MoonLake Immunotherapeutics (MLTX) Risk Factors

We may become a "foreign private issuer" as defined in Rule 36-4 promulgated under the Exchange Act. If we do become a foreign private issuer, we would be exempt from certain rules and regulations in the United States that are applicable to U.S. domestic issuers, including: - the rules under the Exchange Act requiring the filing with the SEC of quarterly reports on Form 10-Q or current report on Form 8-K;- the section of the Exchange Act regulating the solicitation of proxies, consents or authorizations respect of a security registered under the Exchange Act;- the section of the Exchange Act requiring directors, officers and 10% holders to file public reporting of their stock ownership and trading activities and imposing liability on insiders who profit from trades made in a short period of time; and - the selective disclosure rules under Regulation FD restricting issuers from selectively disclosing material nonpublic information. Accordingly, the information we would be required to file with or furnish to the SEC as a foreign private issuer is less extensive and less frequent as compared to the information required to be filed with the SEC by U.S. domestic issuers. In addition, if we become a foreign private issuer whose securities are listed on Nasdaq, we would permitted to, and may elect to, follow certain home country corporate governance practices in lieu of the requirements of the Nasdaq Rules pursuant to Nasdaq Rule 5615(a)(3). Certain corporate governance practices in the Cayman Islands, which is our home country, may differ significantly from the Nasdaq corporate governance listing standards applicable to U.S. domestic issuers and may afford our shareholders less protection than they otherwise would enjoy under the Nasdaq corporate governance listing standards applicable to U.S. domestic issuers. We would be required to disclose any significant ways in which our corporate governance practices differ from those followed by U.S. domestic issuers under Nasdaq corporate governance listing standards in an annual report on Form 20-F filed with the SEC or on our website.

We have never declared or paid cash dividends on its capital stock. We currently intend to retain all of our future earnings, if any, to finance the growth and development of our business. In addition, the terms of any future debt agreements may preclude us from paying dividends. As a result, capital appreciation, if any, of our Class A Ordinary Shares will be your sole source of gain for the foreseeable future.

We are a holding company and have no material assets other than cash and our ownership of Class V shares in MoonLake AG and common shares in MoonLake AG ("MoonLake AG Common Shares"). As such, we have no independent means of generating revenue or cash flow, and our ability to pay taxes and operating expenses or declare and pay dividends in the future, if any, will be dependent upon the financial results and cash flows of MoonLake AG and its subsidiaries, and distributions we receive from MoonLake AG. There can be no assurance that MoonLake AG and its subsidiaries will generate sufficient profits and/or cash flow to distribute funds to us, or that applicable laws and contractual restrictions, including negative covenants in any debt agreements of MoonLake AG or its subsidiaries, will permit such distributions. Distributions by MoonLake AG to the Company are subject to a Swiss federal dividend withholding tax at the statutory rate of 35%, unless and to the extent that such distributions constitute a repayment of duly reported capital contributions. Under the current structure, we are not entitled to any relief from Swiss federal dividend withholding tax, such that MoonLake AG will be required to deduct the Swiss federal dividend withholding tax at the statutory rate of 35% and that such tax deduction will result in a final tax burden for the Company. If our place of management is relocated to Switzerland such withholding tax on distributions from MoonLake AG to us may be eliminated (although such relocation would result in Swiss withholding taxes applying on distributions from us to our shareholders; depending on the specific shareholder, such shareholder may be entitled to a full or partial relief or credit for such Swiss withholding tax). There can be no assurances that our place of management will be relocated or that such withholding tax will be reduced or eliminated.

We may, in the future, form or seek strategic alliances, create joint ventures or collaborations, or enter into licensing arrangements with third parties that we believe will complement or augment our development and commercialization efforts with respect to SLK and/or our Company more broadly. Any of these relationships may require us to increase our near and long-term expenditures, issue securities that dilute our existing shareholders or disrupt our management and business.

Heightened governmental scrutiny over the manner in which manufacturers set prices for their marketed drug products has resulted in several recent Congressional inquiries and proposed and enacted federal and state legislation designed to, among other things, bring more transparency to product pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for products. We expect that additional state and federal healthcare reform measures may be adopted in the future, any of which could limit the amounts that federal and state governments will pay for healthcare therapies, which could result in reduced demand for our drug candidate, if approved for commercial use, or additional pricing pressures. Most recently, on August 16, 2022, President Biden signed into law the IRA, which, among other provisions, included several measures intended to lower the cost of prescription drugs and related healthcare reforms. We cannot be sure whether additional legislation or rulemaking related to the IRA will be issued or enacted, or what impact, if any, such changes will have on the profitability of any of our drug candidates, if approved for commercial use, in the future.

We are subject to laws and regulations related to, among other things, privacy, data protection, information security and consumer protection across different markets where we conduct our business. Such laws and regulations are constantly evolving and changing and are likely to remain uncertain for the foreseeable future. Our actual or perceived failure to comply with such obligations could have an adverse effect on our business, operating results and financial operations. Complying with these numerous, complex, and often changing regulations is expensive and difficult, and failure to comply with any data protection, privacy laws or data security laws or any security incident or breach involving the potential or actual misappropriation, loss or other unauthorized processing, use or disclosure of sensitive or confidential patient, consumer or other personal information, whether by us, one of our collaborators or another third party, could adversely affect our business, financial condition, and results of operations, including but not limited to investigation costs, material fines and penalties, compensatory, special, punitive, and statutory damages, litigation, consent orders regarding our privacy and security practices, requirements that we provide notices, credit monitoring services, and/or credit restoration services or other relevant services to impacted individuals, adverse actions against our licenses to do business, reputational damage and injunctive relief. The collection and use of personal health data and other personal data in the EU is governed by the provisions of the GDPR, which became applicable in May 2018, and related data protection laws in individual EU Member States. The GDPR imposes a number of strict obligations and restrictions on the ability to process (processing includes collecting, analyzing and transferring) personal data of individuals, in particular with respect to health data from clinical trials and adverse event reporting. The GDPR includes requirements relating to the legal basis of the processing (such as consent of the individuals to whom the personal data relates), the information provided to the individuals prior to processing their personal data, the notification obligations to the national data protection authorities, and the security and confidentiality of the personal data. EU Member States may also impose additional requirements in relation to health, genetic and biometric data through their national legislation. In addition, the GDPR imposes specific restrictions on the transfer of personal data to countries outside of the EEA that are not considered by the EC to provide an adequate level of data protection. Appropriate safeguards are required to enable such transfers. Among the appropriate safeguards that can be used, the data exporter may use the EC's standard contractual clauses ("SCCs"). In this respect, recent legal developments in Europe have created complexity and compliance uncertainty regarding certain transfers of personal data from the EEA. For example, following the Schrems II decision of the Court of Justice of the EU on July 16, 2020, in which the Court invalidated the Privacy Shield under which personal data could be transferred from the EEA to United States entities who had self-certified under the Privacy Shield scheme, there is uncertainty as to the general permissibility of international data transfers under the GDPR. The Court did not invalidate the then-current SCCs, but ruled that data exporters relying on these SCCs are required to verify, on a case-by-case basis, if the law of the third country ensures a level of data protection that is essentially equivalent to that guaranteed in the EEA. In light of the implications of this decision, we may face difficulties regarding the transfer of personal data from the EEA to third countries. In 2021 the EC issued a new set of SCCs. Since December 27, 2022, the previous set of SCCs can no longer be used. When relying on SCCs, the data exporters are also required to conduct a transfer risk assessment to verify if anything in the law and/or practices of the third country may impinge on the effectiveness of the SCCs in the context of the transfer at stake and, if so, to identify and adopt supplementary measures that are necessary to bring the level of protection of the data transferred to the EU standard of essential equivalence. Where no supplementary measure is suitable, the data exporter should avoid, suspend or terminate the transfer. On June 18, 2021, the European Data Protection Board adopted recommendations to assist data exporters with such assessment and their duty to identify and implement supplementary measures where they are needed to ensure compliance with the EU level of protection to the personal data they transfer to third countries. With regard to the transfer of personal data from the EEA to the United States, on July 10, 2023, the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework. On the basis of the new adequacy decision, personal data can flow from the EEA to United States companies participating in the framework. In the event of a personal data breach, the GDPR also requires us, as a controller, to notify the competent supervisory authorities and/or the affected data subjects. Such notification must be issued without undue delay, and where feasible not later than 72 hours after having become aware of the data breach. The notification obligation exists regardless of whether the processing is carried out on our or our vendors' systems. The only exception where such notification may be omitted is if the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. In addition to the disruptions to our business and impact to our reputation that any such breach of security could cause, we may be subject to regulatory fines, class actions, or other costly measures if there is a personal data breach on our or our vendors' systems. Furthermore, under the GDPR, when we act as a processor, we must notify the relevant controller without undue delay after become aware of a personal data breach. Failure to comply with the requirements of the GDPR and the related national data protection laws of the EU Member States may result in significant monetary fines for noncompliance of up to €20 million or 4% of the annual global turnover of the noncompliant company, whichever is greater, other administrative penalties and a number of criminal offenses (punishable by uncapped fines) for organizations and, in certain cases, their directors and officers, as well as civil liability claims from individuals whose personal data was processed. Data protection authorities from the different EU Member States may still implement certain variations, enforce the GDPR and national data protection laws differently, and introduce additional national regulations and guidelines, which adds to the complexity of processing personal data in the EU. Guidance developed at both the EU level and at the national level in individual EU Member States concerning implementation and compliance practices are often updated or otherwise revised. Furthermore, there is a growing trend towards the required public disclosure of clinical trial data in the EU, which adds to the complexity of obligations relating to processing health data from clinical trials. Such public disclosure obligations are provided in the new EU CTR, EMA disclosure initiatives and voluntary commitments by industry. Failing to comply with these obligations could lead to government enforcement actions and significant penalties against us, harm to our reputation, and adversely impact our business and operating results. The uncertainty regarding the interplay between different regulatory frameworks, such as the CTR and the GDPR, further adds to the complexity that we face with regard to data protection regulation. With regard to the transfer of data from the EU to the United Kingdom, on June 28, 2021 the EC adopted two adequacy decisions for the UK – one under the GDPR and the other for the Law Enforcement Directive. Personal data may now freely flow from the EU to the UK since the UK is deemed to have an adequate data protection level for purposes of the EU regime. However, the adequacy decisions include a ‘sunset clause' which entails that the decisions will automatically expire four years after their entry into force, unless renewed. Additionally, following the UK's withdrawal from the EU and the EEA, known as Brexit, companies also have to comply with the UK's data protection laws (including the GDPR, as incorporated into UK national law), the latter regime having the ability to impose fines up to the greater of £17.5 million or 4% of global turnover. Furthermore, transfers from the UK to other countries, including the EEA, are subject to specific transfer rules under the UK regime; personal data may freely flow from the UK to the EEA, since the EEA is deemed to have an adequate data protection level for purposes of the UK regime. These UK international transfer rules broadly mirror the EU GDPR rules. With regard to the transfer of personal data from the UK to the United States, from 12 October 2023, businesses in the UK can start to transfer personal data to US organizations certified to the "UK Extension to the EU-US Data Privacy Framework" (UK Extension) under the UK GDPR, without the need for further safeguards. On March 21, 2022, the international data transfer agreement (IDTA) and the international data transfer addendum to the EC's standard contractual clauses for international data transfers (Addendum), and a document setting out transitional provisions came into force and replaced the old EU SCCs for purposes of the UK regime. However, the transitional provisions, adopted with the IDTA and the Addendum, provide that contracts concluded on or before 21 September 2022 on the basis of any old EU SCCs continue to provide appropriate safeguards for the purpose of the UK regime until 21 March 2024, provided that the processing operations that are the subject matter of the contract remain unchanged and appropriate safeguards can be ensured. Furthermore, processing of personal data in Switzerland is governed by restrictive regulations, in particular with respect to health and medical data. The collection, storage, use, revision, disclosure, archiving or destruction of personal data in Switzerland is subject to the Federal Act on Data Protection (the "FDAP"); as well as various other federal and cantonal acts governing medical research and professional secrecy. This regulatory regime is going to be strongly adjusted by the revision of the FDAP, which is coming into force on the September 1, 2023. The FDAP is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data and taking certain measures when engaging third-party processors. Compliance with the FDAP will be a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to sanctions. Breaches of or non-compliance with applicable data protection regulations and professional secrecy obligations could result in fines, or, under certain circumstances, imprisonment of the individuals responsible for the breach or non-compliance. The sanctions regime relating to data protection obligations will be more comprehensive under the revised FDAP. We cannot assure you that our third-party service providers with access to our or our customers', suppliers', trial patients' and employees' personally identifiable and other sensitive or confidential information will not breach contractual obligations imposed by us, or that they will not experience data security breaches or attempts thereof, which could have a corresponding effect on our business, including putting us in breach of our obligations under privacy laws and regulations and/or which could in turn adversely affect our business, results of operations, and financial condition. We cannot assure you that our contractual measures and our own privacy and security-related safeguards will protect us from the risks associated with the third-party processing, use, storage, and transmission of such information. Any of the foregoing could have a material adverse effect on our business, financial condition, results of operations, and prospects.

We are exposed to the risk that our employees, independent contractors, consultants, commercial collaborators, principal investigators, CROs, suppliers and vendors acting for or on our behalf may engage in misconduct or other improper activities. We have adopted a code of conduct to more closely reflect our operations, but it is not always possible to identify and deter misconduct by these parties and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations.

We do not currently own or operate any facility that may be used to produce SLK (including any drug substance or finished drug product) and must currently rely on CMOs to produce them for us. We have not yet caused SLK to be manufactured in a commercially validated and registered process and may not be able to do so. We do not control the manufacturing process of, and are completely dependent on, our contract manufacturing partners for compliance with cGMP requirements and any other regulatory requirements of the FDA or other regulatory authorities for the manufacture of SLK. Beyond periodic audits, we have no control over the ability of our CMOs to maintain adequate quality control, quality assurance and qualified personnel. If the FDA, EMA, or a comparable foreign regulatory authority does not approve these facilities for the manufacture of SLK or if it withdraws any approval in the future, we may need to find alternative manufacturing facilities, which would require the incurrence of significant additional costs and materially and adversely affect our ability to develop, obtain regulatory approval for or market SLK, if approved. Similarly, our failure, or the failure of our CMOs, to comply with applicable regulations could result in sanctions being imposed on us, including fines, injunctions, civil penalties, delays, suspension or withdrawal of approvals, license revocation, seizures or recalls of SLK, operating restrictions and criminal prosecutions, any of which could significantly and adversely affect supplies of SLK and harm our business and results of operations. Moreover, if any CMOs on which we will rely fail to manufacture quantities of SLK at quality levels necessary to meet regulatory requirements and at a scale sufficient to meet anticipated demand at a cost that allows us to achieve profitability, our business, financial condition and prospects could be materially and adversely affected. Our business could be similarly affected by business disruptions to our third-party providers with potential impacts on our future revenue and financial condition and our costs and expenses. Each of these risks could delay or prevent the completion of our clinical trials or the approval of SLK by the FDA, result in higher costs or adversely impact commercialization of SLK. Moreover, we have not yet completed the development of the autoinjector device for SLK and may not be able to do.

The Biologics Price Competition and Innovation Act of 2009 (the "BPCIA"), was enacted as part of the ACA to establish an abbreviated pathway for the approval of biosimilar and interchangeable biological products. The regulatory pathway establishes legal authority for the FDA to review and approve biosimilar biologics, including the possible designation of a biosimilar as "interchangeable" based on its similarity to an approved biologic. Under the BPCIA, a reference biological product is granted 12 years of data exclusivity from the time of first licensure of the product, and the FDA will not accept an application for a biosimilar or interchangeable product based on the reference biological product until four years after the date of first licensure of the reference product. In addition, the approval of a biosimilar product may not be made effective by the FDA until 12 years from the date on which the reference product was first licensed. During this 12-year period of exclusivity, another company may still develop and receive approval of a competing biologic, so long as their BLA does not reply on the reference product, sponsor's data or submit the application as a biosimilar application. The law is complex and is still being interpreted and implemented by the FDA. As a result, its ultimate impact, implementation, and meaning are subject to uncertainty, and any new policies or processes adopted by the FDA could have a material adverse effect on the future commercial prospects for our biological products. We believe that SLK approved in the United States as a biological product under a BLA should qualify for the 12-year period of exclusivity. However, there is a risk that this exclusivity could be shortened due to congressional action or otherwise, or that the FDA will not consider the subject product candidates to be reference products for competing products, potentially creating the opportunity for biosimilar competition sooner than anticipated. Moreover, the extent to which a biosimilar, once approved, will be substituted for any one of the reference products in a way that is similar to traditional generic substitution for non-biological products is not yet clear, and will depend on a number of marketplace and regulatory factors that are still developing. The approval of a biosimilar of our product candidates could have a material adverse impact on our business due to increased competition and pricing pressure.