Cryo-Cell International (CCEL) Risk Analysis

We are subject to substantial regulation. We are required to register with the FDA under the Public Health Service Act because of our ongoing cellular storage business and are subject to FDA inspection. This requirement applies to all establishments engaged in the recovery, processing, storage, labeling, packaging, or distribution of any Human Cells, Tissues, and Cellular and Tissue-Based Products ("HCT/Ps") or the screening or testing of a cell or tissue donor. In addition, with the purchase of the manufacturing rights to the PrepaCyte CB Processing System on June 30, 2015, we are required to register this product as a Medical Device under the Federal Food, Drug, and Cosmetic Act which is also subject to FDA inspection. The Company is in compliance with these requirements, but no assurances can be made that we will be able to meet future regulatory requirements. The division of FDA which regulates HCT/Ps is the Center for Biologics Evaluation and Research ("CBER"). Since 2004, the FDA has formulated a "Tissue Action Plan" which consists of these three rules: 1.As of January 21, 2004, all cord blood banks are required to register with the FDA. Any cord blood bank which has a laboratory should be on the web page of FDA Registered Establishments. 2.The second rule was published May 20, 2004, and became effective May 25, 2005. It pertains to donor eligibility. This rule requires more screening of donors for communicable diseases. 3.The final rule establishes FDA standards of current Good Tissue Practice ("GTP") for laboratories which process HCT/Ps. This rule was published November 19, 2004, became effective May 25, 2005, and is intended to prevent contamination or cross-contamination during the handling of HCT/Ps. The final rule allows the FDA to inspect cord blood laboratories to determine compliance with the provisions of 21 CFR Part 1271. As part of this oversight authority, the FDA conducts unannounced inspections of cord blood banks. Upon execution of the acquisition of all of the assets of Cord:Use, the Company acquired the cord blood operations which included both public (PHS 351) and private (PHS 361) banks. The new PHS 351 product is distributed under an IND (10-CBA) maintained by the NMDP. The Company has continued the contract with Duke initiated by Cord:Use to manufacture, test, cryopreserve, store and distribute the public cord blood units. The units are listed on the NMDP Single Point of Access Registry and are available to transplant centers worldwide. The Company is reimbursed via cost recovery for public cord blood units distributed for transplant through the NMDP. The donation of cord blood units in the public cord blood banking program functions under The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Company adheres to HIPAA rules. The FDA does not require establishments that manufacture drugs (including biological products) and devices that are HCT/Ps for use under an investigational new drug application (IND) (21 CFR Part 312) to register and list their HCT/Ps until the HCT/P is approved through a biologics license application (BLA), new drug application (NDA), or premarket approval application (PMA); or cleared through a premarket notification submission (510(k)). The PrepaCyte CB (Cord Blood) Processing System is intended for use in cell processing laboratories to process and store total nucleated cells (TNC) from human umbilical cord blood, prior to banking. The device is composed of a bag with separation media. The system is 510(k) cleared as a Class II device. The division of the FDA which regulates this product is the Center of Biologics Evaluation and Research ("CBER"). Approval to market the device was determined by the Office of Cellular, Tissue and Gene Therapies. The section of FDA Code of Federal Regulations ("CFR") pertaining to medical device is 21 CFR 800s. The requirements for compliance to this section include annual registration of the device, listing of devices with the FDA, good manufacturing practice, labeling, and prohibitions against misbranding and adulteration. Currently, the states of California, Illinois, Maryland, New Jersey and New York require cord blood banks to be registered or licensed. The Company is currently registered or licensed to operate in these states. If the Company identifies other states with licensing requirements or if other states adopt such requirements, the Company would have to obtain licenses or registration to continue providing cord blood services in those states. The Company is also subject to local, state and federal laws and regulations relating to safe working conditions, laboratory and manufacturing practices and the use and disposal of hazardous or potentially hazardous substances. These laws include the Occupational Safety and Health Act ("OSHA"), cGTPs, cGMPs, Environmental Protection Act and those of the local Department of Health. Evolving legislation and regulations governing private cord blood banking in various jurisdictions throughout the world may impact the Company's international licensees. In addition, as the organization grows and evolves, other legislation and regulations are expected to impact the Company. One such evolution involves activities that may be designated as or involve medical research or cooperative agreements associated with medical research. These types of activities are also governed by the FDA,specifying oversight by an Institutional Review Board (IRB). The IRB is a board or committee that approves the initiation of, and conducts periodic review of, biomedical research involving human subjects. The primary purpose of such review is to assure the protection of the rights and welfare of the human subjects. Governance of biomedical research is codified as laws by Title 21 of the Code of Federal Regulations (CFR) Part 56, and enforced by the FDA. Other medical research associated with clinical trials may require an Investigational New Drug Application (IND). Current Federal law requires that a drug be the subject of an approved marketing application before it is transported or distributed across state lines. Because a sponsor will likely want to ship the investigational drug to clinical investigators in many states, it must seek an exemption from that legal requirement. The IND is the means through which the sponsor technically obtains this exemption from the FDA. This approval would be required in the case of a clinical trial.

The Foreign Corrupt Practices Act ("FCPA"), prohibits any U.S. individual or business from paying, offering, or authorizing payment or offering of anything of value, directly or indirectly, to any foreign official, political party or candidate for the purpose of influencing any act or decision of the foreign entity in order to assist the individual or business in obtaining or retaining business. The FCPA also obligates companies whose securities are listed in the United States to comply with accounting provisions requiring the company to maintain books and records that accurately and fairly reflect all transactions of the corporation, including international subsidiaries, and to devise and maintain an adequate system of internal accounting controls for international operations. Activities that violate the FCPA, even if they occur wholly outside the United States, can result in criminal and civil fines, imprisonment, disgorgement, oversight, and debarment from government contracts

There has been increasing public focus and scrutiny from investors, governmental and nongovernmental organizations, and customers on corporate ESG practices. Our ESG practices may not meet the standards of all of our stakeholders and advocacy groups may campaign for further changes. A failure, or perceived failure, to respond to expectations of all parties could cause harm to our business and reputation and have a negative impact on the market price of our securities. New government regulations could also result in new regulations and new or more stringent forms of ESG oversight and disclosures which may lead to increased expenditures for sustainability initiatives.

Our public blood bank research involves clinical testing, which is expensive, complex and lengthy, and subject to various regulations, including the "Common Rule." The Common Rule is a rule of ethics in the United States regarding biomedical and behavioral research involving human subjects. It governed Institutional Review Boards for oversight of human research. It is encapsulated in the 1991 revision to the U.S. Department of Health and Human Services Title 45 CFR 46 Subparts A, B, C and D. Subpart A. The outcome of clinical trials is inherently uncertain. There is a high rate of attrition for product candidates proceeding through clinical trials and most investigational medicines that commence clinical trials are never approved as products. We may not be able to initiate, may experience delays in, or may have to discontinue clinical trials for our investigational treatments. We and our strategic collaborators, including Duke, also may experience unforeseen events during, or as a result of, any clinical trials that we or they conduct that could delay or prevent us or them from successfully developing our investigational medicines and gaining approval from regulators. Delays or other events that might prevent us from proceeding with clinical trials include: - regulators, Institutional Review Boards (IRBs), or ethics committees may not authorize us or our investigators to commence a clinical trial or conduct a clinical trial at a prospective trial site;- the outcome of our preclinical studies and our early clinical trials may not be predictive of the success of later clinical trials, and interim results of a clinical trial do not necessarily predict final results;- we may be unable to establish or achieve clinically meaningful endpoints for our studies;- if we make changes to our investigational medicines after clinical trials have commenced (which we have done in the past), we may be required to repeat earlier stages or delay later stages of clinical testing;- clinical trials of any investigational medicines may fail to show safety or efficacy, or produce negative or inconclusive results, and we may decide, or regulators may require us to conduct additional nonclinical studies or clinical trials, or we may decide to abandon product development programs; and - regulators may impose a complete or partial clinical hold on a trial, or we or our investigators, IRBs, or ethics committees may elect to suspend or terminate clinical research or trials for various reasons, including noncompliance with regulatory requirements or a finding that the participants are being exposed to an unacceptable benefit-risk ratio. Any delay in developing assays that are acceptable to the FDA or other regulators could delay the start of future clinical trials. Further, the FDA or other regulators may change the requirements for approval even after they have reviewed and commented on the design for clinical trials. Significant preclinical or nonclinical testing and studies or clinical trial delays for our investigational treatments could allow our competitors to bring products to market before we do.

International licenses of our technology and services account for a portion of our income and our international growth may be limited if we are unable to successfully manage our international activities. We are subject to a number of challenges that relate to our international business activities. Our growth and future license income and return on investments from these sources will be impacted by these challenges, which include: - failure of local laws to provide the same degree of protection against infringement of our intellectual property rights;- certain laws and business practices that could prevent our business from operating or favor local competitors, which could slow or limit our growth in international markets;- entering into licensing agreements with organizations capable of undertaking and sustaining operations;- the expense of entering into licensing and investment arrangements in new foreign markets;- changes in local political, economic, social, and labor conditions, which may adversely affect our business;- risks associated with trade restrictions and foreign import requirements, including the importation and exportation of our solutions, as well as changes in trade, tariffs, restrictions or requirements;- heightened risks of unethical, unfair or corrupt business practices, actual or claimed, in certain geographies;- fluctuations in currency exchange rates, which may make doing business with us less appealing as our contracts are generally denominated in U.S. dollars;- greater difficulty in enforcing contracts;- lack of brand awareness that can make commercializing our products more difficult and expensive;- management communication and integration problems resulting from cultural differences and geographic dispersion;- the uncertainty and limitation of protection for intellectual property rights in some countries;- potentially different pricing environments, longer payment cycles in some countries, increased credit risk, and higher levels of payment fraud;- uncertainty regarding liability for products and services, including uncertainty as a result of local laws and lack of legal precedent;- different employee/employer relationships, existence of workers' councils and labor unions, and other challenges caused by distance, language, and cultural differences, making it harder to do business in certain jurisdictions; and - compliance with complex foreign and U.S. laws and regulations applicable to international operations may increase the cost of doing business in international jurisdictions. These numerous and sometimes conflicting laws and regulations include internal control and disclosure rules, data privacy requirements, research ethics and compliance laws, anti-corruption laws, and anti- competition regulations, among others. Violations of these laws and regulations could result in fines and penalties, criminal sanctions against us, our officers, or our employees, prohibitions on the conduct of our business and on our ability to offer our products and services in one or more countries, and could also materially affect our brand, our international expansion efforts, our ability to attract and retain employees, our business, and our operating results. The occurrence of any one of these risks could harm our international business and, consequently, our results of operations. Additionally, operating in international markets requires significant management attention and financial resources. We cannot be certain that the investment and additional resources required to operate in other countries will produce desired levels of revenue or profitability.

We rely on various information systems to manage our operations and to store information, including sensitive data such as confidential business information and personally identifiable information. These systems have been and continue to be vulnerable to interruption or malfunction, including due to events beyond our control, and to unauthorized access, computer hackers, ransomware, viruses, and other security problems. Failure of these systems or any significant breach of our data security could have an adverse effect on our business and may materially adversely affect our operating results and financial condition. Data security breaches could result in loss or misuse of information, which could, in turn, result in potential regulatory actions or litigation, including material claims for damages, compelled compliance with breach notification laws, interruption to our operations, damage to our reputation or could otherwise have a material adverse effect on our business, financial condition and operating results. Companies throughout our industry have been increasingly subject to a wide variety of security incidents, cyber-attacks and other attempts to gain unauthorized access to networks or sensitive information. While we have implemented and continue to implement cybersecurity safeguards and procedures, these safeguards have been vulnerable to attack. As cyber threats continue to evolve, we may be required to expend additional resources to enhance our cybersecurity measures or to investigate or remediate any vulnerabilities or breaches. Although we maintain insurance to protect ourselves in the event of a breach or disruption of certain of our information systems, we cannot ensure that the coverage is adequate to compensate for any damages that may be incurred.

We depend on our ability to store, retrieve, process and manage a significant amount of information. If our information systems fail to perform as expected, or if we suffer an interruption, malfunction or loss of information processing capabilities, it could have a material adverse effect on our business.

Political events, international trade disputes, war, terrorism, natural disasters, public health issues, industrial accidents and other business interruptions, such as the current Ukrainian-Russian conflict could harm or disrupt international commerce and the global economy, and could have a material adverse effect on the Company and its customers, suppliers, cellular network carriers and other partners. International trade disputes could result in tariffs and other protectionist measures that could adversely affect the Company's business. The Ukrainian-Russian conflict has caused market volatility, a sharp increase in certain commodity prices, such as wheat and oil, and an increasing number and frequency of cybersecurity threats. So far, we have not experienced any direct impact from the conflict and, as our business is conducted primarily in the United States, we are probably less vulnerable than companies with international operations. Nevertheless, we will continue to monitor the situation carefully and, if necessary, take action to protect our business, operations and financial condition.