Zura Bio (ZURA) Risk Factors

We have the ability to redeem outstanding Warrants of legacy JATT at any time after they become exercisable and prior to their expiration, at a price of $0.01 per Warrant, provided that the closing price of Zura Class A Ordinary Shares equals or exceeds $18.00 per share (as adjusted for share subdivisions, share dividends, rights issuances, subdivisions, reorganizations, recapitalizations and the like) on each of 20 trading days within any 30-trading-day period commencing after the Warrants become exercisable and ending on the third trading day prior to the date on which notice of redemption is given. If and when the Warrants become redeemable by Zura, We may exercise our redemption right even if we are unable to register or qualify the underlying securities for sale under all applicable state securities laws. Redemption of the outstanding Warrants could force the holders thereof to: (i) exercise such Warrants and pay the exercise price therefor at a time when it may be disadvantageous for a holder to do so; (ii) sell such Warrants at the then-current market price when a holder might otherwise wish to hold such Warrants; or (iii) accept the nominal redemption price that, at the time the outstanding Warrants are called for redemption, is likely to be substantially less than the market value of such Warrants. In addition, we may redeem the Warrants at any time after they become exercisable and prior to their expiration for a number of Zura Class A Ordinary Shares determined based on the fair market value of Zura Class A Ordinary Share. The value received upon exercise of the Warrants (1) may be less than the value the holders would have received if they had exercised their Warrants at a later time where the underlying share price is higher and (2) may not compensate the holders for the value of the Warrants.

As a public company, we are required to comply with the requirements of the Sarbanes-Oxley Act of 2002, or the Sarbanes-Oxley Act, including, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. We continue to develop and refine our  disclosure controls and other procedures that are designed to ensure that information we are required to disclose in the reports that we will file with the SEC are recorded, processed, summarized, and reported within the time periods specified in SEC rules and forms and that information required to be disclosed in reports under the Securities Exchange Act of 1934, as amended, or the Exchange Act, is accumulated and communicated to our management, including our principal executive and financial officers. We must continue to improve our internal control over financial reporting. We are currently required to make a formal assessment of the effectiveness of our internal control over financial reporting. To achieve compliance with these requirements within the prescribed time period, we will be engaging in a process to document and evaluate our internal control over financial reporting, which is both costly and challenging. In this regard, we will need to continue to dedicate internal resources, potentially engage outside consultants and adopt a detailed work plan to assess and document the adequacy of our internal control over financial reporting, validate through testing that controls are functioning as documented and implement a continuous reporting and improvement process for internal control over financial reporting. There is a risk that we will not be able to conclude, within the prescribed time period or at all, that our internal control over financial reporting is effective as required by Section 404 of the Sarbanes-Oxley Act. Moreover, our testing, or the subsequent testing by our independent registered public accounting firm, may reveal additional deficiencies in our internal control over financial reporting that are deemed to be material weaknesses. Any failure to implement and maintain effective disclosure controls and procedures and internal control over financial reporting, including the identification of one or more material weaknesses, could cause investors to lose confidence in the accuracy and completeness of our financial statements and reports, which would likely adversely affect the market price of our ordinary shares. In addition, we could be subject to sanctions or investigations by the stock exchange on which our ordinary shares are listed, the SEC and other regulatory authorities.

We may execute additional transactions to add to our pipeline. We have not yet entered into any agreements for any such in-licensing transactions. In the event that we do enter into any additional in-license agreements, it is likely that we will need to expend additional resources and raise additional capital. The ability to do so, to some extent, is subject to market, economic, financial, competitive, legislative, and regulatory factors as well as other factors that are beyond our control. There can be no assurance that our business will generate cash flow from operations, or that additional capital will be available to us, in amounts sufficient to enable us to fund our needs.

We have not established a formal compliance function with the independence and resources that Federal regulators would expect of established corporate compliance programs. We are in the process of developing policies and procedures for compliance training, auditing, and monitoring activities. We have not established a dedicated Chief Compliance Officer. Accordingly, risks associated with regulatory schemes described herein may arise undetected and unmitigated by corporate leadership. Furthermore, any potential enforcement action for regulatory violations might result in compliance obligations in addition to fines, penalties, or administrative actions (e.g., U.S. Department of Justice monitorships or U.S. Department of Health and Human Services, Office of Inspector General Corporate Integrity Agreements).

We are subject to laws and regulations related to, among other things, privacy, data protection, information security and consumer protection across different markets where we conduct our business. Such laws and regulations are constantly evolving and changing and are likely to remain uncertain for the foreseeable future. Our actual or perceived failure to comply with such obligations could have an adverse effect on our business, operating results and financial operations. Complying with these numerous, complex, and often changing regulations is expensive and difficult, and failure to comply with any privacy laws or data security laws or any security incident or breach involving the potential or actual misappropriation, loss or other unauthorized processing, use or disclosure of sensitive or confidential patient, consumer or other personal information, whether by us, one of our collaborators or another third party, could adversely affect our business, financial condition, and results of operations, including but not limited to investigation costs, material fines and penalties, compensatory, special, punitive, and statutory damages, litigation, consent orders regarding our privacy and security practices, requirements that we provide notices, credit monitoring services, and/or credit restoration services or other relevant services to impacted individuals, adverse actions against our licenses to do business, reputational damage and injunctive relief. European data collection is also governed by restrictive regulations governing the use, processing and cross-border transfer of personal information. The collection, use, storage, disclosure, transfer, or other processing of personal data regarding individuals in Europe, including personal health data, is subject to the EU General Data Protection Regulation ("GDPR"), which imposes strict requirements for processing the personal data of individuals within the European Economic Area (the "EEA"), such as Norway, Iceland and Liechtenstein. The GDPR is directly applicable in each EU member state and is extended to the EEA. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, and taking certain measures when engaging third-party processors. The GDPR implements more stringent operational requirements than its predecessor legislation. Compliance with the GDPR will be a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our European activities. For example, the GDPR applies extraterritorially, requires us to make more detailed disclosures to data subjects, requires disclosure of the legal basis on which we can process personal data, makes it harder for us to obtain valid consent for collecting and processing personal data (including data from clinical trials), requires the appointment of data protection officers, such as when sensitive personal data, such as health data, is processed on a large scale, provides more robust rights for data subjects, including far reaching information rights and the right to erasure, introduces mandatory data breach notification through the EU, imposes additional obligations on us when contracting with service providers and requires us to adopt appropriate privacy governance, including policies, procedures, training, and data audit. The GDPR provides that EU member states and EEA countries may establish their own laws and regulations that go beyond the GDPR in certain areas, such as regarding the mandatory appointment of data protection officers or further limiting the processing of personal data, including genetic, biometric, or health data, which could limit our ability to use and share personal data or could cause our costs to increase. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EU and the United States remains uncertain. For example, in 2016, the EU and the United States agreed to a transfer framework for data transferred from the EU to the United States, called the Privacy Shield, but the Privacy Shield was invalidated in July 2020 by the Court of Justice of the European Union ("CJEU"). While the CJEU upheld the adequacy of the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield), it made clear that reliance on them alone may not necessarily be sufficient in all circumstances. Use of the standard contractual clauses must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place, however, the nature of these additional measures is currently uncertain. After Brexit the United Kingdom is also a third country from an EU perspective, but the EU Commission adopted adequacy decisions for the United Kingdom on June 28, 2021 largely permitting the free flow of data from the EU to the United Kingdom. However, for the first time, the adequacy decisions include a so-called "sunset clause" and, therefore, will automatically expire four years after their entry into force. We cannot assure you that our third-party service providers with access to our or our customers', suppliers', trial patients' and employees' personally identifiable and other sensitive or confidential information will not breach contractual obligations imposed by us, or that they will not experience data security breaches or attempts thereof, which could have a corresponding effect on our business, including putting us in breach of our obligations under privacy laws and regulations and/or which could in turn adversely affect our business, results of operations, and financial condition. We cannot assure you that our contractual measures and our own privacy and security-related safeguards will protect us from the risks associated with the third-party processing, use, storage, and transmission of such information. Any of the foregoing could have a material adverse effect on our business, financial condition, results of operations, and prospects.

We are exposed to the risk that our employees, independent contractors, consultants, commercial collaborators, principal investigators, CROs, suppliers and vendors acting for or on our behalf may engage in misconduct or other improper activities. We have adopted a Code of Conduct applicable to all employees of the Company, but it is not always possible to identify and deter misconduct by these parties and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations.

We have relied upon and plan to continue to rely upon third parties, including independent clinical investigators, academic partners, medical institutions, regulatory affairs consultants and third-party CROs, to conduct our preclinical studies and clinical trials, including in some instances sponsoring such clinical trials, and to engage with regulatory authorities and monitor and manage data for our ongoing preclinical and clinical programs. While we have, or will have, agreements governing the activities of such third parties, we will control only certain aspects of their activities and have limited influence over their actual performance. Any of these third parties may terminate their engagements with us under certain circumstances. We may not be able to enter into alternative arrangements or do so on commercially reasonable terms. In addition, there is a natural transition period when a new contract research organization begins work. As a result, delays would likely occur, which could negatively impact our ability to meet our expected clinical development timelines and harm our business, financial condition and prospects. We remain responsible for ensuring that each of our preclinical studies and clinical trials is conducted in accordance with the applicable protocol and legal, regulatory and scientific standards, and our reliance on these third parties does not relieve us of our regulatory responsibilities. We and our third-party contractors and CROs are required to comply with GCP requirements, which are regulations and guidelines enforced by the FDA, the Competent Authorities of the Member States of the EEA and other regulatory authorities for all of our products in clinical development. Regulatory authorities enforce these GCP requirements through periodic inspections of trial sponsors, principal investigators and trial sites. If we fail to exercise adequate oversight over any of our academic partners or CROs or if we or any of our academic partners or CROs do not successfully carry out their contractual duties or obligations, fail to meet expected deadlines, or if the quality or accuracy of the clinical data they obtain is compromised due to the failure to adhere to our clinical protocols or regulatory requirements, or for any other reasons, the clinical data generated in our clinical trials may be deemed unreliable and the FDA, the EMA or other regulatory authorities may require us to perform additional clinical trials before approving our marketing applications. We cannot assure you that upon a regulatory inspection of us, our academic partners or our CROs or other third parties performing services in connection with our clinical trials, such regulatory authority will determine that any of our clinical trials complies with GCP regulations. In addition, our clinical trials must be conducted with product produced under applicable cGMP regulations. Our failure to comply with these regulations may require us to repeat clinical trials, which would delay the regulatory approval process. Furthermore, the third parties conducting clinical trials on our behalf are not our employees, and except for remedies available to us under our agreements with such contractors, we cannot control whether or not they devote sufficient time, skill and resources to our ongoing development programs. These contractors may also have relationships with other commercial entities, including our competitors, for whom they may also be conducting clinical trials or other drug development activities, which could impede their ability to devote appropriate time to our clinical programs. If these third parties, including clinical investigators, do not successfully carry out their contractual duties, meet expected deadlines or conduct our clinical trials in accordance with regulatory requirements or our stated protocols, we may not be able to obtain, or may be delayed in obtaining, marketing approvals for our product candidates. If that occurs, we will not be able to, or may be delayed in our efforts to, successfully commercialize our product candidates. In addition, with respect to investigator-sponsored trials that may be conducted, we do not control the design or conduct of these trials, and it is possible that the FDA or EMA will not view these investigator- sponsored trials as providing adequate support for future clinical trials or market approval, whether controlled by us or third parties, for any one or more reasons, including elements of the design or execution of the trials or safety concerns or other trial results. We expect that such arrangements will provide us certain information rights with respect to the investigator-sponsored trials, including the ability to obtain a license to obtain access to use and reference the data, including for our own regulatory submissions, resulting from the investigator-sponsored trials. However, we do not have control over the timing and reporting of the data from investigator-sponsored trials, nor do we own the data from the investigator-sponsored trials. If we are unable to confirm or replicate the results from the investigator-sponsored trials or if negative results are obtained, we would likely be further delayed or prevented from advancing further clinical development. Further, if investigators or institutions breach their obligations with respect to the clinical development of our product candidates, or if the data proves to be inadequate compared to the firsthand knowledge we might have gained had the investigator-sponsored trials been sponsored and conducted by us, then our ability to design and conduct any future clinical trials ourselves may be adversely affected. Additionally, the FDA or EMA may disagree with the sufficiency of our right of reference to the preclinical, manufacturing or clinical data generated by these investigator-sponsored trials, or our interpretation of preclinical, manufacturing or clinical data from these investigator-sponsored trials. If so, the FDA or EMA may require us to obtain and submit additional preclinical, manufacturing, or clinical data.

The Biologics Price Competition and Innovation Act of 2009, or BPCIA, was enacted as part of the ACA to establish an abbreviated pathway for the approval of biosimilar and interchangeable biological products. The regulatory pathway establishes legal authority for the FDA to review and approve biosimilar biologics, including the possible designation of a biosimilar as "interchangeable" based on its similarity to an approved biologic. Under the BPCIA, a reference biological product is granted 12 years of data exclusivity from the time of first licensure of the product, and the FDA will not accept an application for a biosimilar or interchangeable product based on the reference biological product until four years after the date of first licensure of the reference product. In addition, the approval of a biosimilar product may not be made effective by the FDA until 12 years from the date on which the reference product was first licensed. During this 12-year period of exclusivity, another company may still develop and receive approval of a competing biologic, so long as their biologics license application ("BLA") does not rely on the reference product, sponsor's data or submit the application as a biosimilar application. The law is complex and is still being interpreted and implemented by the FDA. As a result, its ultimate impact, implementation, and meaning are subject to uncertainty, and any new policies or processes adopted by the FDA could have a material adverse effect on the future commercial prospects for our biological products. We believe that if any of the ZB Assets is approved in the United States as a biological product under a BLA it would qualify for the 12-year period of exclusivity. However, there is a risk that this exclusivity could be shortened due to congressional action or otherwise, or that the FDA will not consider the subject product candidate to be a reference product for competing products, potentially creating the opportunity for biosimilar competition sooner than anticipated. Moreover, the extent to which a biosimilar, once approved, will be substituted for any one of the reference products in a way that is similar to traditional generic substitution for non-biological products is not yet clear, and will depend on a number of marketplace and regulatory factors that are still developing. The approval of a biosimilar or interchangeable of our product candidates could have a material adverse impact on our business due to increased competition and pricing pressure.