidates, in particular, as medically necessary, cost-effective, and safe. VYJUVEK and any product candidate that we commercialize may not gain acceptance by physicians, patients, health care payors, and others in the medical community. If these products do not achieve an adequate level of acceptance, we may not generate significant product revenue and may not become consistently profitable. The degree of market acceptance of gene therapy products and VYJUVEK and our product candidates, if approved for commercial sale, will depend on several factors, including:

Previous wording

•product labeling or product insert requirements of the FDA, the EMA, the PMDA, or other regulatory authorities, including any limitations or warnings contained in a product’s approved labeling;

Current wording

•product labeling or product insert requirements of the FDA, the EMA, the MHLW, or other regulatory authorities, including any limitations or warnings contained in a product’s approved labeling;

Previous wording

•manufacture, market, and sell our lead product, VYJUVEK, in the United States, market and sell VYJUVEK in the EU, and prepare for regulatory approval in Japan and if such approval is received, commercialize VYJUVEK in Japan;

Current wording

•manufacture, market, and sell our lead product, VYJUVEK, in the United States and market and sell VYJUVEK in the EU and Japan;

Previous wording

To remain profitable, we must be successful in a range of challenging activities, including designing, initiating, and completing clinical trials for our product candidates, developing, validating, and maintaining commercial scale manufacturing processes, obtaining marketing approvals, manufacturing, marketing, and selling VYJUVEK and any product candidates for which we may obtain marketing approval, and satisfying any post-marketing requirements. If we were required to discontinue development of any of our product candidates, if VYJUVEK does not receive regulatory approvals outside the United States or the EU, or any of our product candidates do not receive regulatory approvals, or if VYJUVEK or any of our product candidates, if approved, fails to achieve sufficient market acceptance for any indication, our ability to remain profitable and our business prospects and financial condition could be materially adversely affected. Moreover, if we decide to leverage any success with VYJUVEK or any of our current product candidates to develop other product opportunities, we may not be successful in such efforts. In any such event, our business may be materially adversely affected.

Current wording

To remain profitable, we must be successful in a range of challenging activities, including designing, initiating, and completing clinical trials for our product candidates, developing, validating, and maintaining commercial scale manufacturing processes, obtaining marketing approvals, manufacturing, marketing, and selling VYJUVEK and any product candidates for which we may obtain marketing approval, and satisfying any post-marketing requirements. If we were required to discontinue development of any of our product candidates, if VYJUVEK does not receive regulatory approvals outside the United States, the EU, or Japan, or any of our product candidates do not receive regulatory approvals, or if VYJUVEK or any of our product candidates, if approved, fails to achieve sufficient market acceptance for any indication, our ability to remain profitable and our business prospects and financial condition could be materially adversely affected. Moreover, if we decide to leverage any success with VYJUVEK or any of our current product candidates to develop other product opportunities, we may not be successful in such efforts. In any such event, our business may be materially adversely affected.

Previous wording

We currently have one product, VYJUVEK, approved by the FDA and the EMA and several product candidates in the clinical trials stages. However, we may never develop, acquire or in-license additional product candidates. We may never generate revenue from any of our product candidates. We may not be able to sustain or increase profitability on a quarterly or annual basis. Our failure to remain profitable would decrease the value of our company and could impair our ability to raise capital, maintain our research and development efforts, expand our business, or continue our operations. A decline in the value of our company also could cause stockholders to lose all or part of their investment.

Current wording

We currently have one product, VYJUVEK, approved by the FDA, the EMA, and MHLW and several product candidates in the clinical trials stages. However, we may never develop, acquire or in-license additional product candidates. We may never generate revenue from any of our product candidates. We may not be able to sustain or increase profitability on a quarterly or annual basis. Our failure to remain profitable would decrease the value of our company and could impair our ability to raise capital, maintain our research and development efforts, expand our business, or continue our operations. A decline in the value of our company also could cause stockholders to lose all or part of their investment.

Previous wording

Because of the numerous risks and uncertainties associated with pharmaceutical product and biological development, we are unable to accurately predict the timing or amount of increased expenses. If we are required by the FDA, the EMA, the PMDA, or other regulatory authorities to perform studies in addition to those currently expected, or if there are any delays in completing our clinical trials or the development of our product candidates, our expenses could increase and potential revenue from product candidates in development could be delayed.

Current wording

Because of the numerous risks and uncertainties associated with pharmaceutical product and biological development, we are unable to accurately predict the timing or amount of increased expenses. If we are required by the FDA, the EMA, the MHLW, or other regulatory authorities to perform studies in addition to those currently expected, or if there are any delays in completing our clinical trials or the development of our product candidates, our expenses could increase and potential revenue from product candidates in development could be delayed.