Xencor (XNCR) Risk Analysis

We expect that significant additional capital will be needed in the future to continue our planned operations. To the extent we raise additional capital by issuing equity securities, our stockholders may experience substantial dilution. We may sell common stock, convertible securities, or other equity securities in one or more transactions at prices and in a manner, we determine from time to time. These sales may also result in material dilution to our existing stockholders, and new investors could gain rights superior to our existing stockholders. Pursuant to our 2023 Equity Incentive Plan (2023 Plan), subject to the Board of Directors approval, our management is authorized to grant stock options and other equity-based awards to our employees, directors and consultants. As of December 31, 2024, we had options to purchase 12,370,081 shares outstanding under our equity compensation plans. In addition, we are also authorized to grant equity awards, including stock options, to our employees, directors, and consultants, covering up to 18,367,000 shares of our common stock, pursuant to our equity compensation plans. We plan to register the number of shares available for issuance or subject to outstanding awards under our equity compensation plans. On February 27, 2023, we filed an automatic universal shelf registration statement on Form S-3 (File No. 333-270030) as a well-known seasoned issuer as defined in Rule 405 under the Securities Act of 1933, as amended, which became effective upon filing (the Shelf Registration Statement). The Shelf Registration Statement allows us to offer an indeterminate amount of securities, including equity securities, debt securities, warrants, rights, units and depositary shares, from time to time as described in the Shelf Registration Statement. The specific terms of any offering under the Shelf Registration Statement will be established at the time of such offering. The Shelf Registration Statement will expire on February 27, 2026. On February 27, 2023, we entered into a sales agreement (the Sales Agreement) with SVB Securities LLC (the Agent) pursuant to which we may offer and sell, from time to time, through the Agent (the ATM Offering), shares of our common stock having an aggregate offering price of up to $200 million (the ATM Shares). Any ATM Shares offered and sold in the ATM Offering are to be issued pursuant to the Shelf Registration Statement and the 424(b) prospectus supplement relating to the ATM Offering dated February 27, 2023 (the ATM Prospectus). From the date of the ATM Prospectus through December 31, 2024, no shares of our common stock were sold pursuant to the ATM Offering and, as of December 31, 2024, we may sell shares of our common stock for remaining gross proceeds of up to $200 million from time to time pursuant to the ATM Prospectus.

Based on information available to us as of December 31, 2024 our executive officers, directors, 5% stockholders and their affiliates beneficially owned, as a group, approximately 56.8% of our voting stock. The interests of these stockholders may not be the same as or may even conflict with your interests. Therefore, our officers, directors and 5% stockholders and their affiliates will have the ability to influence us through this ownership position and so long as they continue to beneficially own a significant amount of our outstanding voting stock. These stockholders may be able to determine all matters requiring stockholder approval and this concentration of ownership may deprive other stockholders from realizing the true value of our common stock. For example, these stockholders, acting together, may be able to control elections of directors, amendments of our organizational documents, or approval of any merger, sale of assets, or other major corporate transaction. This may prevent or discourage unsolicited acquisition proposals, offers for our common stock or other transactions or arrangements that you may believe are in your best interest as one of our stockholders.

Prior to our initial public offering (IPO), there was no public market for our common stock. The trading price of our common stock is likely to be volatile. Since our IPO, the trading price of our common stock has ranged from a low of approximately $5.75 to a high of approximately $58.345. From January 2, 2024 to December 31, 2024, the trading price of our common stock ranged from a low of $15.31 to a high of $27.24. Our stock price could be subject to wide fluctuations in response to a variety of factors, including the following: 1.adverse results or delays, or cancellations of clinical trials by us or our partners;2.inability to obtain additional funding;3.changes in laws or regulations applicable to our products;4.inability to obtain adequate product supply for our product candidates, or the inability to do so at acceptable prices;5.adverse regulatory decisions;6.changes in the structure of healthcare payment systems;7.introduction of new products or technologies by our competitors;8.failure to meet or exceed product development or financial projections we provide to the public;9.the perception of the pharmaceutical and biotechnology industry by the public, legislatures, regulators and the investment community;10.announcements of significant acquisitions, strategic partnerships, joint ventures or capital commitments by us or our competitors;11.disputes or other developments relating to proprietary rights, including patents, litigation matters and our ability to obtain patent protection for our technologies;12.additions or departures of key scientific or management personnel;13.significant lawsuits, including patent or stockholder litigation;14.changes in the market valuations of similar companies;15.sales of our common stock by us or our stockholders in the future; and 16.trading volume of our common stock. In addition, the stock market in general, and the Nasdaq Global Market and biotechnology companies in particular, have experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of these companies. Broad market and industry factors may negatively affect the market price of our common stock, regardless of our actual operating performance. In the past, securities class action litigation has often been brought against a company following a decline in the market price of its securities. This risk is especially relevant for us because biopharmaceutical companies have experienced significant stock price volatility in recent years. If we face such litigation, it could result in substantial costs and a diversion of management's attention and resources, which could harm our business.

Pursuant to Section 404 of the Sarbanes-Oxley Act, our management is required to report on, and our independent registered public accounting firm is required to audit, the effectiveness of our internal control over financial reporting. The rules governing the standards that must be met for management to determine the adequacy of our internal control over financial reporting are complex and require significant documentation, testing, and possible remediation if a deficiency is identified. Annually, we perform activities that include reviewing, documenting, and testing our internal control over financial reporting. If we fail to maintain the adequacy of our internal control over financial reporting, we will not be able to conclude on an ongoing basis that we have effective internal control over financial reporting in accordance with Section 404 of the Sarbanes-Oxley Act. Any failure to achieve and maintain an effective system of internal control could result in materially misstated consolidated financial statements and a failure to meet our reporting obligations, which would likely cause investors to lose confidence in our reported financial information. This could result in significant expenses to remediate any internal control deficiency and lead to a decline in the price of our common stock. We previously concluded that certain periods of our historical financial statements should no longer be relied upon and should be restated to reflect the correct accounting for the sale of future royalties pursuant to the Ultomiris Royalty Sale Agreement and to account for additional tax liabilities. In addition, on February 7, 2025, RSM informed us that disclosure should be made or action should be taken to prevent future reliance on RSM's audit report filed with the Original Form 10-K for the year ended December 31, 2023 and completed interim review related to previously issued financial statements included in our Quarterly Reports on Form 10-Q for the quarters ended March 31, 2024, June 30, 2024 and September 30, 2024. In connection with this restatement, our management re-evaluated the effectiveness of our disclosure controls and procedures and internal control over financial reporting as of December 31, 2023. Our Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were not effective as of December 31, 2023, and our management concluded that our internal control over financial reporting was not effective as of December 31, 2023 due to material weaknesses (a material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis) related to the design of controls related to the review of the accounting treatment of the non-routine transactions and the evaluation of certain tax legislation. These material weaknesses led to the restatement of our audited financial statements for the year ended December 31, 2023 and the unaudited financial statements for the quarterly periods ended March 31, 2024, June 30, 2024 and September 30, 2024. On February 24, 2025, we filed an Annual Report on Form 10-K/A for the year ended December 31, 2023 and Quarterly Reports on Form 10-Q/As for the quarterly periods ended March 31, 2024, June 30, 2024 and September 30, 2024. We are in the process of implementing remediation plans to address these material weaknesses. While we believe these efforts will improve our internal controls and address the root causes of the material weaknesses, the material weaknesses cannot be considered completely remediated until applicable controls have been designed, implemented, have operated for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. We cannot be certain that the steps we are taking will be sufficient to remediate the control deficiencies that led to the material weaknesses in our internal control over financial reporting or prevent future material weaknesses or control deficiencies from occurring. In addition, we cannot be certain that we have identified all material weaknesses in our internal control over financial reporting, or that in the future we will not have additional material weaknesses in our internal control over financial reporting. For more information related to the material weaknesses and their remediation, see Part II, Item 9A Controls and Procedures of this Form 10-K.

Effective internal control over financial reporting is necessary for us to provide reliable financial reports in a timely manner. If we fail to adequately staff our accounting and finance function to address the additional demands that will be placed upon us as a public company, including the requirements of the Sarbanes-Oxley Act of 2002, or fail to maintain adequate internal control over financial reporting, it could prevent our management from concluding our internal control over financial reporting is effective and impair our ability to prevent material misstatements in our financial statements, which could cause our business to suffer. As a large accelerated filer, we are subject to additional internal control requirements of the Sarbanes-Oxley Act of 2002.

We have been subject to the reporting requirements of the Exchange Act and the other rules and regulations of the Securities and Exchange Commission (SEC) since December 2013. Effective for the year-ended December 31, 2016, we became a large accelerated filer and are subject to additional internal control and SEC reporting obligations. Compliance with the various reporting and other requirements applicable to public reporting companies requires considerable time, attention of management, and financial resources. Further, the listing requirements of The Nasdaq Global Market require that we satisfy certain corporate governance requirements relating to director independence, distributing annual and interim reports, stockholder meetings, approvals, and voting, soliciting proxies, conflicts of interest and a code of conduct. Our management and other personnel need to devote a substantial amount of time to ensure that we comply with all of these requirements. Moreover, the reporting requirements, rules and regulations increase our legal and financial compliance costs and also make some activities more time-consuming and costly. These reporting requirements, rules, and regulations, coupled with the increase in potential litigation exposure associated with being a public company, could also make it more difficult for us to attract and retain qualified persons to serve on our Board of Directors or Board committees or to serve as executive officers, or to obtain certain types of insurance, including directors' and officers' insurance, on acceptable terms. In addition, being a public company could make it more difficult or more costly for us to obtain certain types of insurance, including directors' and officers' liability insurance, and we may be forced to accept reduced policy limits and coverage or incur substantially higher costs to obtain the same or similar coverage. The impact of these events could also make it more difficult for us to attract and retain qualified persons to serve on our Board of Directors, our Board committees, or as executive officers. Any changes we make to comply with these obligations may not be sufficient to allow us to satisfy our obligations as a public company on a timely basis, or at all.

We have never declared or paid any cash dividend on our common stock. We currently anticipate that we will retain future earnings for the development, operation and expansion of our business and do not anticipate declaring or paying any cash dividends for the foreseeable future. Any return to stockholders will therefore be limited to the appreciation of their stock.

Among policy makers and payors in the United States and elsewhere, there is significant interest in promoting changes in healthcare systems with the stated goals of containing healthcare costs, improving quality and/or expanding access. In the United States, the pharmaceutical industry has been a particular focus of these efforts and has been significantly affected by major legislative initiatives. Healthcare reform measures, if approved, may result in more rigorous coverage criteria and lower reimbursement, and in additional downward pressure on the price that may be charged for any of our product candidates.

The regulatory framework for the collection, use, safeguarding, sharing, transfer and other processing of information worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. Globally, virtually every jurisdiction in which we operate has established its own data security and privacy frameworks with which we must comply. Depending on our activities and operations we may be subject to privacy laws in other jurisdictions. For example, the collection, use, disclosure, transfer, or other processing of personal data regarding individuals in the European Union (the EU) including personal health data, is subject to the EU General Data Protection Regulation (GDPR) which took effect across all member states of the European Economic Area (EEA) in May 2018. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, and taking certain measures when engaging third-party processors. In addition, the GDPR imposes strict rules on the transfer of personal data to countries outside the EU, which includes the United States and, as a result, increases the scrutiny that clinical trial sites located in the EEA should apply to transfers of personal data from such sites to countries that are considered to lack an adequate level of data protection, such as the United States. The GDPR also permits data protection authorities to require destruction of improperly gathered or used personal data and/or impose substantial fines for violations of the GDPR, which can be up to 4% of global revenues or €20 million, whichever is greater, and it also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. In addition, the GDPR provides that EU member states may make their own additional laws and regulations limiting the processing of personal data, including genetic, biometric or health data. The European Data Protection Board continues to release guidelines for industries and impose fines related to the GDPR, some of which have been very significant. To improve coordination among EU supervisory authorities, the European Commission has proposed a new regulation that would help to streamline enforcement of the GDPR in cross-border cases. Meanwhile, there continues to be persistent uncertainty relating to the transfer of personal data from Europe to the U.S., or other non-adequate countries, following the Schrems II decision. On July 10, 2023, the European Commission adopted its adequacy decision on the EU-U.S. Data Privacy Framework (DPF). The decision, which took effect on the day of its adoption, concludes that the United States ensures an adequate level of protection for personal data transferred from the EEA to companies certified to DPF. However, it remains too soon to tell how the future of DPF will evolve and what impact it will have on our international activities. At least one challenge to the DPF is pending before the Court of Justice of the European Union. Further, Brexit has led and could also lead to legislative and regulatory changes that may increase our compliance costs. As of January 1, 2021 and the expiry of transitional arrangements agreed to between the UK and the EU, data processing in the UK is governed by a UK version of the GDPR (combining the GDPR and the Data Protection Act 2018), exposing us to two parallel regimes, each of which authorizes similar fines and other potentially divergent enforcement actions for certain violations. On June 28, 2021, the European Commission adopted an Adequacy Decision for the UK, allowing for the relatively free exchange of personal data between the EU and the UK (as the UK correspondingly allows transfers back to the EU). However, the European Commission may suspend the Adequacy Decision if it considers that the UK no longer provides for an adequate level of data protection. A bill to amend the existing UK framework has been reintroduced (in a different form) by the new UK Government and was announced as a bill which will be introduced into Parliament at the King's Speech on July 17, 2024. At this time, there is no specific clarity on the provisions of the bill, or the extent to which it will amend the UK framework, beyond general descriptions on its intended purpose. Similar actions are either in place or under way in the United States. There are a broad variety of data protection and breach notification laws that are applicable to our activities, and a wide range of enforcement agencies at both the state and federal levels that can review companies for privacy and data security concerns based on general consumer protection laws. Each of these laws is subject to varying interpretations and the legislative landscape is constantly evolving and the Federal Trade Commission (FTC) and state Attorneys General all are aggressive in reviewing privacy and data security protections for consumers. At the federal level, for example, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which establishes privacy and security standards that limit the use and disclosure of individually identifiable health information, or protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information. We may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, we could be subject to civil, criminal, and administrative penalties if we knowingly obtain, use, or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. Requirements for compliance under HIPAA are also subject to change, as the U.S. Department of Health and Human Services Office of Civil Rights issued a proposed rule that would amend certain security compliance requirements for covered entities and business associates. Even when HIPAA does not apply, according to the FTC, failing to take appropriate steps to keep consumers' personal data secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. In 2024, the FTC finalized updates to the Health Breach Notification Rule that, among other things, clarified its applicability to health apps and other similar technologies and expanded the information the breach notification requirements for entities subject to the rule which may add additional complexity to compliance obligations going forward. Additionally, new laws also are being considered at both the state and federal levels and several states have passed comprehensive privacy laws. For example, the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020, and as was later amended and expanded, is creating similar risks and obligations as those created by the GDPR, though the CCPA does exempt certain clinical trial data. The CCPA may increase our compliance costs and potential liability, and we cannot yet predict the impact of the CCPA on our business. Similar laws passed in various other states such as Virginia, Colorado, Connecticut, New Jersey and Texas, with effective dates through 2026. Some state laws also minimize what data can be collected from consumers and how businesses may use and disclose it. These state privacy laws also require businesses to make disclosures to consumers about data collection, use and sharing practices. In addition, some of these laws (including the CCPA), along with other standalone health privacy laws, subject health-related information to additional safeguards and disclosures and some specifically regulate consumer health data, such as the Washington My Health My Data Act, which became effective in 2023 and 2024, Nevada's Consumer Health Data Privacy Law, which became effective in 2024, and Connecticut's amendments to its privacy law to address health data, which became effective in 2023. Additionally, a broad range of legislative measures also have been introduced at the federal level. Accordingly, failure to comply with federal and state laws (both those currently in effect and future legislation) regarding privacy and security of personal data could expose us to fines and penalties under such laws. There also is the threat of consumer class actions related to these laws and the overall protection of personal data. Our employees and personnel use generative artificial intelligence, or AI, technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages. Given the breadth and depth of changes in data protection obligations, preparing for and complying with these requirements is rigorous and time intensive and requires significant resources and a review of our technologies, systems and practices, as well as those of any third-party collaborators, service providers, CROs, contractors or consultants that process or transfer personal data collected in the EU. The GDPR and other changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as healthcare data or other personal data from our clinical trials, and access to certain data such as the European Health Data Space Regulation, could require us to change our business practices and put in place additional compliance mechanisms, may interrupt or delay our development, regulatory and commercialization activities and increase our cost of doing business, and could lead to government enforcement actions, private litigation and significant fines and penalties against us and could have a material adverse effect on our business, financial condition or results of operations. Similarly, failure to comply with federal and state laws regarding privacy and security of personal data could expose us to fines and penalties under such laws. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business.

Social media is increasingly being used to communicate about our products, technologies and programs, and the diseases our product or product candidates are designed to treat. Social media practices in the biopharmaceutical industry continue to evolve and regulations relating to such use are not always clear. This evolution creates uncertainty and risk of noncompliance with regulations applicable to our business. For example, patients may use social media channels to comment on the effectiveness of a product or to report an alleged adverse event. When such disclosures occur, there is a risk that we fail to monitor and comply with applicable adverse event reporting obligations or we may not be able to defend ourselves or the public's legitimate interests in the face of the political and market pressures generated by social media due to restrictions on what we may say about our product or product candidates. There is also a risk of inappropriate disclosure of sensitive information or negative or inaccurate posts or comments about us on any social networking website. If any of these events were to occur or we otherwise fail to comply with applicable regulations, we could incur liability, face overly restrictive regulatory actions or incur other harm to our business.

We do not currently have nor do we plan to acquire the infrastructure or capability internally to manufacture our clinical drug supplies for use in the conduct of our clinical trials, and we lack the resources and the capability to manufacture any clinical candidates on a clinical scale. Instead, we rely on our third-party manufacturing partners to manufacture our clinical drug supply. Any of our contract manufacturers may not perform as agreed, may be unable to comply with cGMP requirements and with FDA, state and foreign regulatory requirements or may terminate their respective agreements with us. In addition, manufacturers are subject to ongoing periodic unannounced inspection by the FDA and other governmental authorities to ensure strict compliance with government regulations. We do not control the manufacturing processes of our third-party manufacturing partners, which include, among other things, quality control, quality assurance and the maintenance of records and documentation. If we were to experience an unexpected loss of supply, we could experience delays in our planned clinical trials as our third-party manufacturing partner would need to manufacture additional clinical drug supply and would need sufficient lead time to schedule a manufacturing slot. While there are other potential suppliers of clinical supplies of our biologics, the long transition periods necessary to switch manufacturers for any of our clinical drug supply would significantly delay our clinical trials and the commercialization of such products, if approved.