Inhibrx Biosciences Inc (INBX) Risk Analysis

Our restated certificate of incorporation, restated bylaws and Delaware law contain provisions which could have the effect of rendering more difficult, delaying or preventing an acquisition deemed undesirable by our board of directors. Our corporate governance documents include provisions: - authorizing our board of directors to issue up to 15,000,000 shares of preferred stock without stockholder approval upon the terms and conditions and with the rights, privileges and preferences as our board of directors may determine;- specifying that special meetings of our stockholders can be called only by our board of directors, the chairman of our board of directors or our Chief Executive Officer and that our stockholders may not act by written consent;- establishing an advance notice procedure for stockholder proposals to be brought before an annual meeting of our stockholders, including proposed nominations of persons for election to our board of directors;- providing that our board of directors may create new directorships and that vacancies on our board of directors may be filled only by a majority of directors then in office, even though less than a quorum;- establishing that our board of directors is divided into three classes-Class I, Class II, and Class III-with each class serving staggered three-year terms;- providing that our board of directors may amend our restated bylaws without stockholder approval; and - requiring a super-majority of votes to amend certain of the above-mentioned provisions. These provisions, alone or together, could delay or prevent hostile takeovers and changes in control or changes in our management. As a Delaware corporation, we are also subject to provisions of Delaware law, including Section 203 of the Delaware General Corporation law, which prevents some stockholders holding more than 15% of our outstanding common stock from engaging in certain business combinations without approval of the holders of substantially all of our outstanding common stock. Any provision of our amended and restated certificate of incorporation, amended and restated bylaws or Delaware law that has the effect of delaying or deterring a change in control could limit the opportunity for our stockholders to receive a premium for their shares of our common stock, and could also affect the price that some investors are willing to pay for our common stock.

Except as may occur in connection with the Merger and spin-out transaction, we currently anticipate that we will retain future earnings for the development, operation and expansion of our business and do not anticipate declaring or paying any cash dividends for the foreseeable future. The Amended 2020 Loan Agreement requires, and future debt financing agreements may require us to have the lender's permission before declaring dividends on our common stock. Any return to stockholders will therefore be limited to the appreciation of their stock.

As a public company, we incur significant legal, accounting and other expenses that we did not incur as a private company. We are subject to the reporting requirements of the Exchange Act, which require, among other things, that we file with the SEC annual, quarterly and current reports with respect to our business and financial condition. In addition, the Sarbanes-Oxley Act of 2002, or the Sarbanes-Oxley Act, as well as rules subsequently adopted by the SEC and Nasdaq Stock Market to implement provisions of the Sarbanes-Oxley impose significant requirements on public companies, including requiring establishment and maintenance of effective disclosure and financial controls and changes in corporate governance practices. Further, in July 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act, or the Dodd-Frank Act, was enacted. There are significant corporate governance and executive compensation-related provisions in the Dodd-Frank Act that require the SEC to adopt additional rules and regulations in these areas such as "say on pay" and proxy access. Stockholder activism, the current political environment and the current high level of government intervention and regulatory reform may lead to substantial new regulations and disclosure obligations, which may lead to additional compliance costs and impact the manner in which we operate our business in ways we cannot currently anticipate. We expect the rules and regulations applicable to public companies to substantially increase our legal and financial compliance costs and to make some activities more time-consuming and costly. If these requirements divert the attention of our management and personnel from other business concerns, they could have a material adverse effect on our business, financial condition and results of operations. The increased costs will decrease our net income or increase our net loss, and may require us to reduce costs in other areas of our business or increase the prices of our products or services. We cannot predict or estimate the amount or timing of additional costs we may incur to respond to these requirements. The impact of these requirements could also make it more difficult for us to attract and retain qualified persons to serve on our board of directors, our board committees or as executive officers.

We are subject to export control and import laws and regulations, including the U.S. Export Administration Regulations, U.S. Customs regulations, various economic and trade sanctions regulations administered by the U.S. Treasury Department's Office of Foreign Assets Controls, the U.S. Foreign Corrupt Practices Act of 1977, as amended, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act, and other state and national anti-bribery and anti-money laundering laws in the countries in which we conduct activities. Anti-corruption laws are interpreted broadly and prohibit companies and their employees, agents, contractors, and other collaborators from authorizing, promising, offering, or providing, directly or indirectly, improper payments or anything else of value to recipients in the public or private sector. We may engage third parties to sell our products sell our products outside the United States, to conduct clinical trials, and/or to obtain necessary permits, licenses, patent registrations, and other marketing approvals. We have direct or indirect interactions with officials and employees of government agencies or government-affiliated hospitals, universities, and other organizations. We can be held liable for the corrupt or other illegal activities of our employees, agents, contractors, and other collaborators, even if we do not explicitly authorize or have actual knowledge of such activities. Any violations of the laws and regulations described above may result in substantial civil and criminal fines and penalties, imprisonment, the loss of export or import privileges, debarment, tax reassessments, breach of contract and fraud litigation, reputational harm, and other consequences.

We are exposed to significant product liability risks inherent in the development, testing, manufacturing and marketing of biotechnology treatments of any therapeutic candidates for which we or our collaborators may conduct clinical trials. Product liability claims could delay or prevent completion of our development programs. If we succeed in marketing any approved products, these claims could result in an FDA investigation of the safety and effectiveness of our future commercial products, our manufacturing processes and facilities (or the manufacturing processes and facilities of our third-party manufacturers) or our marketing programs, a recall of our products or more serious enforcement action, limitations on the approved indications for which the product may be used or suspension or withdrawal of approvals. Regardless of the merits or eventual outcome, liability claims may also result in decreased demand for our products, injury to our reputation, costs to defend the related litigation, a diversion of management's time and our resources, substantial monetary awards to clinical trial participants or patients and a decline in our stock price. Any insurance we have or may obtain may not provide sufficient coverage against potential liabilities. Furthermore, clinical trial and product liability insurance is becoming increasingly expensive. As a result, we may be unable to obtain sufficient insurance at a reasonable cost to protect us against losses caused by potential product liability claims that could have a material and adverse effect on our business, financial condition, results of operations and prospects.

The regulatory environment surrounding information security, data collection and privacy is increasingly demanding. We are subject to numerous U.S. federal and state laws and non-U.S. regulations, including in Europe and China, governing the protection of personal and confidential information of our clinical subjects, clinical investigators, employees and vendors/business contacts, including in relation to medical records, credit card data and financial information. In the United States, numerous federal and state laws and regulations, including federal health information privacy laws, state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act and CCPA), that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators, and the privacy regulatory area is in constant flux. The state of California, for example, has adopted the CCPA, which went into effect beginning in January 2020. The CCPA establishes a new privacy framework for covered businesses by creating an expanded definition of personal information, establishing new data privacy rights for residents of the State of California, imposing special rules on the collection of personal information from minors, and creating a new and potentially severe statutory damages framework for violations of the CCPA and for businesses that fail to implement reasonable security procedures and practices to prevent data breaches. While there is currently an exception under CCPA for protected health information that is subject to HIPAA and clinical trial regulations, CCPA still applies to the personal information of employees and may otherwise impact our business. In November of 2020, California voters approved the CPRA, which took full effect on January 1, 2023. The CPRA amends the CCPA significantly, potentially resulting in further uncertainty, additional costs and expenses in an effort to comply, and additional harm and liability for failure to comply. Among other things, the CPRA established a new regulatory authority, the California Privacy Protection Agency, or CPPA, which has expanded enforcement authority. Further, the CPPA has introduced significant draft regulations under the CPRA which could have operational effects on our business and further uncertainty with respect to enforcement. Comprehensive privacy laws similar to the CCPA in Virginia, Colorado, Connecticut, and Utah all took effect in 2023, and laws in Montana, Oregon and Texas will take effect in 2024, increasing the regulatory compliance risk. Like the GDPR, many of these state laws categorize medical or health data, genetic data, and biometric data that can be used to identify a natural person as "sensitive data" and the processing or collection of such will require additional compliance obligations. In the EU, the GDPR, which came into effect on May 25, 2018, could increase our burden of regulatory compliance. The GDPR implements more stringent operational requirements for processors and controllers of personal data, including, for example, requiring expanded disclosures about how personal information is to be used, limitations on retention of information, mandatory data breach notification requirements, and higher standards for data controllers to demonstrate that they have obtained either valid consent or have another legal basis in place to justify their data processing activities. The GDPR further provides that EU member states may make their own additional laws and regulations in relation to certain data processing activities, which could further limit our ability to use and share personal data and could require localized changes to our operating model. Under the GDPR, fines of up to €20 million or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, may be assessed for noncompliance, which significantly increases our potential financial exposure for non-compliance. We will be subject to the GDPR where we have a EU presence or "establishment" (e.g. EU based subsidiary or operations), when conducting clinical trials with EU based data subjects (whether the trials are conducted directly by us or through a clinical vendor or partner) or offering approved products or services (if relevant) to EU based data subjects (regardless of whether involving our EU based subsidiary or operations). The GDPR sets out a number of requirements that must be complied with when processing the personal data of such EU based data subjects including: providing expanded disclosures about how their personal data will be used; higher standards for organizations to demonstrate that they have obtained valid consent or have another legal basis in place to justify their data processing activities; the obligation to appoint data protection officers in certain circumstances; new rights for individuals to be "forgotten" and rights to data portability, as well as enhanced current rights (e.g. access requests); the principal of accountability and demonstrating compliance through policies, procedures, training and audit; the new mandatory data breach regime. In particular, medical or health data, genetic data and biometric data where the latter is used to uniquely identify an individual are all classified as "special category" data under the GDPR and afford greater protection and require additional compliance obligations. Further, EU member states have a broad right to impose additional conditions-including restrictions-on these data categories. This is because the GDPR allows EU member states to derogate from the requirements of the GDPR mainly in regard to specific processing situations (including special category data and processing for scientific or statistical purposes). As the EU states continue to reframe their national legislation to harmonize with the GDPR, we will need to monitor compliance with all relevant EU member states' laws and regulations, including where permitted derogations from the GDPR are introduced. We will also be subject to evolving EU laws on data export, where we transfer data outside the EU to group companies or third parties. The GDPR only permits exports of data outside the EU where there is a suitable data transfer solution in place to safeguard personal data (e.g. the EU Commission approved Standard Contractual Clauses or the recently-adopted EU-US Data Privacy Framework). On July 16, 2020, the Court of Justice of the EU or the CJEU, issued a landmark opinion in the case Maximilian Schrems vs. Facebook (Case C-311/18), called Schrems II. This decision (i) calls into question certain data transfer mechanisms as between the EU member states and the U.S. (such as the Standard Contractual Clauses) and (ii) invalidates the EU-U.S. Privacy Shield on which many companies had relied as an acceptable mechanism for transferring such data from the EU to the U.S. The CJEU is the highest court in Europe and the Schrems II decision heightens the burden on data importers to assess the impact of U.S. national security laws on their business and future actions of EU data protection authorities are difficult to predict. While the recently-adopted EU-US Data Privacy Framework was meant to address the concerns raised by the CJEU in Schrems II, it will likely be subject to future legal challenges. Further, the EU-US Data Privacy Framework is only available to companies who have completed a self-certification and application. We have not self-certified to the EU-US Data Privacy Framework, and consequently, there is some risk of any of our data transfers from the EU being halted by one or more EU member states. Where we rely on third parties to carry out a number of services for us, including processing personal data on our behalf, we are required under GDPR and the U.S. state privacy laws to enter into contractual arrangements to help ensure that these third parties only process such data according to our instructions and have sufficient security measures in place. Any security breach or non-compliance with our contractual terms or breach of applicable law by such third parties could result in enforcement actions, litigation, fines and penalties or adverse publicity and could cause our customers to lose trust in us, which could have an adverse impact on our reputation and business. Any contractual arrangements requiring the transfer of personal data from the EU to us in the United States requires greater scrutiny and assessments as required under Schrems II and may have an adverse impact on cross-border transfers of personal data, or increase costs of compliance. Our partnerships in China and our CRO relationships in Hong Kong may expose us to new and stringent Chinese data security laws. The Data Security Law of the People's Republic of China, or the PRC Data Security Law, took effect on September 1, 2021. The PRC Data Security Law requires data processing, which includes the collection, storage, use, processing, transmission, provision and publication of data, to be conducted in a legitimate and proper manner. Moreover, the PRC Data Security Law provides a national security review procedure for those data processing activities which affect or may affect national security and imposes export restrictions on certain data and information. In addition, the PRC Data Security Law also provides that any organization or individual within the territory of the PRC shall not provide any foreign judicial body and law enforcement body with any data stored in the territory of the PRC without the approval of the competent PRC governmental authorities. Also in China, the Personal Information Protection Law, which took effect on November 1, 2021, introduced stringent protection requirements for processing personal information. We may be required to make further significant adjustments to our business practices to comply with data security and personal information protection laws in China. In recent years, U.S. and European lawmakers and regulators have expressed concern over electronic marketing. In the EU, marketing is defined broadly to include any promotional material and the rules specifically on e-marketing are currently set out in the ePrivacy Directive which will be replaced by a new ePrivacy Regulation. While the ePrivacy Regulation was originally intended to be adopted on May 25, 2018 (alongside the GDPR), it is still going through the European legislative process. Once the regulation is adopted, there will be a two-year implementation period. The current draft of the ePrivacy Regulation imposes strict opt-in e-marketing rules with limited exceptions to business to business communications and significantly increases fining powers to the same levels as GDPR (see above). In the U.S., the state privacy laws in California, Virginia, Colorado, Connecticut, and Utah include provisions regulating certain types of behavioral marketing and require companies to analyze online marketing and, in some cases, require opt-out mechanisms, increasing operational expenses and risk. The Federal Trade Commission has also issued a notice of proposed rulemaking with respect to online marketing and data collection. We may find it necessary or desirable to join self-regulatory bodies or other privacy-related organizations, particularly relating to biopharmacy and/or scientific research that may require compliance with their rules pertaining to privacy and data security. The introduction of the GDPR, and any resultant changes in EU member states' national laws and regulations and the ePrivacy Regulation, will increase our compliance obligations and will necessitate the review and implementation of policies and processes relating to our collection and use of data. This increase in compliance obligations could also lead to an increase in compliance costs which may have an adverse impact on our business, financial condition or results of operations. If any person, including any of our employees, clinical vendors or partners or those with whom we share such information, negligently disregards or intentionally breaches our established controls with respect to our clinical subject, clinical investigator or employee data, or otherwise mismanages or misappropriates that data, we could be subject to significant monetary damages, regulatory enforcement actions, fines and/or criminal prosecution in one or more jurisdictions. As above, under the GDPR there are significant new punishments for non-compliance which could result in a penalty of up to 4% of a firm's global annual revenue. Applicable laws may conflict with each other, and by complying with the laws or regulations of one jurisdiction, we may find that we are violating the laws or regulations of another jurisdiction. Despite our efforts, we may not have fully complied in the past and may not in the future. If we become liable under laws or regulations applicable to us, we could be required to pay significant fines and penalties, our reputation may be harmed and we may be forced to change the way we operate. That could require us to incur significant expenses or to discontinue certain services, which could negatively affect our business. We are increasingly dependent upon technology systems and data to operate our business. In particular, the COVID-19 pandemic has caused us to modify our business practices, including in certain cases allowing office-based employees in the United States to work from home. As a result, we are increasingly dependent upon our technology systems to operate our business and our ability to effectively manage our business depends on the security, reliability and adequacy of our technology systems and data, which includes use of cloud technologies. A breakdown, invasion, corruption, destruction or breach of our technology systems, including the cloud technologies that we utilize, and/or unauthorized access to our data and information could subject us to liability or negatively impact the operation of our business. Our technology systems, including the cloud technologies that we utilize, continue to increase in multitude and complexity, making them potentially vulnerable to breakdown, malicious intrusion and random attack. Likewise, data privacy or security breaches by individuals authorized to access our technology systems, including the cloud technologies that we utilize, may pose a risk that sensitive data, including intellectual property, trade secrets or personal information belonging to us, our patients, customers or other business partners, may be exposed to unauthorized persons or to the public.

Our success largely depends on the continued service of key management, advisors and other specialized personnel, including Mark P. Lappe, our Chief Executive Officer, Brendan P. Eckelman, Ph.D., our Chief Scientific Officer, and Kelly D. Deck, our Chief Financial Officer, who are all employed at will and for whom we do not have "key man" insurance coverage. The loss of one or more members of our management team or other key employees or advisors could delay our research and development programs and have a material and adverse effect on our business, financial condition, results of operations and prospects. We are dependent on the continued service of our technical personnel because of the highly technical nature of our therapeutic candidates and technologies and the specialized nature of the marketing approval process. Our future success will depend in large part on our continued ability to attract and retain other highly qualified scientific, technical and management personnel, as well as personnel with expertise in clinical testing, manufacturing, governmental regulation and commercialization. We face competition for personnel from other companies, universities, public and private research institutions, government entities and other organizations (many of whom have substantially greater financial resources than us), and we might not be able to attract or retain these key employees on conditions that are economically acceptable. Our inability to attract and retain these key employees could prevent us from achieving our objectives and implementing our business strategy, which could have a material adverse effect on our business and prospects.

Healthcare providers, physicians and third-party payors play a primary role in the recommendation and prescription of any therapeutic candidates for which we may obtain marketing approval. Our current and future arrangements with healthcare providers, third-party payors and customers expose us to broadly applicable fraud and abuse and other healthcare laws and regulations that may constrain the business or financial arrangements and relationships through which we market, sell and distribute our therapeutic candidates for which we obtain marketing approval. In addition, we may be subject to patient data privacy and security regulation by both the U.S. federal government and the states in which we conduct our business. Restrictions under applicable federal and state healthcare laws and regulations, include the following: - the U.S. federal Anti-Kickback Statute, which prohibits, among other things, persons or entities from knowingly and willfully soliciting, offering, receiving or providing remuneration, directly or indirectly, in cash or in kind to induce or reward either the referral of an individual for, or the purchase, or order or recommendation of, any good or service, for which payment may be made under federal and state healthcare programs such as Medicare and Medicaid. A person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation;- the federal civil and criminal false claims laws, including the U.S. federal False Claims Act, which can be enforced through civil whistleblower or qui tam actions, and the civil monetary penalties laws, which prohibit individuals or entities from knowingly presenting, or causing to be presented, to the federal government, claims for payment that are false or fraudulent, knowingly making, using or causing to be made or used, a false record or statement material to a false or fraudulent claim, or from knowingly making a false statement to avoid, decrease or conceal an obligation to pay money to the federal government. In addition, the government may assert that a claim including items and services resulting from a violation of the U.S. federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the U.S. federal False Claims Act;- HIPAA, which imposes criminal and civil liability for, among other things, knowingly and willfully executing, or attempting to execute a scheme to defraud any healthcare benefit program, or knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false statement in connection with the delivery of or payment for healthcare benefits, items or services; similar to the U.S. federal Anti-Kickback Statute, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation;- the U.S. federal legislation commonly referred to as the Physician Payments Sunshine Act, enacted as part of the ACA, and its implementing regulations, which requires certain manufacturers of drugs, devices, biologics and medical supplies that are reimbursable under Medicare, Medicaid, or the Children's Health Insurance Program to report annually to HHS information related to certain payments and other transfers of value to physicians (defined to include doctors, dentists, optometrists, podiatrists, and chiropractors), certain advanced non-physician healthcare practitioners and teaching hospitals, as well as ownership and investment interests held by the physicians described above and their immediate family members; and - analogous state laws and regulations, such as state anti-kickback and false claims laws that may apply to sales or marketing arrangements and claims involving healthcare items or services reimbursed by non-governmental third-party payors, including private insurers; state laws that require pharmaceutical companies to comply with the pharmaceutical industry's voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government in addition to requiring drug and therapeutic biologics manufacturers to report information related to payments to physicians and other healthcare providers or marketing expenditures and pricing information; state and local laws that require the registration of pharmaceutical sales representatives; and state laws governing the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts. Ensuring that our future business arrangements with third parties comply with applicable healthcare laws and regulations could involve substantial costs. It is possible that governmental authorities will conclude that our business practices do not comply with current or future statutes, regulations, agency guidance or case law involving applicable fraud and abuse or other healthcare laws and regulations. If our operations are found to be in violation of any such requirements, we may be subject to significant civil, criminal and administrative penalties, including monetary damages, fines, disgorgements, imprisonment, loss of eligibility to obtain approvals from the FDA, exclusion from participation in government contracting, healthcare reimbursement or other government programs, including Medicare and Medicaid, reputational harm, diminished profits and future earnings, additional reporting requirements if we become subject to a corporate integrity agreement or other agreement to resolve allegations of non-compliance with any of these laws, and the curtailment or restructuring of our operations, any of which could adversely our financial results. Although effective compliance programs can mitigate the risk of investigation and prosecution for violations of these laws, these risks cannot be entirely eliminated. Any action against us for an alleged or suspected violation could cause us to incur significant legal expenses and could divert our management's attention from the operation of our business, even if our defense is successful. In addition, achieving and sustaining compliance with applicable laws and regulations may be costly to us in terms of money, time and resources.

Even if we are successful in achieving marketing approval to commercialize a therapeutic candidate ahead of our competitors, our future therapeutic candidates may face direct competition from biosimilar products. In the United States, our therapeutic candidates are regulated by the FDA as biological products, and we intend to seek approval for these therapeutic candidates pursuant to the BLA pathway. The BPCIA created an abbreviated pathway for the FDA approval of biosimilar biological products based on a previously licensed innovator, or reference, biological product. Under the BPCIA, an application for a biosimilar biological product cannot be approved by the FDA until 12 years after the original reference biological product was approved under a BLA. We believe that any of our therapeutic candidates approved as a biological product under a BLA should qualify for the 12-year period of exclusivity available to reference biological products. However, there is a risk that this exclusivity could be shortened due to Congressional action or otherwise, or that the FDA will not consider our therapeutic candidates to be reference biological products pursuant to its interpretation of the exclusivity provisions of the BPCIA, potentially creating the opportunity for follow-on biosimilar competition sooner than anticipated. Moreover, the extent to which a biosimilar product, once approved, will be substituted for any one of our reference products in a way that is similar to traditional generic substitution for non-biological products is not yet clear, and will depend on a number of marketplace and regulatory factors that are still developing including whether a future competitor seeks an interchangeability designation for a biosimilar of one of our products. Under the BPCIA as well as state pharmacy laws, only so-called "interchangeable" biosimilar products are considered substitutable for the reference biological product without the intervention of the healthcare provider who prescribed the original biological product. However, as with all prescribing decisions made in the context of a patient-provider relationship and a patient's specific medical needs, healthcare providers are not restricted from prescribing biosimilar products in an off-label manner. In addition, a competitor could decide to forego the abbreviated approval pathway available for biosimilar products and to submit a full BLA for product licensure after completing its own nonclinical studies and clinical trials. In such a situation, any exclusivity to which we may be eligible under the BPCIA would not prevent the competitor from marketing its biological product as soon as it is approved. In Europe, the European Commission has granted marketing authorizations for many biosimilar products pursuant to a set of general and product class-specific guidelines for biosimilar approvals issued over the past few years. In addition, companies may be developing biosimilar products in other countries that could compete with our products, if approved. If competitors are able to obtain marketing approval for biosimilars referencing our therapeutic candidates, if approved, our future products may become subject to competition from such biosimilars, whether or not they are designated as interchangeable, with the attendant competitive pressure and potential adverse consequences. Such competitive products may be able to immediately compete with us in each indication for which our therapeutic candidates may have received approval.