Apellis Pharmaceuticals (APLS) Risk Factors

Regulatory authorities in some jurisdictions, including the United States and Europe, may designate drugs for relatively small patient populations as orphan drugs. Under the Orphan Drug Act, the FDA may designate a product as an orphan drug if it is a drug intended to treat a rare disease or condition, which is generally defined as a patient population of fewer than 200,000 individuals annually in the United States. The FDA has granted orphan drug designation to pegcetacoplan for the treatment of PNH and for the treatment of C3 glomerulopathy. We, or our collaborators, may seek orphan drug designations for pegcetacoplan for other indications and for other product candidates and may be unable to obtain such designations. Even if we, or our collaborators, obtain orphan drug designation for a product candidate, such as is the case for pegcetacoplan for the treatment of PNH, we, or they, may not be able to obtain orphan drug exclusivity for that product candidate. Generally, a product with orphan drug designation only becomes entitled to orphan drug exclusivity if it receives the first marketing approval for the indication for which it has such designation, in which case the FDA or the EMA will be precluded from approving another marketing application for the same drug for that indication for the applicable exclusivity period. The applicable exclusivity period is seven years in the United States and ten years in Europe. The European exclusivity period can be reduced to six years if a drug no longer meets the criteria for orphan drug designation or if the drug is sufficiently profitable so that market exclusivity is no longer justified. Orphan drug exclusivity may be lost if the FDA or the EMA determines that the request for designation was materially defective or if the manufacturer is unable to assure sufficient quantity of the drug to meet the needs of patients with the rare disease or condition. Even if we, or our collaborators, obtain orphan drug exclusivity for a product, that exclusivity may not effectively protect the product from competition because different drugs can be approved for the same condition. Even after an orphan drug is approved, the FDA can subsequently approve the same drug for the same condition if the FDA concludes that the later drug is clinically superior in that it is shown to be safer, more effective or makes a major contribution to patient care. The FDA and Congress may further reevaluate the Orphan Drug Act and its regulations and policies. This may be particularly true in light of a decision from the Court of Appeals for the 11th Circuit in September 2021 finding that, for the purpose of determining the scope of exclusivity, the term "same disease or condition" means the designated "rare disease or condition" and could not be interpreted by the FDA to mean the "indication or use." Thus, the court concluded, orphan drug exclusivity applies to the entire designated disease or condition rather than the "indication or use." Although there have been legislative proposals to overrule this decision, they have not been enacted into law. On January 23, 2023, the FDA announced that, in matters beyond the scope of that court order, the FDA will continue to apply its existing regulations tying orphan-drug exclusivity to the uses or indications for which the orphan drug was approved. We do not know if, when, or how the FDA may change the orphan drug regulations and policies in the future, and it is uncertain how any changes might affect our business. Depending on what changes the FDA may make to its orphan drug regulations and policies, our business could be adversely impacted.

Periodic maintenance fees, renewal fees, annuity fees and various other governmental fees on patents and applications are required to be paid to the USPTO and various governmental patent agencies outside of the United States in several stages over the lifetime of the patents and applications. The USPTO and various non-U.S. governmental patent agencies require compliance with a number of procedural, documentary, fee payment and other similar provisions during the patent application process and after a patent has issued. While an inadvertent lapse can in many cases be cured by payment of a late fee or by other means in accordance with the applicable rules, there are situations in which non-compliance can result in abandonment or lapse of the patent or patent application, resulting in partial or complete loss of patent rights in the relevant jurisdiction. Non-compliance events that could result in abandonment or lapse of a patent or patent application include, but are not limited to, the failure to respond to official actions within prescribed time limits, non-payment of fees and failure to properly legalize and submit formal documents. If we fail to maintain the patents and patent applications covering our products and product candidates, our competitive position would be adversely affected.

If any of our product candidates are approved and we are found to have improperly promoted off-label uses of those products, we may become subject to significant liability. The FDA, EMA and other regulatory authorities strictly regulate the promotional claims that may be made about prescription products, such as our product candidates, if approved. In particular, a product may not be promoted in the United States for uses that are not approved by the FDA as reflected in the product's approved labelling, or in other jurisdictions for uses that differ from the labelling or uses approved by the applicable regulatory authorities. While physicians may prescribe products for off-label uses, the FDA, EMA and other regulatory authorities actively enforce laws and regulations that prohibit the promotion of off-label uses by companies, including promotional communications made by companies' sales force with respect to off-label uses that are not consistent with the approved labelling, and a company that is found to have improperly promoted off-label uses may be subject to significant civil, criminal and administrative penalties. Notwithstanding the regulatory restrictions on off-label promotion, the FDA and other regulatory authorities allow companies to engage in truthful, non-misleading, and non-promotional scientific communications concerning their products in certain circumstances. For example, in October 2023, the FDA published draft guidance outlining the agency's non-binding policies governing the distribution of scientific information on unapproved uses to healthcare providers. This draft guidance calls for such communications to be truthful, non-misleading, factual, and unbiased and include all information necessary for healthcare providers to interpret the strengths and weaknesses and validity and utility of the information about the unapproved use. In addition, under some relatively recent guidance from the FDA and the Pre-Approval Information Exchange Act, or PIE Act, signed into law as part of the Consolidated Appropriations Act of 2023, companies may also promote information that is consistent with the prescribing information and proactively speak to formulary committee members of payors regarding data for an unapproved drug or unapproved uses of an approved drug. We may engage in these discussions and communicate with healthcare providers, payors and other constituencies in compliance with all applicable laws, regulatory guidance and industry best practices. We will need to carefully navigate the FDA's various regulations, guidance and policies, along with recently enacted legislation, to ensure compliance with restrictions governing promotion of our products. If we are found to have promoted such off-label uses, we may become subject to significant liability. The federal government has levied large civil and criminal fines against companies for alleged improper promotion of off-label use and has enjoined several companies from engaging in off-label promotion. The FDA has also requested that companies enter into consent decrees or permanent injunctions under which specified promotional conduct is changed or curtailed. If we cannot successfully manage the promotion of our product candidates, if approved, we could become subject to significant liability, which would materially adversely affect our business and financial condition.

We face an inherent risk of product liability claims as a result of the commercial sale of EMPAVELI and SYFOVRE, and the clinical testing of our product candidates despite obtaining appropriate informed consents from our clinical trial participants. For example, we may be sued if any product we develop allegedly causes injury or is found to be otherwise unsuitable during clinical testing, manufacturing, marketing or sale. Any such product liability claims may include allegations of defects in manufacturing, defects in design, a failure to warn of dangers inherent in the product, negligence, strict liability or a breach of warranties. Claims could also be asserted under state consumer protection acts. If we cannot successfully defend ourselves against product liability claims, we may incur substantial liabilities or be required to limit commercialization of our product candidates. Regardless of the merits or eventual outcome, liability claims may result in: - decreased demand for EMPAVELI, SYFOVRE, and any other product candidates that we may develop;- injury to our reputation and significant negative media attention;- withdrawal of clinical trial participants;- significant costs to defend resulting litigation;- substantial monetary awards to trial participants or patients;- loss of revenue;- reduced resources of our management to pursue our business strategy; and - the inability to successfully commercialize EMPAVELI, SYFOVRE, or any other products that we may develop. Although we maintain product liability and clinical trial insurance coverage in the amount of up to $50.0 million in the aggregate, this insurance may not fully cover potential liabilities that we may incur. The cost of any litigation or other proceeding, even if resolved in our favor, could be substantial. We may need to increase our insurance coverage as we continue to commercialize EMPAVELI, SYFOVRE, and commercialize any other product candidate that receives marketing approval. In addition, insurance coverage is becoming increasingly expensive. If we are unable to maintain sufficient insurance coverage at an acceptable cost or to otherwise protect against potential product liability claims, it could prevent or inhibit the development and commercial production and sale of EMPAVELI, SYFOVRE, and our other product candidates, which could harm our business, financial condition, results of operations and prospects.

We operate through various subsidiaries in a number of countries throughout the world. Consequently, we are subject to tax laws, treaties, and regulations in the countries in which we operate, and these laws and treaties are subject to interpretation. We have taken, and will continue to take, tax positions based on our interpretation of such tax laws. Our transfer pricing arrangements are not generally binding on applicable tax authorities. The price charged for products, services, or the royalty rates and other amounts paid for intellectual property rights, could be challenged by the various tax authorities, resulting in additional tax liability, interest, and/or penalties. There can be no assurance that a taxing authority will not have a different interpretation of applicable law and assess us with additional taxes. If we are assessed with additional taxes, this may result in a material adverse effect on our results of operations and/or financial condition.

We are subject to data privacy and protection laws and regulations that apply to the collection, transmission, storage and use of personally-identifying information, which among other things, impose certain requirements relating to the privacy, security and transmission of personal information, including comprehensive regulatory systems in the United States, European Union and United Kingdom The legislative and regulatory landscape for privacy and data protection continues to evolve in jurisdictions worldwide, and there has been an increasing focus on privacy and data protection issues with the potential to affect our business. Failure to comply with any of these laws and regulations could result in enforcement action against us, including fines, claims for damages by affected individuals, damage to our reputation and loss of goodwill, any of which could have a material adverse effect on our business, financial condition, results of operations or prospects. There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information. In particular, regulations promulgated pursuant to HIPAA establish privacy and security standards that limit the use and disclosure of individually identifiable health information, or protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information. Determining whether protected health information has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation. These obligations may be applicable to some or all of our business activities now or in the future. If we are unable to properly protect the privacy and security of protected health information, we could be found to have breached our contracts. Further, if we fail to comply with applicable privacy laws, including applicable HIPAA privacy and security standards, we could face civil and criminal penalties. HHS enforcement activity can result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal resources. In addition, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. We cannot be sure how these regulations will be interpreted, enforced or applied to our operations. In addition to the risks associated with enforcement activities and potential contractual liabilities, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to our policies, procedures and systems. In 2018, California passed into law the California Consumer Privacy Act, or the CCPA, which took effect on January 1, 2020 and imposed many requirements on businesses that process the personal information of California residents. Many of the CCPA's requirements are similar to those found in the General Data Protection Regulation, or GDPR, including requiring businesses to provide notice to data subjects regarding the information collected about them and how such information is used and shared, and providing data subjects the right to request access to such personal information and, in certain cases, request the erasure of such personal information. The CCPA also affords California residents the right to opt-out of "sales" of their personal information. The CCPA contains significant penalties for companies that violate its requirements. In November 2020, California voters passed a ballot initiative for the California Privacy Rights Act, or the CPRA, which went into effect on January 1, 2023 and significantly expanded the CCPA to incorporate additional GDPR-like provisions including requiring that the use, retention, and sharing of personal information of California residents be reasonably necessary and proportionate to the purposes of collection or processing, granting additional protections for sensitive personal information, and requiring greater disclosures related to notice to residents regarding retention of information. The CPRA also created a new enforcement agency – the California Privacy Protection Agency – whose sole responsibility is to enforce the CPRA, which will further increase compliance risk. The provisions in the CPRA may apply to some of our business activities. In addition to California, at least eleven other states have passed comprehensive privacy laws similar to the CCPA and CPRA. These laws are either in effect or will go into effect sometime before the end of 2026. Like the CCPA and CPRA, these laws create obligations related to the processing of personal information, as well as special obligations for the processing of "sensitive" data, which includes health data in some cases. Some of the provisions of these laws may apply to our business activities. There are also states that are strongly considering or have already passed comprehensive privacy laws during the 2023 legislative sessions that will go into effect in 2024 and beyond, including New Hampshire and New Jersey. Other states will be considering similar laws in the future, and Congress has also been debating passing a federal privacy law. There are also states that are specifically regulating health information that may affect our business. For example, Washington state passed a health privacy law in 2023 that will regulate the collection and sharing of health information, and the law also has a private right of action, which further increases the relevant compliance risk. Connecticut and Nevada have also passed similar laws regulating consumer health data and additional states are considering such legislation for 2024. These laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products. Similar to the laws in the United States, there are significant privacy and data security laws that apply in Europe and other countries. The collection, use, disclosure, transfer, or other processing of personal data, including personal health data, regarding individuals who are located in the EEA, and the processing of personal data that takes place in the EEA, is regulated by the GDPR, which went into effect in May 2018 and which imposes obligations on companies that operate in our industry with respect to the processing of personal data and the cross-border transfer of such data. The GDPR imposes onerous accountability obligations requiring data controllers and processors to maintain a record of their data processing and policies. If our or our partners' or service providers' privacy or data security measures fail to comply with the GDPR requirements, we may be subject to litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data and/or fines of up to 20 million Euros or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, as well as compensation claims by affected individuals, negative publicity, reputational harm and a potential loss of business and goodwill. The GDPR places restrictions on the cross-border transfer of personal data from the European Union to countries that have not been found by the EC to offer adequate data protection legislation, such as the United States. There are ongoing concerns about the ability of companies to transfer personal data from the EU to other countries. In July 2020, the Court of Justice of the European Union, or the CJEU, invalidated the EU-U.S. Privacy Shield, one of the mechanisms used to legitimize the transfer of personal data from the EEA to the U.S. The CJEU decision also drew into question the long-term viability of an alternative means of data transfer, the standard contractual clauses, for transfers of personal data from the EEA to the U.S. While we were not self-certified under the Privacy Shield, this CJEU decision may lead to increased scrutiny on data transfers from the EEA to the U.S. generally and increase our costs of compliance with data privacy legislation as well as our costs of negotiating appropriate privacy and security agreements with our vendors and business partners. In October 2022, President Biden signed an executive order to implement the EU-U.S. Data Privacy Framework, which serves as a replacement to the EU-U.S. Privacy Shield. The European Commission adopted the adequacy decision on July 10, 2023. The adequacy decision permits U.S. companies who self-certify to the EU-U.S. Data Privacy Framework to rely on it as a valid data transfer mechanism for data transfers from the European Union to the United States. However, some privacy advocacy groups have already suggested that they will be challenging the EU-U.S. Data Privacy Framework. If these challenges are successful, they may not only impact the EU-U.S. Data Privacy Framework, but also further limit the viability of the standard contractual clauses and other data transfer mechanisms. The uncertainty around this issue has the potential to impact our business. Furthermore, while the Data Protection Act of 2018 in the United Kingdom that "implements" and complements the EU's GDPR has achieved Royal Assent on May 23, 2018 and is now effective in the United Kingdom, it is still unclear whether transfer of data from the EEA to the United Kingdom will remain lawful under GDPR. The Trade and Cooperation Agreement provides for a transitional period during which the United Kingdom will be treated like a European Union member state in relation to processing and transfers of personal data for four months from January 1, 2021. This may be extended by two further months. After such period, the United Kingdom will be a "third country" under the GDPR unless the European Commission adopts an adequacy decision in respect of transfers of personal data to the United Kingdom. The United Kingdom has already determined that it considers all of the EU 27 and EEA member states to be adequate for the purposes of data protection, ensuring that data flows from the United Kingdom to the EU/EEA remain unaffected. Beyond GDPR, there are privacy and data security laws in a growing number of countries around the world. While many loosely follow GDPR as a model, other laws contain different or conflicting provisions. These laws will impact our ability to conduct our business activities, including both our clinical trials and the sale and distribution of commercial products, through increased compliance costs, costs associated with contracting and potential enforcement actions. While we continue to address the implications of the recent changes to data privacy regulations, data privacy remains an evolving landscape at both the domestic and international level, with new regulations coming into effect and continued legal challenges, and our efforts to comply with the evolving data protection rules may be unsuccessful. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our practices. We must devote significant resources to understanding and complying with this changing landscape. Failure to comply with laws regarding data protection would expose us to risk of enforcement actions taken by data protection authorities in the EEA and elsewhere and carries with it the potential for significant penalties if we are found to be non-compliant. Similarly, failure to comply with federal and state laws in the U.S. regarding privacy and security of personal information could expose us to penalties under such laws. Any such failure to comply with data protection and privacy laws could result in government-imposed fines or orders requiring that we change our practices, claims for damages or other liabilities, regulatory investigations and enforcement action, litigation and significant costs for remediation, any of which could adversely affect our business. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our business, financial condition, results of operations or prospects.

We are exposed to the risk that our employees, independent contractors, consultants, collaborators and contract research organizations may engage in fraud or other misconduct, including intentional failures to comply with FDA regulations or similar regulations of comparable non-U.S. regulatory authorities, to provide accurate information to the FDA or comparable non-U.S. regulatory authorities, to comply with manufacturing standards we have established, to comply with federal and state healthcare fraud and abuse laws and regulations and similar laws and regulations established and enforced by comparable non-U.S. regulatory authorities, to report financial information or data accurately or to disclose unauthorized activities to us. Such misconduct could also involve the improper use of information obtained in the course of clinical trials, which could result in regulatory sanctions and serious harm to our reputation. It is not always possible to identify and deter misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to be in compliance with such laws, standards or regulations. These risks may be particularly acute given the rapid growth in the size of our company. If any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business and results of operations, including the imposition of significant criminal, civil and administrative sanctions including monetary penalties, damages, fines, disgorgement, individual imprisonment, and exclusion from participation in government funded healthcare programs, such as Medicare and Medicaid, additional reporting requirements and oversight if we become subject to a corporate integrity agreement or similar agreement to resolve allegations of non-compliance with these laws, reputational harm, and we may be required to curtail or restructure our operations.

It may be necessary for us to use the patented or proprietary technology of third parties to commercialize our products, in which case we would be required to obtain a license from these third parties. If we are unable to license such technology, or if we are forced to license such technology on unfavorable terms, our business could be materially harmed. If we are unable to obtain a necessary license, we may be unable to develop or commercialize the affected products or product candidates, which could materially harm our business and the third parties owning such intellectual property rights could seek either an injunction prohibiting our sales, or, with respect to our sales, an obligation on our part to pay royalties and/or other forms of compensation. Even if we are able to obtain a license, it may be non-exclusive, which could enable our competitors to obtain access to the same technologies licensed to us. If we fail to comply with our obligations under license agreements, our counterparties may have the right to terminate these agreements, in which event we might not be able to develop, manufacture or market, or may be forced to cease developing, manufacturing or marketing, any product that is covered by these agreements or may face other penalties under such agreements. Such an occurrence could materially adversely affect the value of the product or product candidate being developed under any such agreement. Termination of these agreements or reduction or elimination of our rights under these agreements may result in our having to negotiate new or reinstated agreements with less favorable terms, cause us to lose our rights under these agreements, including our rights to important intellectual property or technology, or impede, delay or prohibit the further development or commercialization of one or more product candidates that rely on such agreements.

Once marketing approval has been granted, an approved product and its manufacturer and marketer are subject to ongoing review and extensive regulation. We, and our collaborators, must therefore comply with requirements concerning advertising and promotion for any of our product candidates which we or they market. Promotional communications with respect to prescription drugs are subject to a variety of legal and regulatory restrictions and must be consistent with the information in the product's approved labeling. Thus, we and our collaborators will not be able to promote any products we develop for indications or uses for which they are not approved. We are limited to promoting EMPAVELI and SYFOVRE in accordance with their approved label in each jurisdiction and may not promote them for any indication other than as stated on the label. The label for Aspaveli in the European Union is more limited than the label for EMPAVELI in the United States.