Aurinia Pharmaceuticals (IKAP) Risk Analysis

We are subject to various federal, state and foreign laws and regulations governing the health care industry that could result in substantial penalties for noncompliance. These laws and regulations may impact our ability to operate, including our sales and marketing efforts. In addition, we may be subject to patient privacy regulation by federal, state and foreign governments that govern jurisdictions in which we conduct our business. The laws and regulations that may affect our ability to operate include: - the AKS, which prohibits, among other things, persons from soliciting, receiving, offering or paying remuneration, directly or indirectly, in cash or in kind, to induce or reward, or in return for, either the referral of an individual for, or the purchase, order or recommendation of, an item or service reimbursable under a federal health care program, such as the Medicare and Medicaid programs. The term "remuneration" has been broadly interpreted to include anything of value, including for example gifts, cash payments, donations, the furnishing of supplies or equipment, waivers of payment, ownership interests, and providing any item, service or compensation for something other than fair market value. - false claims and civil monetary penalties laws, including the FCA, which prohibits anyone from, among other things, knowingly presenting, or causing to be presented, for payment to federal programs (including Medicare and Medicaid) claims for items or services that are false or fraudulent. Although we may not submit claims directly to payors, manufacturers can be held liable under these laws in a variety of ways. These include: providing inaccurate billing or coding information to customers; improperly promoting a product's off-label use; violating the AKS; or misreporting pricing information to government programs. - HIPAA, which prohibits, among other things, knowingly and willfully executing a scheme to defraud any health care benefit program or making false statements in connection with the delivery of or payment for health care benefits, items or services. - the U.S. Physician Payment Sunshine Act requirements, under the ACA, which require manufacturers of certain drugs and biologics to track and report to U.S. Centers for Medicare & Medicaid Services payments and other transfers of value they make to U.S. physicians and teaching hospitals as well as physician ownership and investment interests in the manufacturer. - various federal, state and foreign data privacy and security laws and regulations. These include provisions of HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act and its implementing regulations, which impose certain requirements relating to the privacy, security and transmission of individually identifiable health information in the U.S. and the GDPR in the E.U. We may not be directly subject to certain of these laws and regulations, such as privacy and security requirements under HIPAA; however, we may be subject to criminal penalties for knowingly, aiding and abetting these violations. - section 1927 of the Social Security Act, which requires that manufacturers of drugs and biological products covered by Medicaid report pricing information to CMS on a monthly and quarterly basis, including the best price available to any customer of the manufacturer, with certain exceptions for government programs, and pay prescription rebates to state Medicaid programs based on a statutory formula derived from reported pricing information. - various state and/or foreign law equivalents of each of the above federal laws, such as the California Consumer Privacy Act, many of which differ from each other in significant ways and may not have the same effect, which complicates our compliance efforts. If we are found to be in violation of any of the laws or regulations described above or any other laws or regulations that apply to us (including any changes made to such laws or regulations, or new laws or regulations implemented, by applicable government entities), we may be subject to substantial penalties, including civil and criminal penalties, damages, fines and possible exclusion from participation in Medicare, Medicaid and other federal health care programs. If we are subjected to substantial penalties, our business may suffer, and we may be forced to curtail or cease our operations.

Any products manufactured or distributed by us pursuant to FDA, EC and/or other regulatory agency approvals may be subject to continuing regulation by such agencies, including record-keeping requirements and reporting of adverse experiences with the drug. Drug manufacturers and their subcontractors are required to register their establishments with the FDA, EC and/or other regulatory agencies and may be subject to periodic unannounced inspections by such agencies for compliance with cGMPs, which impose certain procedural and documentation requirements on us and our third-party manufacturers. Even after regulatory approval is obtained, under certain circumstances, such as later discovery of previously unknown safety risks, the FDA, EC and/or other regulatory agencies can withdraw approval, recall the product or subject the drug to additional restrictions. In addition, governments outside of the U.S. tend to impose strict price controls, which may adversely affect our revenues or our royalty payments received from license agreements.

After a regulator, such as the FDA, approves a product for marketing, the product's sponsor must comply with post-marketing obligations. Post-marketing obligations include, but are not limited to, the reporting of adverse events to the regulator within specified timeframes, the submission of product-specific annual reports and notification when a drug product is found to have significant deviations from its approved manufacturing specifications. Such deviations may include unforeseen side effects. Our ongoing compliance with such mandatory reporting requirements could result in additional requests for information that could result in a product recall, strengthened warnings, revisions to other label information, conducting additional clinical studies or the imposition of other risk-management measures. Regulators may also require the withdrawal of the product from the market. Any of these post-marketing regulatory actions could materially affect our sales and increase our costs, and our business may suffer.

In the event we or our current or future out-licensees (together, "Marketers") pursue the right to market and sell our products, our product candidates or any other products we may develop ("Product Candidate") in jurisdictions where we do not already have approval, Marketers would be required to obtain separate marketing approvals and comply with numerous and varying regulatory requirements in those jurisdictions. The approval procedures vary among jurisdictions and may involve additional testing. The time required to obtain approval may differ substantially from that required to obtain, for example, FDA or EC approval. The regulatory approval process outside the U.S. generally includes all of the risks associated with obtaining FDA approval. In addition, in many countries outside the U.S., it is required that the product be approved for reimbursement before the product can be approved for sale in that jurisdiction. In the event Marketers choose to pursue them, Marketers may not obtain approvals from regulatory authorities in such jurisdictions on a timely basis, if at all. Our existing approvals do not ensure approval by regulatory authorities in other countries or jurisdictions, and approval by one regulatory authority outside the U.S. does not ensure approval by regulatory authorities in other countries or jurisdictions or by the FDA. If Marketers are unable in the future to obtain approval of a Product Candidate by regulatory authorities, the commercial prospects of that Product Candidate may be significantly diminished and our business may suffer.