Waldencast Acquisition (WALD) Risk Factors

We are subject to a variety of laws and regulations in the U.S. and abroad regarding privacy and data protection, some of which can be enforced by private parties or government entities and some of which provide for significant penalties for noncompliance. Such laws and regulations govern the collection, use, disclosure, retention, and security of personal information, such as information that we may collect in connection with sales on our e-commerce websites or during clinical trials of our products. Implementation standards, interpretations and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to collect, store, transfer, use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, or result in additional liability for us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with federal, state or foreign laws or regulation, our internal policies and procedures or our contracts governing our processing of personal information could result in negative publicity, claims by third parties, government investigations and enforcement actions, including injunctions, fines and/or criminal penalties if we knowingly obtain or disclose individually identifiable health information from a covered entity in a manner that is not authorized or permitted by HIPAA or applicable state laws, any of which could have a material adverse effect on our operations, financial performance and business. In the U.S., numerous federal and state laws and regulations, including federal and state health information privacy laws, state data breach notification laws, and federal and state consumer protection laws that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators and third-party providers. For example, the California Consumer Privacy Act (the "CCPA"), which went into effect on January 1, 2020, creates individual privacy rights for California consumers, including the right to opt out of certain disclosures of personal information, increases the privacy and security obligations of entities handling certain personal information, and also establishes significant penalties for noncompliance. The CCPA also provides for a private right of action for data breaches, which is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. Additionally, in November 2020, California voters passed the California Privacy Rights Act (the "CPRA"). The CPRA, which went into effect on January 1, 2023, significantly expands the CCPA, including by introducing additional obligations such as data minimization and storage limitations, granting additional rights to consumers such as correction of personal information and additional opt-out rights and creating a new entity, the California Privacy Protection Agency, to implement and enforce the law. The CPRA may require us to modify our data collection or processing practices and policies, cause us to incur substantial costs and expenses to comply, and increase our potential exposure to regulatory enforcement and/or litigation. Other U.S. states have also enacted or are considering enacting stricter data privacy laws. For example, in March 2021, Virginia enacted the Virginia Consumer Data Protection Act and, in March 2022, Utah enacted the Utah Consumer Privacy Act, comprehensive privacy statutes that are similar to the CCPA and CPRA. Further, the FTC and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, violating consumers' privacy rights or failing to take appropriate steps to keep consumers' personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. We are also subject to rapidly evolving data protection laws, rules and regulations in foreign jurisdictions. For example, the EU's General Data Protection Regulation 2016/679 (the "EU GDPR") and the U.K. General Data Protection Regulation and the U.K.'s Data Protection Act 2018 (the "U.K. GDPR"; and together with the EU GDPR, the "GDPR") governs certain collection and other processing activities involving personal data about data subjects in the European Economic Area ("EEA") and U.K. respectively. The U.K. GDPR is likely to be subject to divergence from the EU GDPR over time. Among other things, the GDPR imposes requirements regarding the security of personal data and the rights of data subjects to access and delete personal data, requires having lawful bases on which personal data can be processed, includes requirements relating to the consent of individuals to whom the personal data relates (such consent relates to the lawful processing of personal data under the GDPR and is distinct from others consents obtained from individuals in connection with clinical trial participation), requires detailed notices for clinical trial participants and investigators and regulates transfers of personal data from the EEA to third countries that have not been found to provide adequate protection to such personal data, including the U.S. (and these restrictions have heightened in light of recent case law and regulatory guidance). In addition, the EU GDPR imposes substantial administrative fines for breaches and violations ranging from €10.0 million to €20.0 million or 2% to 4% of our annual global revenue, whichever is higher and the U.K. GDPR imposes separate and additional fines ranging from £8.7 million to £17.5 million or 2% to 4% of total worldwide annual revenue, whichever is higher. The GDPR also confers a private right of action on data subjects to lodge complaints with supervisory authorities, seek judicial remedies (including data subject-led class actions and injunctions) and obtain compensation for damages resulting from violations of the GDPR. We are also subject to EEA and U.K. rules with respect to cross-border transfers of personal data outside of the EEA and U.K. to third countries. The GDPR generally prohibits the transfer of EEA and U.K. personal data to third countries whose laws do not ensure an adequate level of protection, unless a valid data transfer mechanism has been implemented or an Article 49 GDPR derogation applies. Legal developments in the EEA and U.K. have created complexity and uncertainty regarding transfers of personal data. As supervisory authorities issue further guidance on personal data transfer mechanisms, transfer risk assessments, and supplementary measures for the security of transferred personal data or start taking enforcement action, we could be subject to additional costs, complaints or regulatory investigations or fines, or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we operate our business and could harm our business, financial condition and results of operations. In October 2022, President Biden signed an Executive Order on "Enhancing Safeguards for United States Signals Intelligence Activities" which introduced new binding safeguards to address the concerns raised by the Court of Justice of the European Union in its Schrems II judgement. Although this Executive Order is intended to form the basis of a new EU-US Data Privacy Framework (the "Framework"), the Framework is still in development and its route to implementation remains uncertain. In June 2021, the European Commission published a new set of modular standard contractual clauses (the "New SCCs"). The New SCCs must be used for all relevant transfers of personal data outside the EEA (since December 2022) and organizations must ensure that all new and existing contracts involving the transfer of personal data outside the EEA contain New SCCs. Although the European Commission adopted an adequacy decision for the U.K. in June 2021 allowing the continued flow of personal data from the EEA to the U.K., this decision will automatically expire in June 2025 unless the European Commission re-assesses and renews or extends that decision. The decision will be regularly reviewed by the European Commission going forward and may be revoked if the U.K. diverges from its current data protection laws and the European Commission deems the U.K. to no longer provide adequate protection of personal data. In March 2022, the U.K. implemented its own U.K.-specific international data transfer agreement ("IDTA") and addendum to the New SCCs ("U.K. Addendum"). For all contracts involving transfers of U.K.-originated data entered into after September 2022, organizations that transfer U.K. personal data are required to use the IDTA, or the New SCCs together with the U.K. Addendum. Existing contracts involving transfers of U.K.-originated data relying on standard contractual clauses must be migrated to the IDTA, or the New SCCs together with the U.K. Addendum by March 2024. The cross-border data transfer landscape in the EEA and U.K. is continually developing, and we are monitoring these developments. We may, in addition to other impacts, experience additional costs associated with increased compliance burdens and be required to engage in new contract negotiations with third parties that aid in processing data on our behalf or localize certain data. We may experience reluctance or refusal by current or prospective European customers to use our products, and we may find it necessary or desirable to make further changes to our handling of personal data of EEA and U.K.-based data subjects. The cross-border data transfer landscape globally (including in the EEA, U.K. and U.S.) is continually evolving, and other countries outside of Europe have enacted or are considering enacting cross-border data transfer restrictions and laws requiring data localization, which may affect our ability to process or transfer personal data from Europe or elsewhere. Inability to import personal data to the U.S. may significantly and negatively impact our business. Regulators in the EEA and the U.K. are increasingly focusing on compliance with requirements in cookies and tracking technologies and the online behavioral advertising ecosystem, with a notable rise in enforcement activity from supervisory authorities across the EEA in relation to cookies-related violations, resulting in significant fines as supervisory authorities increasing adopt a fact-based approach. National laws in the EEA that implement the ePrivacy Directive are likely to be replaced by the ePrivacy Regulation, which, though still in development, will if adopted, impose new obligations on the use of personal data in the context of electronic communications, particularly in relation to online tracking technologies and direct marketing, and will significantly increase fines for noncompliance, although it will not have effect in the U.K. In the U.K., it is possible that we will be subject to separate and additional legal regimes with respect to ePrivacy, which may result in further costs and may necessitate changes to our business practices. The GDPR requires opt-in, informed consent for the placement of cookies on a customer's device, and imposes conditions on obtaining valid consent (e.g., a prohibition on prechecked consents). Increased regulation of cookies tracking technologies and online behavioral advertising may lead to broader restrictions and impairments on our online activities, including our ability to identify and potentially target users, lead to substantial costs, require significant systems changes, negatively impact our efforts to understand our customers and subject us to additional liabilities. Compliance with existing, not yet effective, and proposed privacy and data protection laws and regulations can be costly and can delay or impede our ability to market and sell our products, affect our ability to conduct business through websites and mobile applications we and our partners may operate, require us to modify or amend our information practices and policies, change and limit the way we use consumer information in operating our business, increase our operating costs, or require significant management time and attention. Failure to comply could result in negative publicity or subject us to inquiries or investigations, claims or other remedies, including significant fines and penalties, or demands that we modify or cease existing business practices. We may also face civil claims, including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, and diversion of internal resources. Any of the foregoing could have a material adverse effect on our business, financial condition and results of operations.

Our operations are dependent upon a relatively small group of individuals and in particular, Michel Brousset and Hind Sebti, our Chief Growth Officer. We believe that our success depends on the continued service of our directors and officers. We do not have key-man insurance on the life of any of our directors or officers. The unexpected loss of the services of one or more of our directors or officers could have a detrimental effect on us. Additionally, our success and future growth depend upon the services of Obagi's and Milk's management teams and other key employees, including highly skilled experts in their respective fields. In 2023, we made extensive changes to senior management at Obagi, finding seasoned experts to join Obagi as the new President, Chief Financial Officer and Chief Marketing Officer with in-depth expertise in their respective fields. However, these new executives have only recently taken on these roles and we cannot assure you that they will integrate well into the Obagi business, that we will be able to retain them, or that they will be able to successfully manage and operate the business, maintain our existing relationships with key suppliers and customers and retain other highly skilled key employees of Obagi. The loss of one or more members of Obagi's or Milk's management teams or key employees could harm our business, and we may not be able to find adequate replacements. Our success depends on our continued ability to attract, retain and motivate highly qualified management, business development, sales and marketing, product development and other personnel for our Obagi Skincare and Milk Makeup businesses. We may have difficulty recruiting and retaining such qualified personnel due to current market conditions, their inability to trade their equity awards and the existence of many similar competitive job openings. There is intense competition in our industry particularly for senior sales and marketing and research and product development positions. The failure to attract and retain qualified personnel could have a significant negative impact on our future product sales and business results. In addition, prospective and existing employees and independent contractors often consider the value of the equity awards they receive in connection with their employment. If the perceived value of our equity awards declines, experiences significant volatility or increases such that prospective employees or independent contractors believe there is limited or less upside to the value of such equity awards, it may adversely affect our ability to recruit and retain key employees and independent contractors. If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and future growth prospects would be harmed. Although we currently maintain directors' and officers' liability insurance coverage, such coverage may not be sufficient to cover the types or extent of claims or loss that may be incurred or received. Our inability to obtain and maintain appropriate insurance coverage could cause a substantial business disruption, adverse reputational impact and regulatory scrutiny. If we incur any loss that is not covered by our directors' and officers' liability insurance policy, or the compensated amount is significantly less than our actual loss, our business, financial condition and results of operations could be materially and adversely affected.

A significant component of our growth strategy involves expanding sales of our Obagi Skincare and Milk Makeup products internationally. We generate an increasing share of our revenue from international sales and maintain international operations, including supply and distribution chains that are, and will continue to be, an increasingly significant part of our business. International sales of our Obagi Skincare products currently depend upon the marketing efforts of and sales by certain distributors and licensees. The SA Distributor accounted for a significant portion of our net revenue for the period from July 28 to December 31, 2022 (the "2022 Successor Period"), the period from January 1 to July 27, 2022 (the "2022 Predecessor Period") and year ended December 31, 2021 ("2021 Predecessor Period"). In March 2023, we acquired a majority interest in Obagi Vietnam Import Export Trading MTV Company Limited, a company incorporated in accordance with the laws of Vietnam and formed by the SA Distributor to conduct its business in Vietnam ("Obagi Vietnam"). Due to some of the challenges described elsewhere in this Report, Obagi Skincare related revenue for Vietnam decreased in the year ended December 31, 2023 (Successor Period) compared to prior periods. Given the distribution in Vietnam was previously conducted by the SA Distributor, we have set up our own resources and teams in order to directly sell and distribute Obagi Skincare products in this country. During the course of 2023 (Successor Period), we also began to establish our own entities in various other countries in Southeast Asia to distribute products directly in those countries as well, which required an initial investment in facilities, personnel and registration of products and other start-up costs. We may experience significant delays between incurring these costs and the sale of products in these countries as a result of required business or regulatory licenses or product approvals and the time required to establish a market presence in a new geographic region. We cannot assure you that we will be able to successfully promote, distribute and sell our products in each of these new markets. Our success in executing on our international expansion strategy will depend upon our ability to, among other things: - secure all required product and business licenses to operate the business in its jurisdiction;- develop relationships with sub-distributors, retailers, customers and other business partners in the country;- attract and retain talent and create processes and systems; and - expand brand awareness, adjust our products to accommodate local consumer preferences and expand our distribution channels and networks within the country. Our future business operations in new countries are subject to the economic, political and legal environment in such geographic areas. In particular, Vietnam's economy differs from the economies of the countries in which we currently operate in many respects such as governmental involvement, level of development, growth rate, allocation of resources and inflation rate. The regulatory landscape in Vietnam is also complex and we may encounter difficulties obtaining and maintaining authorizations required by the governmental authorities to import, market and sell our products in this country. Relevant laws and regulations, as well as their interpretations, may be unclear or may evolve in Vietnam. This can make it difficult for us to assess which licenses and approvals are necessary to operate the business of Obagi Vietnam or the processes for obtaining such licenses in Vietnam. For these reasons, we also cannot be certain that we will be able to maintain the licenses and approvals that we have previously obtained, or that once they expire, we will be able to renew them. We cannot be sure that our interpretations of the rules and their exemptions have been or will be consistent with those of the local regulators. As we expand the business of Obagi in Southeast Asia, we may be required to obtain new licenses in other countries, which could be a complex and timely process, and comply with additional laws and regulations in the new markets in which we plan to operate. The foreign regulatory approval process may include all of the risks associated with obtaining FDA approval. In addition, many countries from time to time evaluate the regulatory status of various products and ingredients. We may not obtain foreign regulatory approvals on a timely basis, if at all, or may choose not to implement a country's labeling requirements if to do so would have a negative impact on our international or domestic operations. The intellectual property laws in Vietnam and the other countries in Southeast Asia may not be as protective as those in the U.S. and we may encounter difficulties asserting rights against those who misappropriate our intellectual property to sell counterfeit products using our trade names. Moreover, the laws and regulations in these jurisdictions have in the past, and may in the future, change rapidly, and we may not be able to adapt quickly to such changes, which could disrupt our operations. The legal systems of Vietnam and other countries in Southeast Asia differ from most common law jurisdictions. For instance, in Vietnam, previously decided legal cases have little precedential value. The laws and regulations are subject to broad and varying interpretations by government officials and courts. For vague regulations, the courts of Vietnam have the power to read implied terms into contracts, adding a further layer of uncertainty. As a result, government officials and courts often express different views from lawyers on the legality, validity and effect of a particular legal document. In addition, the views of a governmental authority received on a particular issue may have no binding effect or finality, so there is no guarantee that similar issues will be dealt with in a similar way by other governmental authorities. Furthermore, recognition and enforcement of legal rights through Vietnam courts, arbitration centers and administrative agencies in the event of a dispute is uncertain. Our ability to execute our international growth strategy will depend, in part, on our ability to penetrate new international markets and increase the localization of our products and services. We expect to continue to increase our sales and presence outside the U.S., particularly in markets we believe to have high-growth potential. The substantial up-front investment required, the lack of consumer awareness of our products in certain jurisdictions outside of the U.S., differences in consumer preferences and trends between the U.S. and other jurisdictions, the risk of inadequate intellectual property protections and differences in packaging, labeling and related laws, rules and regulations are all substantial matters that need to be evaluated prior to doing business in new jurisdictions and make the success of our international efforts uncertain. As we continue to expand our international sales, our business will increasingly be subject to certain risks inherent in international business, many of which are beyond our control. These risks include: - local political and economic instability;- increased expenses for developing, testing and making localized versions of our products;- difficulties in hiring and retaining employees;- differing employment practices and laws and labor;- difficulties in registering products in multiple jurisdictions with varying regulatory requirements and in maintaining such registrations;- risks of noncompliance by our distributors, retailers or partners or agents with, and burdens of complying with, a wide variety of extraterritorial, regional and local laws, including competition laws and anti-bribery laws such as the Foreign Corrupt Practices Act ("FCPA") and the U.K. Bribery Act 2010 (the "Bribery Act"), despite our compliance efforts and activities;- the impact of government-led initiatives to encourage the purchase or support of domestic vendors, which can affect the willingness of customers to purchase products from, or collaborate to promote interoperability of products with, companies whose headquarters or primary operations are not domestic;- adverse changes in tariff and trade protection measures;- unexpected changes or differences in foreign regulatory requirements;- potentially negative consequences from changes in tax laws;- the potential business failure of one or more of our distribution partners;- exchange rate risks;- potential natural disasters in countries where our products are sold;- differing degrees of protection for intellectual property; and - difficulties in coordinating foreign distribution. Any of these factors could adversely affect our business, financial condition and results of operations. We cannot assure you that we can successfully manage these risks or avoid their effects.

Our business is exposed to fluctuations in exchange rates. Although our reporting currency is the U.S. dollar, we operate in different geographical areas and transact in a range of currencies in addition to the U.S. dollar, such as the British pound, the Canadian dollar, the Chinese yuan, the EU euro and the Vietnamese dong. As a result, movements in exchange rates may cause our revenue and expenses to fluctuate, impacting our profitability, financial position and cash flows. Future business operations and opportunities, including our planned expansion of our business outside the U.S., may further increase the risk that cash flows resulting from these activities may be adversely affected by changes in currency exchange rates. In the event we are unable to offset these risks, there could be a material adverse effect on our business and operations. In appropriate circumstances where we are unable to naturally offset our exposure to these currency risks, we may enter into derivative transactions to reduce such exposures. Even where we implement hedging strategies to mitigate foreign currency risk, these strategies might not eliminate our exposure to foreign exchange rate fluctuations and involve costs and risks of their own, such as ongoing management time and expertise, external costs to implement the strategies and potential accounting implications. Nevertheless, exchange rate fluctuations may either increase or decrease our revenues and expenses as reported in U.S. dollars. Moreover, foreign governments may restrict transfers of cash out of the country and control exchange rates. There can be no assurance that we will be able to repatriate earnings generated, or cash held, by us and our subsidiaries due to exchange control restrictions or the requirements to hold cash locally to meet regulatory solvency requirements. This could have a material adverse effect on our business, financial condition and results of operations.