Krystal Biotech, Inc.

Current report

There have been no material changes to the risk factors previously disclosed in Part I, Item 1A of our Annual Report on Form 10-K for the fiscal year ended December 31, 2024, and in Part II, Item 1A of our Quarterly Reports on Form 10-Q filed during 2025.

Previous report

There are a number of risks and uncertainties that may have a material effect on the operating results of our business and our financial condition. The risk factors below reflect material changes to risks to our business following Japan’s Ministry of Health, Labour and Welfare (“MHLW”) approval of VYJUVEK on July 24, 2025, and should be reviewed in conjunction with “Summary Risk Factors” and “Part I, Item 1A. Risk Factors” in our 2024 10-K, and “Part II, Item 1A. Risk Factors” in our Quarterly Report on Form 10-Q for the quarter ended March 31, 2025, filed with the Securities and Exchange Commission (the “SEC”) on May 6, 2025 (“Q1 2025 10-Q”). Except as set forth below, the above referenced risk factors included in our 2024 10-K and our Q1 2025 10-Q remain unchanged.

Previous report

Risks Related to Our Business and Industry

Previous report

We are substantially dependent on the commercial success of VYJUVEK

Previous report

To date, we have invested substantial efforts and financial resources in the research and development of VYJUVEK and our product candidates. Our near-term prospects, including our ability to develop our product candidates and generate revenue, and our future growth is substantially dependent on the commercial success of VYJUVEK.

Previous report

Although we received approval from the FDA, the European Commission, and Japan’s MHLW for VYJUVEK for the treatment of DEB, we can provide no assurances that we will obtain regulatory approval in any other jurisdiction, which would have an adverse impact on our results of operations. In addition, the successful commercialization of VYJUVEK will depend on a number of factors and involves risk, including some of the risks that are set forth under the caption “Risk Factors” in our annual and quarterly reports on file with the SEC. One or more of these factors, many of which are beyond our control could cause significant delays or an inability to successfully commercialize VYJUVEK.

Previous report

Social media is increasingly being used by us, our employees, or others to communicate about our business, VYJUVEK, our clinical development programs, DEB, and the diseases our product candidates are being developed to treat. We use social media in connection with our commercialization efforts of VYJUVEK and intend to use it in connection with our commercialization efforts of our product candidates, if approved. Social media practices in the biotechnology and biopharmaceutical industries continue to evolve, and regulations and regulatory guidance relating to such use are evolving and not always clear. This evolution creates uncertainty and risk of noncompliance with regulations applicable to our business, resulting in potential regulatory actions against us, along with the potential for litigation and heightened scrutiny by the FDA, the EMA, the MHLW, the SEC, and other regulators. For example, patients may use social media channels to comment on their experience in an ongoing clinical trial of our product candidates, or to report an alleged adverse event. If such disclosures occur, there is a risk that clinical trial enrollment may be adversely impacted, that we may fail to monitor and comply with applicable adverse event reporting obligations, or that we may not be able to defend our business or the public’s legitimate interests in the face of the political and market pressures generated by social media due to restrictions on what we may say about our product candidates. There is also a risk of inappropriate disclosure of sensitive information, loss of trade secrets or other intellectual property, public exposure of personal information of our employees, patients who use VYJUVEK, clinical trial patients, and others, or negative or inaccurate posts or comments about us on any social networking website. In addition, we may encounter attacks on social media regarding our company, management, VYJUVEK, or our product candidates that seriously damage our reputation, brand image, and goodwill. If any of these events were to occur or we otherwise fail to comply with applicable regulations, we could incur liability, face regulatory actions, or incur other harm to our business that could have a material adverse effect on our business, prospects, operating results, and financial condition, and could adversely affect the price of our common stock.

Previous report

Our employees, principal investigators and advisors may engage in misconduct or other improper activities, including non-compliance with regulatory standards and requirements.

Previous report

We are exposed to the risk of fraud or other misconduct by our employees, principal investigators, and advisors. Misconduct by these parties could include intentional failures to comply with FDA regulations, regulations applicable in the EU, Japan, and other jurisdictions, provide accurate information to the FDA, the EMA, the MHLW, and other regulatory authorities, comply with healthcare fraud and abuse laws and regulations in the United States and abroad, report financial information or data accurately or disclose unauthorized activities. Sales, marketing, and business arrangements in the healthcare industry are subject to extensive laws and regulations intended to prevent fraud, misconduct, kickbacks, self-dealing, and other abusive practices. These laws and regulations restrict or prohibit a wide range of pricing, discounting, marketing and promotion, sales commission, customer incentive programs, and other business arrangements. It is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from government investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations. If any such actions are instituted against us and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, financial condition, results of operations, and prospects, including the imposition of significant fines, criminal penalties, or other sanctions.

Previous report

In addition, principal investigators for our clinical trials may serve as scientific advisors or consultants to us from time to time and receive compensation in connection with such services. Under certain circumstances, we may be required to report some of these relationships to the FDA or regulators in other jurisdiction if we conduct clinical trials outside of the United States. The FDA or other applicable regulators may conclude that a financial relationship between us and a principal investigator has created a conflict of interest or otherwise affected interpretation of the clinical trial. The FDA or other applicable regulators may therefore question the integrity of the data generated at the applicable clinical trial site and the utility of the clinical trial itself may be jeopardized. This could result in a delay in approval, or rejection, of our marketing applications by the FDA or foreign regulators and may ultimately lead to the denial of marketing approval of our current and future product candidates.

Previous report

Healthcare legislative reform measures may have a material adverse effect on our business and results of operations.

Previous report

In the United States and some foreign jurisdictions, there have been, and continue to be, several legislative and regulatory changes and proposed changes regarding the healthcare system that could prevent or delay marketing approval of our product candidates, restrict or regulate post-approval activities, and affect our ability to profitably sell VYJUVEK and any product candidates for which we obtain marketing approval.

Previous report

In the United States, there have been and continue to be a number of legislative efforts to contain healthcare costs. Any legislative changes that result in price controls, reduce access to and reimbursement for care, or add additional regulations may have an adverse effect on our financial condition and results of operations. Any changes that reduce, or impede the ability to obtain, reimbursement for VYJUVEK or our product candidates that we intend to commercialize in the United States could adversely affect successful commercialization of VYJUVEK and our plans to introduce our product candidates in the United States.

Previous report

The Budget Control Act of 2011, among other things, created measures for spending reductions by Congress. A Joint Select Committee on Deficit Reduction, tasked with recommending a targeted deficit reduction of at least $1.2 trillion for the years 2012 through 2021, was unable to reach required goals, thereby triggering the legislation’s automatic reduction to several government programs. This includes aggregate reductions of Medicare payments to providers of up to 2% per fiscal year, which went into effect in April 2013 and will remain in effect through 2032 unless additional Congressional action is taken. In January 2013, the American Taxpayer Relief Act of 2012, among other things, further reduced Medicare payments to certain providers, and increased the time for Medicare contractors to recoup Medicare overpayments to providers from three to five years.

Previous report

In August 2022, the Inflation Reduction Act (“IRA”) was signed into law. The IRA includes several provisions to lower prescription drug costs for people with Medicare and reduce drug spending by the federal government. In relevant part, the IRA allows Medicare to negotiate prices for certain prescription drugs, requires drug manufacturers to pay a rebate to the federal government if prices for single-source drugs and biologicals covered under Medicare Part B and nearly all covered drugs under

Previous report

Part D increase faster than the rate of inflation, caps out of pocket spending for Medicare Part D enrollees, and makes other benefit design changes to Medicare Part D intended to lower drug costs for enrollees and Medicare. Implementation of these changes began in 2023 and will continue to be implemented over the next several years. Beginning January 1, 2025, Medicare Part D enrollees now have a new annual out-of-pocket cap of $2,000 on prescription drugs. Other 2025 Medicare Part D changes include the elimination of the coverage gap phase and the replacement of the Coverage Gap Discount Program with the Manufacturer Discount Program, which requires drug manufacturers to pay a 10% discount for brand-name drugs and biologics during the initial coverage period and a 20% discount during the catastrophic phase. Multiple pharmaceutical manufacturers have challenged the law in court, largely on constitutional grounds. These suits will likely continue and the ultimate effects of such legal challenges are unclear. On April 15, 2025, President Trump issued an executive order directing the Secretary of the Department of Health and Human Services to take certain actions on drug pricing reform, including working with Congress on amendments to the IRA and rule making to establish new Medicare payment models for so-called “high-cost” prescription drugs and biological products. At this time, we continue to evaluate the effect of the IRA on our business operations and financial condition and results as the full impact of the IRA remains uncertain.

Previous report

Furthermore, on July 4, 2025, legislation commonly referred to as the One Big Beautiful Bill Act was signed into law, which reduces funding to federal healthcare programs and imposes additional requirements to be eligible for healthcare, which may result in decreased access to healthcare, particularly in Medicaid programs.

Previous report

Further, there has been heightened governmental scrutiny in recent years over the manner in which manufacturers set prices for their marketed products and the cost of prescription drugs to consumers and government healthcare programs, which have resulted in several recent Congressional inquiries and proposed and enacted bills designed to, among other things, reduce the cost of prescription drugs, bring more transparency to product pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for products. In addition, the United States government, state legislatures, and foreign governments have shown significant interest in implementing cost containment programs, including price-controls, restrictions on reimbursement and requirements for substitution of generic products for branded prescription drugs to limit the growth of government paid health care costs. For example, the United States government has passed legislation requiring pharmaceutical manufacturers to provide rebates and discounts to certain entities and governmental payors to participate in federal healthcare programs. Individual states in the United States have also been increasingly passing legislation and implementing regulations designed to control pharmaceutical product pricing, including price or patient reimbursement constraints, discounts, restrictions on certain product access and marketing cost disclosure and transparency measures, and, in some cases, designed to encourage importation from other countries and bulk purchasing.

Previous report

Additional changes may affect our business, including those governing enrollment in federal healthcare programs, reimbursement changes, fraud and abuse enforcement, and expansion of new programs, such as Medicare payment for performance initiatives. Healthcare reform measures that may be adopted in the future, may result in more rigorous coverage criteria and in additional downward pressure on the price that we receive for any approved product. Any reduction in reimbursement from Medicare or other government programs may result in a similar reduction in payments from private payors. The implementation of cost containment measures or other healthcare reforms could result in reduced demand for our product and product candidates or additional pricing pressures and may adversely impact our ability to generate sufficient revenue, attain consistent profitability, or commercialize our product candidates, if approved.

Previous report

We are subject, directly or indirectly, to federal and state healthcare fraud and abuse laws, false claims laws, and health information privacy and security laws. If we are unable to comply, or have not fully complied, with such laws, we could face substantial penalties.

Previous report

With the FDA approval of VYJUVEK, our operations are directly, or indirectly through our prescribers, customers, and purchasers, subject to various federal and state fraud and abuse laws and regulations, including, without limitation, the federal Anti-Kickback Statute, federal civil and criminal false claims laws and the Physician Payments Sunshine Act and regulations. These laws impact, among other things, our sales, marketing, access assistance, sponsored genetic patient testing, and educational programs. In addition, we are subject to patient privacy laws by both the federal government and the states in which we conduct our business, as well as by foreign jurisdictions. The laws that affect our operations include, but are not limited to:

Previous report

•the federal Anti-Kickback Statute, which prohibits, among other things, persons or entities from knowingly and willfully soliciting, receiving, offering, or paying any remuneration (including any kickback, bribe, or rebate), directly or indirectly, overtly or covertly, in cash or in kind, in return for the purchase, recommendation, leasing, or furnishing of an item or service reimbursable under a federal healthcare program, such as the Medicare and Medicaid programs. This statute has been interpreted to apply to arrangements between pharmaceutical manufacturers on the one hand, and prescribers, purchasers, and formulary managers on the other. The Patient Protection and Affordable Care Act (the “ACA”) amended the intent requirement of the federal Anti-Kickback Statute to clarify that a person or entity does not have to have actual knowledge of this statute or specific intent to violate it;

Previous report

•federal civil and criminal false claims laws and civil monetary penalty laws which prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, claims for payment or approval from Medicare, Medicaid, or other government payors that are false or fraudulent. The ACA provides that a claim for items or services resulting from an Anti-Kickback Statute violation is a false claim under the False Claims Act (“FCA”). Cases against pharmaceutical manufacturers support the view that certain marketing practices, including off-label promotion, may implicate the FCA;

Previous report

•the federal Health Care Fraud statute imposes criminal and civil liability for executing or attempting to execute a scheme to defraud any healthcare benefit program or making false statements relating to healthcare matters;

Previous report

•the Health Insurance Portability and Accountability Act of 1996 Rules (“HIPAA Rules”), which impose certain requirements relating to the privacy, security, and transmission of individually identifiable health information by certain entities subject to the HIPAA Rules, such as health plans, health care clearinghouses, and health care providers that engage in certain covered transactions, known as covered entities, as well as their business associates that perform certain services that involve the use or disclosure of individually identifiable health information for or on behalf of covered entities;

Previous report

•federal transparency laws, including the federal Physician Payment Sunshine Act, that require certain manufacturers of drugs, devices, biologics, and medical supplies for which payment is available under Medicare, Medicaid, or the Children’s Health Insurance Program, with specific exceptions, to report annually to the United States Centers for Medicare and Medicaid Services (“CMS”) information related to: (i) payments or other “transfers of value” made to physicians and teaching hospitals, and (ii) ownership and investment interests held by physicians and their immediate family members;

Previous report

•our operations in Europe and Japan may be directly or indirectly subject to European and Japanese law equivalents of each of the above U.S. federal laws, some of which may not have been applicable prior to the recent European Commission and MHLW approvals of VYJUVEK;

Previous report

•U.S. state and foreign law equivalents of each of the above federal laws, state laws that require drug manufacturers to report information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures; and

Previous report

•state and foreign laws governing data privacy and security of health information, many of which differ from each other and require attention to frequently changing regulatory requirements, thus complicating compliance efforts in certain circumstances and increasing exposure to liability.

Previous report

Because of the breadth of these laws and the narrowness of the statutory exceptions and safe harbors available, it is possible that some of our business activities could be subject to challenge under one or more of such laws. If our operations are found to be in violation of any of the laws described above or any other government regulations that apply to us, we may be subject to penalties, including civil and criminal penalties, damages, fines, exclusion from participation in government health care programs, such as Medicare and Medicaid, imprisonment, and the curtailment or restructuring of our operations, any of which could adversely affect our ability to operate our business and our results of operations.

Previous report

Often, to avoid the threat of treble damages and penalties under the FCA, health care providers and drug manufacturers will resolve allegations in a settlement without admitting liability. Any such settlement could materially affect our business, financial operations, and reputation.

Previous report

Efforts to ensure that our business arrangements with third parties comply with applicable healthcare laws and regulations involve substantial costs. It is possible that governmental authorities will conclude that our business practices may not comply with current or future statutes, regulations or case law involving applicable fraud and abuse or other healthcare laws and regulations.

Previous report

The risk of our being found in violation of these laws is increased by the fact that many of them have not been fully interpreted by the regulatory authorities or the courts, and their provisions are open to a variety of interpretations. Any action against us for violation of these laws, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management’s attention from the operation of our business. The shifting compliance environment and the need to build and maintain a robust and expandable systems to comply with multiple jurisdictions with different compliance and/or reporting requirements increases the possibility that we may run afoul of one or more of the requirements.

Previous report

We are subject to stringent and evolving U.S. and foreign laws, regulations and other obligations related to privacy and data security. Our actual or perceived failure to comply with such obligations could lead to regulatory inquiries or actions, litigation, fines and penalties, disruptions to our business operations, reputational harm, loss of revenue, and other adverse business consequences.

Previous report

Privacy and data security have become significant areas of legal and regulatory focus in the United States, European Union, Japan, and in many other jurisdictions where we conduct or may conduct our operations. In our ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, “process”) personal information and other sensitive information, including, but not limited to, health information, individuals’ financial information, as well as proprietary and confidential business data, including trade secrets, intellectual property, and sensitive third-party data (collectively, “sensitive data”). The legislative and regulatory landscape for privacy and data security continues to evolve, and there has been an increasing focus on privacy and data security issues, which may affect our business and is expected to increase our compliance costs and exposure to liability. Our data processing activities may subject us to numerous privacy and data security obligations, including, but not limited to, domestic and international laws, regulations, guidance, industry standards, external and internal privacy and security policies, and contractual requirements.

Previous report

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal information privacy laws, consumer protection laws, and other similar laws. Notably, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, imposes requirements on covered entities, as well as their business associates regarding the privacy, security, and transmission of individually identifiable health information. Further, states continue to adopt new laws or amend existing laws related to data privacy, requiring attention to frequently changing regulatory requirements. For example, and the California Consumer Privacy Act of 2018 (“CCPA”) requires businesses to provide specific disclosures in their privacy notices and honor residents’ privacy rights. The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA does not apply to certain data that we process in the context of clinical trials, efforts to comply with the CCPA may increase our annual compliance costs and subject us to potential liability with respect to other personal information we may maintain about California residents. In addition, the California Privacy Rights Act of 2020 (“CPRA”), which came into effect on January 1, 2023, expanded the CCPA’s requirements, extending it to cover personal information of business representatives and employees and the CPRA established a new regulatory agency to implement and enforce the law. Other states, such as Virginia, Nevada, Connecticut, Utah, Texas, and Colorado, have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels, which impose similar obligations to those in the CCPA. Further, other states, such as Nevada and Washington, have enacted privacy laws specifically governing consumer health information, with Washington providing for a private right of action. Although many of these laws currently exempt certain health-related information, the laws may increase our potential liability related to our data processing activities, complicate our compliance efforts, and increase both legal risk and compliance costs for us and the third parties upon whom we rely.

Previous report

Outside of the United States, there are an increasing number of laws, regulations, and industry standards regarding privacy and data security. For example, the EU General Data Protection Regulation (“GDPR”), the Japanese Act on the Protection of Personal Information, and UK GDPR impose strict requirements for processing personal information, and companies that violate the GDPR may face temporary or permanent bans on certain data processing activities and they may be subject to other penalties such as fines of up to 20 million Euros under the EU GDPR / 17.5 million pounds sterling under the UK GDPR or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized to represent data subjects’ interests.

Previous report

In some circumstances, we may be unable to transfer personal information between certain jurisdictions due to data localization requirements or other limitations on cross-border data flows. Europe, Japan, and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal information to other countries. In particular, the European Economic Area (“EEA”) and the UK have significantly restricted the transfer of personal information to the United States and other countries whose privacy laws they consider inadequate. Although there are various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with the law, such as the EEA and UK’s standard contractual clauses, these mechanisms are subject to legal challenges, and we may be unable to rely on these measures to lawfully transfer personal information to the United States in all cases. If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally compliant transfer are too onerous, we could face significant adverse consequences, including increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors, and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal information to recipients outside Europe for allegedly violating the EU GDPR’s cross-border data transfer limitations. Additionally, companies that transfer personal information to recipients outside of the EEA and/or UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Previous report

Compliance with applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms ensuring compliance with new data protection rules. Failure to comply with any such laws or regulations puts us at risk of facing significant fines and penalties that could adversely affect our business, financial condition, reputation, and results of our operations. Furthermore, conflicting requirements across applicable privacy and data security laws would complicate our compliance efforts and increase both legal risk and compliance costs for us and the third parties upon whom we rely.

Previous report

In addition to any applicable privacy and data security laws and regulations, we may be subject to industry standards adopted by industry groups or bound by other contractual obligations related to privacy and data security. We may publish privacy policies, marketing materials, and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials, or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to regulatory inquiries, regulatory enforcement actions, and other adverse consequences.

Previous report

Our obligations related to privacy and data security are quickly changing, becoming increasingly stringent, and creating regulatory uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent between jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources and may necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal information or other sensitive data on our behalf.