ANI Pharmaceuticals (ANIP) Risk Analysis

We are subject to data protection laws and regulations. In the U.S., numerous federal and state laws and regulations, including state data breach notification laws, state health information and/or genetic privacy laws, and federal and state consumer protection laws, govern the collection, use, disclosure, and protection of health related and other personal information. In California, the California Consumer Privacy Act ("CCPA") establishes certain requirements for data use and sharing transparency, and provides California residents certain rights concerning the use, disclosure, and retention of their personal data. The California Privacy Rights Act currently in effect, significantly amends the CCPA. Virginia, Colorado, Utah, and Connecticut have enacted privacy laws similar to the CCPA that impose new obligations or limitations in areas affecting our business, and similar laws are under consideration in other states. These laws and regulations are evolving and subject to interpretation and may impose limitations on our activities or otherwise adversely affect our business. The obligations to comply with the CCPA and evolving legislation may involve, among other things, updates to our notices and the development of new processes. We may be subject to fines, penalties, or private actions in the event of non-compliance with such laws. In addition, we may obtain health information from third parties (e.g., healthcare providers who prescribe our product) that are subject to privacy and security requirements under the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations, (collectively, "HIPAA"). HIPAA imposes privacy and security obligations on covered entity health care providers, health plans, and health care clearinghouses, as well as their "business associates"-certain persons or entities that create, receive, maintain, or transmit protected health information in connection with providing a specified service or performing a function on behalf of a covered entity. Although we are not directly subject to HIPAA, we could be subject to criminal penalties if we knowingly receive individually identifiable health information maintained by a HIPAA covered entity in a manner that is not authorized or permitted by HIPAA. Further at the federal level, the Federal Trade Commission ("FTC") also sets expectations for failing to take appropriate steps to keep consumers' personal information secure, or failing to provide a level of security commensurate to promises made to individual about the security of their personal information (such as in a privacy notice) may constitute unfair or deceptive acts or practices in violation of Section 5(a) of the Federal Trade Commission Act ("FTC Act"). The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. With respect to privacy, the FTC also sets expectations that companies honor the privacy promises made to individuals about how the company handles consumers' personal information; any failure to honor promises, such as the statements made in a privacy policy or on a website, may also constitute unfair or deceptive acts or practices in violation of the FTC Act. While we do not intend to engage in unfair or deceptive acts or practices, the FTC has the power to enforce promises as it interprets them, and events that we cannot fully control, such as data breaches, may result in FTC enforcement. Enforcement by the FTC under the FTC Act can result in civil penalties or enforcement actions. EU Member States and other jurisdictions where we operate have adopted data protection laws and regulations, which impose significant compliance obligations. For example, the General Data Protection Regulation (GDPR) imposes strict obligations and restrictions on the ability to collect, analyze and transfer personal data, including health data from clinical trials and adverse event reporting. Switzerland has adopted laws that impose restrictions and obligations similar to the GDPR. The obligations and restrictions under the GDPR and Switzerland's laws concern, in particular, in some instances the consent of the individuals to whom the personal data relate, the processing details disclosed to the individuals, the sharing of personal data with third parties, the transfer of personal data out of the EEA or Switzerland, contracting requirements (such as with clinical trial sites and vendors), and security breach notifications, as well as substantial potential fines, in some cases up to 4% of annual global turnover, for breaches of the data protection obligations. Data protection authorities from the different EU Member States and the EEA may interpret the GDPR and applicable related national laws differently which could effectively result in requirements additional to those currently understood to apply under the GDPR. In addition, guidance on implementation and compliance practices may be updated or otherwise revised, which adds to the complexity of processing personal data in the EU. When processing personal data of subjects in the EU, we have to comply with applicable data protection and electronic communications laws. In particular, as we rely on service providers processing personal data of subjects in the EU, we have to enter into suitable contract terms with such providers and receive sufficient guarantees that such providers meet the requirements of the applicable data protection laws, particularly the GDPR which imposes specific and relevant obligations. Enforcement by EU and U.K. regulators is active, and failure to comply with the GDPR or applicable Member State law may result in substantial fines. Legal mechanisms to allow for the transfer of personal data from the EEA or U.K. to the U.S. may impact our ability to transfer personal data or otherwise may cause us to incur significant costs to do so legally. On July 16, 2020, the European Court of Justice ruled that the Privacy Shield is an invalid data transfer mechanism and confirmed that the Standard Contractual Clauses ("SCCs") remain valid. If companies are relying on the SCCs as their transfer mechanism to transfer personal information from the EEA to the U.S. (or to other jurisdictions not recognized as adequate by the EU), they must be incorporated into new and existing agreements within prescribed timeframes. The U.K. adopted versions of their own SCCs. Updating agreements to incorporate these new SCCs for the EEA and U.K. may require significant time and resources to implement, including through adjusting our operations, conducting requisite data transfer assessments, and revising our contracts. Companies that have not taken steps to demonstrate that their SCCs and personal data recipients in the U.S. or other non-adequate jurisdictions are suitable to receive the personal data may be subject to enforcement actions by competent authorities in the EU for failure to comply with related data privacy rules. Additionally, the European Commission adopted a draft adequacy decision for the EU-U.S. Data Privacy Framework, which reflects the assessment by the European Commission of the U.S. legal framework. The draft decision concludes that the U.S. ensures an adequate level of protection for personal data transferred from the EU to U.S. companies. After an approval process, the European Commission is expected to adopt the final adequacy decision, which will allow data to flow freely from the EU to the U.S. If we or our distributors fail to comply with applicable data privacy laws concerning, or if the legal mechanisms we or our distributors rely upon to allow, the transfer of personal data from the EEA or Switzerland to the U.S. (or other countries not considered by the European Commission to provide an adequate level of data protection) are not considered adequate, we could be subject to government enforcement actions, including an order to stop transferring the personal data outside of the EEA and significant penalties against us. Moreover, our business could be adversely impacted if our ability to transfer personal data out of the EEA or Switzerland to the U.S. is restricted, which could adversely impact our operating results. Failure to comply with data protection laws and regulations could result in unfavorable outcomes, including increased compliance costs, delays or impediments in the development of new products, increased operating costs, diversion of management time and attention, government enforcement actions and create liability for us (which could include civil, administrative, and/or criminal penalties), private litigation and/or adverse publicity that could negatively affect our operating results and business.

We rely significantly on our information technology and manufacturing infrastructure to effectively manage and maintain inventory and financial reports, manufacture and ship products, and invoice customers in a timely manner. While we have invested in the protection of data and information technology, any failure, accidents, inadequacy, or interruption of that infrastructure or security lapse of that technology, including cybersecurity incidents, could harm our ability to operate our business effectively. Our ability to manage and maintain inventory and financial reports, manufacture and ship products, and invoice customers timely depends significantly on our general ledger, our contracted electronic data interface system, and other information systems. Cybersecurity attacks in particular are evolving and include, but are not limited to, malicious software, attempts to gain unauthorized access to data and other electronic security breaches that could lead to disruptions in systems, misappropriation of confidential or otherwise protected information and corruption of data. Cybersecurity incidents resulting in the failure of our information systems to operate effectively or to integrate with other systems, or a breach in security or other unauthorized access of these systems, may affect our ability to manage and maintain inventory and financial reports, and result in delays in product fulfillment and reduced efficiency of operations. A breach in security, unauthorized access resulting in misappropriation, theft, or sabotage with respect to proprietary and confidential information, including research or clinical data, could require significant capital investments to remediate any such failure, problem or breach, all of which could adversely affect our business, financial position, and operating results. See "Cybersecurity – Risk management and strategy," Item 1C of this Annual Report on Form 10-K for additional information.

We, like other generic drug manufacturers, have agreements with customers allowing chargebacks, product returns, administrative fees, and other rebates. Under many of these arrangements, we may match lower prices offered to customers by competitors. If we choose to lower our prices, we generally give the customer a credit on the products that the customer is holding in inventory, which could reduce sales revenue for the period the credit is provided. Like our competitors, we also give credits for chargebacks to wholesalers with whom we have contracts for their sales to hospitals, group purchasing organizations, pharmacies, or other customers. A chargeback is the difference between the price at which we invoice the wholesaler and the price that the wholesaler's end-customer pays for a product. Although we establish reserves based on prior experience and our best estimates of the impact that these policies may have in subsequent periods, we cannot ensure that our reserves are adequate or that actual product returns, allowances, and chargebacks will not exceed our estimates.

Inflationary pressures are currently being experienced and may continue to exist in the U.S. and key worldwide markets. The rate of inflation may significantly increase input costs for our products and, given the competitive nature of the markets in which we compete, including branded, generic, and rare disease pharmaceutical, and may not be able to pass those costs on to our customers.

Our internal manufacturing operations are currently based in three facilities. We have transitioned products manufactured or packaged in Oakville to one of our three U.S.-based manufacturing sites. While these three facilities are sufficient for our current needs, the facilities are highly specialized and any damage to or need for replacement of all or any significant function of our facilities could be very costly and time-consuming and could impair or prohibit production and shipping. A significant disruption at any of the facilities, even on a short-term basis, whether due to a labor strike, adverse quality or compliance observation, vandalism, natural disaster, fire, storm or other environmental damage, or other events could impair our ability to produce and ship products on a timely basis and, among other consequences, could subject us to "failure to supply" claims from our customers, as discussed below. Although we believe we carry commercially reasonable business interruption and liability insurance, we might suffer losses because of business interruptions that exceed the coverage available under our insurance policies or for which we do not have coverage. Any of these events could have a material adverse effect on our business, financial position, and operating results. Virtually all of our contracts for the supply of generic products to our customers contain "failure to supply" clauses which require us to reimburse the customer for the difference between our contract price and the price the customer was forced to pay to procure the substitute product in the event we failed to deliver the requested quantity within a specified period of time. This difference can be substantial because of the much higher spot price at which the customer must cover its requirements and can be far in excess of the revenue that we would otherwise have received on the sale of our own product. Therefore, our ability to produce and ship a sufficient quantity of product on a consistent basis is critical. Failure to deliver products could have a material adverse effect on our business, financial position, and operating results.

Our success is dependent upon the efforts of certain key employees, including members of our senior management team. We have employment arrangements in place with our executive and other officers, but none of these executive and other officers are bound legally to remain employed with ANI for any specific term. We do not have key person life insurance policies covering our executive and other officers or any of our other employees. If key individuals were to leave ANI, our business could be affected adversely if suitable replacement personnel are not recruited quickly. Competition for personnel is intense in certain localities in which we operate, specifically northern Minnesota, where two of our three current manufacturing facilities are located, is small, and as a result, there is a limited number of qualified personnel available in all functional areas, which could make it difficult to retain and attract the qualified personnel necessary for the development and growth of our business. If we were unable to attract and retain qualified personnel, our business, financial position, and operating results could be materially adversely affected.

We have incurred, and will continue to incur, significant costs and expenses, including fees for professional services and other transaction costs, in connection with the Merger, including costs that we may not currently expect. There are a number of factors beyond our control that could affect the total amount or the timing of these costs and expenses. We must pay substantially all of the costs and expenses whether or not the transaction is completed. Moreover, many of the expenses that will be incurred are, by their nature, difficult to estimate accurately. To the extent these acquisition and integration expenses are higher than anticipated, we may experience liquidity or cash flow issues.