Bausch + Lomb Corporation (BLCO) Risk Analysis

In the United States and certain foreign jurisdictions, there have been a number of legislative and regulatory proposals to change the health care system in ways that could impact our ability to sell our products profitably. The Patient Protection and Affordable Care Act, as amended by the Health Care Reform Act (as defined below) may affect the operational results of companies in the pharmaceutical and medical device industries, including the Company and other health care related industries, by imposing on them additional costs. Effective January 1, 2010, the Health Care Reform Act increased the minimum Medicaid drug rebates for pharmaceutical companies, expanded the 340B drug discount program, and made changes to affect the Medicare Part D coverage gap, or "donut hole." The law also revised the definition of "average manufacturer price" for reporting purposes, which may affect the amount of our Medicaid drug rebates to states. Beginning in 2011, the law imposed a significant annual fee on companies that manufacture or import branded prescription drug products. More recently, the Bipartisan Budget Act of 2018 amended the Patient Protection and Affordable Care Act, effective January 1, 2019, to close the donut hole in most Medicare drug plans. In addition, in April 2018, the Centers for Medicare & Medicaid Services published a final rule that gives states greater flexibility in setting benchmarks for insurers in the individual and small group marketplaces, which may have the effect of relaxing the essential health benefits required under the Patient Protection and Affordable Care Act for plans sold through such marketplaces. Although efforts at replacing the Health Care Reform Act have stalled in Congress, there could still be changes to this legislation in the near term. We cannot predict what those changes will be or when they will take effect, and we could face additional risks arising from such changes or changed interpretations of our obligations under the legislation. Because of this continued uncertainty, including the potential for further legal challenges or repeal of that legislation, we cannot quantify or predict with any certainty the likely impact of the Health Care Reform Act or its repeal on our business model, prospects, financial condition or results of operations, in particular on the pricing, coverage or reimbursement of any of our product candidates that may receive marketing approval. Additionally, policy efforts designed specifically to reduce patient out-of-pocket costs for medicines could result in new mandatory rebates and discounts or other pricing restrictions. Legislative efforts relating to drug pricing, the cost of prescription drugs under Medicare, the relationship between pricing and manufacturer patient programs, and government program reimbursement methodologies for drugs have been proposed and considered at the U.S. federal and state level. At the federal level, the administration's budget proposal for fiscal year 2019 contained further drug price control measures that could be enacted in future legislation, including, for example, measures to permit Medicare Part D plans to negotiate the price of certain drugs under Medicare Part B, to allow some states to negotiate drug prices under Medicaid and to eliminate cost sharing for generic drugs for low-income patients. While any proposed measures will require authorization through additional legislation to become effective, Congress and the administration have each indicated an intent to continue to seek new legislative or administrative measures to control drug costs, such as the Inflation Reduction Act, which, among other things, enables the U.S. government to impose penalties if drug prices are increased at a rate faster than inflation. At the state level, legislatures have increasingly passed legislation and implemented regulations designed to control pharmaceutical product pricing, including price or patient reimbursement constraints, discounts, restrictions on certain product access and marketing cost disclosure and transparency measures, and, in some cases, designed to encourage importation from other countries and bulk purchasing. We also anticipate that Congress, state legislatures, and third-party payors may continue to review and assess alternative health care delivery and payment systems and may in the future propose and adopt legislation or policy changes or implementations effecting additional fundamental changes in the health care delivery system. We cannot provide assurance as to the ultimate content, timing, or effect of changes, nor is it possible at this time to estimate the impact of any such potential legislation. In 2019, the U.S. Health and Human Services Administration announced a preliminary plan to allow for the importation of certain lower-cost drugs from Canada. The preliminary plan excludes insulin, biological drugs, controlled substances and intravenous drugs. The preliminary plan relies on individual states to develop proposals for safe importation of those drugs from Canada and submit those proposals to the federal government for approval. Although the preliminary plan has some support from the current administration, at this time, studies to evaluate the related costs and benefits, evaluate the reasonableness of the logistics and measure the public reaction of such a plan have not been performed. While we do not believe this will have a significant impact on our future cash flows, we cannot provide assurance as to the ultimate content, timing, effect or impact of such a plan. In 2019, the Government of Canada (Health Canada) published in the Canada Gazette amendments to the pricing regulation for patented drugs. These regulations were scheduled to become effective on July 1, 2021, but were delayed until July 1, 2022. The new regulations, among other things, change the mechanics of establishing the pricing for products submitted for approval after August 21, 2019 and the number and composition of reference countries used to determine if a drug's price is excessive. While we do not believe this will have a significant impact on our future cash flows, as additional facts materialize, we cannot provide assurance as to the ultimate content, timing, effect or impact of such regulations. The Health Care Reform Act and further changes to health care laws or regulatory framework that reduce our revenues or increase our costs could also have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares and/or debt securities to decline.

Pharmaceutical and medical device companies have faced lawsuits and investigations pertaining to violations of health care "fraud and abuse" laws, such as the federal False Claims Act, the federal Anti-Kickback Statute ("AKS") and other state and federal laws and regulations. The AKS prohibits, among other things, knowingly and willfully offering, paying, soliciting or receiving remuneration to induce or in return for purchasing, leasing, ordering or arranging for the purchase, lease or order of any health care item or service reimbursable under federally financed health care programs. This statute has been interpreted to apply to arrangements between pharmaceutical or medical device manufacturers, on the one hand, and prescribers, purchasers, formulary managers and other health care related professionals, on the other hand. More generally, the federal False Claims Act, among other things, prohibits any person from knowingly presenting, or causing to be presented, a false claim for payment to the federal government. Pharmaceutical and medical device companies have been prosecuted or faced civil liability under these laws for a variety of alleged promotional and marketing activities, including engaging in off-label promotion that caused claims to be submitted for non-covered off-label uses. If we are in violation of any of these requirements or any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, this could have a significant impact on our business, including the imposition of significant criminal and civil fines and penalties, exclusion from federal health care programs or other sanctions, including consent orders or corporate integrity agreements. In addition, the U.S. Department of Health and Human Services Office of Inspector General recommends, and increasingly states require pharmaceutical companies to have comprehensive compliance programs. Moreover, the Physician Payment Sunshine Act enacted in 2010 imposes reporting and disclosure requirements on device and drug manufacturers for any "transfer of value" made or distributed to prescribers and other health care providers. Failure to submit this required information may result in significant civil monetary penalties. While we have developed corporate compliance programs based on what we believe to be current best practices, we cannot provide assurance that we or our employees or agents are or will be in compliance with all applicable federal, state or foreign regulations and laws. If we are in violation of any of these requirements or any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, including the imposition of significant criminal and civil fines and penalties, exclusion from federal health care programs or other sanctions, including consent orders or corporate integrity agreements. The U.S. FCPA, the Canadian Corruption of Foreign Public Officials Act and similar worldwide anti- bribery laws generally prohibit companies and their intermediaries from making improper payments to officials for the purpose of obtaining or retaining business. Our policies mandate compliance with these anti-bribery laws. We operate in many parts of the world that have experienced governmental corruption and in certain circumstances, strict compliance with anti-bribery laws may conflict with local customs and practices or may require us to interact with doctors and hospitals, some of which may be state controlled, in a manner that is different than in the United States and Canada. We cannot provide assurance that our internal control policies and procedures will protect us from reckless or criminal acts committed by our employees, consultants, distributors, third party contractors or agents. Violations of these laws, or allegations of such violations, could disrupt our business and result in criminal or civil penalties or remedial measures, any of which could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares and/or debt securities to decline. We are also subject to various state, federal and international laws and regulations governing the collection, transmission, dissemination, use, privacy, confidentiality, security, retention, availability, integrity and other processing of health-related and other sensitive and personal information, including the HIPAA. Many states in which we operate have laws that protect the privacy and security of sensitive and personal information, including health-related information. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which may complicate compliance efforts. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act ("CPRA," and collectively, "CCPA") imposes stringent data privacy and security requirements and obligations with respect to the personal information of California residents and provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal data that may increase the likelihood of, and risks associated with, data breach litigation. The effects on our business of the CCPA and other similar state laws are potentially significant. State laws are changing rapidly and there is discussion in Congress of a new federal data protection and privacy law to which we may be subject. For instance, the CPRA maintains the core framework of the CCPA while also making a number of substantive changes. Since these data security regimes are evolving, uncertain and complex, especially for a global business such as ours, we will need to update or enhance our compliance measures from time to time and these updates or enhancements will require further implementation costs. Any failure, or perceived failure, by us to comply with current and future regulatory or customer-driven privacy, data protection, and information security requirements, or to prevent or mitigate security breaches, cyber- attacks, or improper access to, use of, or disclosure of data, or any security issues or cyber-attacks affecting our business, could result in significant liability, costs (including the costs of mitigation and recovery), a material loss of revenue resulting from the adverse impact on its reputation and brand, loss of proprietary information and data, disruption to its business and relationships, and diminished ability to retain or attract customers and business partners. Such events may result in governmental enforcement actions and prosecutions, private litigation, fines and penalties or adverse publicity, and could cause customers and business partners to lose trust in us, which could have an adverse effect on our reputation and business. Internationally, laws and regulations in many jurisdictions apply broadly to the collection, transmission, dissemination, use, privacy, confidentiality, security, retention, availability, integrity and other processing of health-related and other sensitive and personal information. For example, the EU's General Data Protection Regulation ("GDPR"), and the UK's General Data Protection Regulation ("UK GDPR") together with national legislation, regulations and guidelines of the EU member states and the UK governing the processing of personal data, impose strict obligations and restrictions on the ability to collect, analyze, store, transfer and otherwise process personal data, including health data from clinical trials and adverse event reporting. The GDPR authorizes fines for certain violations of up to 4% of global annual revenue or €20 million (or GBP 17.5 million under the UK GDPR), whichever is greater. European data protection authorities may interpret the GDPR and national laws differently and impose additional requirements, which contributes to the complexity of processing personal data in or from the European Economic Area or UK. Guidance on implementation and compliance practices is often updated or otherwise revised. These laws require data controllers to implement stringent operational requirements, including, for example, transparent and expanded disclosure to data subjects about how their personal data is collected and processed, grant rights for data subjects to access, delete or object to the processing of their data, mandatory data breach notification requirements (and in certain cases, affected individuals), set limitations on retention of information and outline significant documentary requirements to demonstrate compliance through policies, procedures, training and audits. The GDPR also provides that EU member states may introduce further conditions, including limitations, and make their own laws and regulations, further limiting the processing of ‘special categories of personal data,' including personal data related to health, biometric data used for unique identification purposes and genetic information, which could limit our ability to collect, use and share EU data, and could cause our compliance costs to increase, ultimately having an adverse impact on our business, and harm our business and financial condition. The withdrawal of the UK from the European Union also has created uncertainty with regard to the regulation of data protection in the UK. Since January 1, 2021, when the transitional period following Brexit expired, we have been required to comply with the GDPR as well as the UK GDPR (combining the GDPR and the UK's Data Protection Act of 2018), which exposes us to two parallel regimes, each of which authorizes similar fines and may subject us to increased compliance risk based on differing, and potentially inconsistent or conflicting, interpretation and enforcement by regulators and authorities (particularly, if the laws are amended in the future in divergent ways). With respect to transfers of personal data from the EEA, on June 28, 2021, the European Commission issued an adequacy decision in respect of the UK's data protection framework, enabling data transfers from EU member states to the UK to continue without requiring organizations to put in place contractual or other measures in order to lawfully transfer personal data between the territories. While it is intended to last for at least four years, the European Commission may unilaterally revoke the adequacy decision at any point, and if this occurs, it could lead to additional costs and increase our overall risk exposure. We are also subject to Canada's federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and substantially similar equivalents at the provincial level with respect to the collection, use and disclosure of personal information in Canada. Such federal and provincial legislation impose data privacy and security obligations on our processing of personal information of Canadian residents. The federal, Quebec and Alberta legislation include mandatory data breach notification requirements. Canada's Anti-Spam Legislation ("CASL") also applies to the extent that we send commercial electronic messages from Canada or to electronic addresses in Canada. CASL contains prescriptive consent, form, content and unsubscribe mechanism requirements. Penalties for non-compliance with CASL are up to CAD $10 million per violation. These laws and regulations may be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible they will be interpreted and applied in ways that will materially and adversely affect our business. The regulatory framework for data privacy, data security and data transfers worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. Complying with all of these laws and regulations involves costs to our business, and failure to comply with these laws and regulations can result in the imposition of significant civil and criminal penalties, as well as litigation, all of which could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares and/or debt securities to decline. We are also subject to U.S. federal laws regarding reporting and payment obligations with respect to our participation in federal health care programs, including Medicare and Medicaid. Because our processes for calculating applicable government prices and the judgments involved in making these calculations involve subjective decisions and complex methodologies, these calculations are subject to risk of errors and differing interpretations. In addition, they are subject to review and challenge by the applicable governmental agencies, and it is possible that such reviews could result in changes that could have material adverse legal, regulatory, or economic consequences.

The marketing, promotional and business practices of pharmaceutical and medical device companies, as well as the manner in which companies' in-house or third-party sales forces interact with purchasers, prescribers and patients, are subject to extensive regulation, enforcement of which may result in the imposition of civil, regulatory and/or criminal penalties, injunctions and/or limitations on marketing practice for some of our products and/or pricing restrictions or mandated price reductions for some of our products. Many companies, including us, have been the subject of claims related to these practices asserted by federal authorities. These claims have resulted in fines and other consequences, such as entering into corporate integrity agreements with the U.S. government. Companies may not promote drugs or devices for "off-label" uses-that is, uses that are not described in the product's labeling and that differ from those approved by the FDA, Health Canada, EMA or other applicable regulatory agencies. A company that is found to have improperly promoted off-label uses may be subject to significant liability, including civil and administrative remedies (such as entering into corporate integrity agreements with the U.S. government), as well as criminal sanctions. In addition, management's attention could be diverted from our business operations and our reputation could be damaged.

For certain of our products, we are, and may in the future be, subject to certain restrictions that limit our ability to increase or make changes to the pricing of those products. These restrictions or limitations are or may be imposed contractually (such as through our contracts with group purchasing organizations or others), through legislation (such as the new Inflation Reduction Act, which, among other things, requires manufacturers to pay rebates to Medicare if prices increase faster than inflation for products used by Medicare beneficiaries) or through decisions or commitments we decide to make ourselves (such as through the pricing committees we have established or may establish for certain of our businesses). At this time, we cannot predict what pricing changes we will make (or be required to make) nor can we predict what other changes in our business practices we may implement with respect to pricing. We also cannot predict the impact such pricing decisions or changes will or would have on our business. However, any such changes could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares and/or debt securities to decline. For example, any pricing changes and programs could affect the average realized prices for our products and may have a significant impact on our revenue trends. In addition, limiting or eliminating price increases on certain of our products will result in fewer or lower price appreciation credits from certain of our wholesalers. Price appreciation credits are generated when we increase a product's wholesaler acquisition cost ("WAC") under our contracts with certain wholesalers. Under such contracts, we are entitled to credits from such wholesalers for the impact of that WAC increase on inventory currently on hand at the wholesalers. In wholesaler contracts, such credits, which can be significant, are offset against the total distribution service fees we pay on all of our products to each wholesaler. As a result, to the extent we decide to cease or limit price increases, we will have fewer or lower price appreciation credits to use to offset against our distribution fees owing to these wholesalers. In addition, under certain of our agreements with our wholesaler customers, we have price protection or price depreciation provisions, pursuant to which we have agreed to adjust the value of any on-hand or in-transit inventory with such customers in the event we reduce the price of any of our products. As a result, to the extent we reduce the WAC price for any of our products, we may owe a payment to such customers (or such customers may earn a credit to be offset against any amounts owing to us) equal to the amount of such inventory multiplied by the difference between the price at which they acquired the product inventory and the new reduced price.

The manufacturing, formulation, packaging, labeling and advertising of the Company's dietary supplement products are also subject to regulation by certain federal, state and foreign agencies, including the FDA, the Federal Trade Commission (the "FTC"), and the Consumer Product Safety Commission, in the U.S., and by Health Canada in Canada. The FDA has authority in the U.S. over the adulteration or misbranding of dietary supplements. There are requirements relating to ingredient safety, new dietary ingredient notifications, labeling, claims notifications, and adverse event reporting among other requirements. While we believe our products comply with those requirements, the FDA may challenge positions we have taken with respect to the formulation or labeling of a dietary supplement product or the claims we make with respect to such products. We are also subject to risks relating to evolving regulations of dietary supplement products, including our eye vitamins and mineral supplements, as the FDA and other applicable agencies have in the past and may in the future consider additional or more stringent regulations of dietary supplements and other products. Such developments could require reformulation of certain of our products to meet new standards, additional record-keeping obligations, increased documentation of the properties of certain products, additional or different labeling, additional scientific substantiation, adverse event reporting or similar obligations, amended or different promotional claims and materials, or could result in recalls or the discontinuance of certain of our products that are not able to be reformulated. Any such developments could increase our costs significantly. In addition, the FDA also has comprehensive regulations for cGMP for those who manufacture, package or hold dietary supplement products. These regulations focus on practices that ensure the identity, purity, quality, strength and composition of dietary supplements manufacture. We or our contract manufacturers may not be able to comply with such regulations without incurring additional expenses, which could be significant.