NASDAQ: REPL

We are conducting a number of clinical trials of RP1, both as a monotherapy and in combination with anti-PD-1 therapy, with the goal of establishing a major skin cancer treatment franchise.

Our leading clinical trial of RP1 is referred to as the IGNYTE trial, which is a multi-cohort clinical trial being conducted in collaboration with Bristol Myers Squibb Company, or BMS, under which BMS has granted us a non-exclusive, royalty-free license to, and is supplying at no cost, its anti-PD-1 therapy, nivolumab, for use in combination with RP1.

The leading tumor specific cohort in the IGNYTE trial is our registration directed Phase 2 expansion cohort in anti-PD-1 failed cutaneous melanoma. The anti-PD-1 failed melanoma cohort from the IGNYTE trial includes 140 patients who received RP1 in combination with nivolumab. The primary analysis by independent central review was triggered once all patients had been followed for at least 12 months. The topline results showed the overall response rate, or ORR, was 33.6% by modified RECIST 1.1 criteria, the primary endpoint as defined in the protocol, and 32.9% by RECIST 1.1 criteria, an additional analysis requested by the FDA. Responses from baseline were highly durable with 85% of responses lasting more than 12 months. The median duration of response from baseline was 27.6 months and the median duration of response from treatment initiation was 21.6 months. RP1 combined with nivolumab continues to be well-tolerated, with mainly Grade 1-2 "on target" side effects, observed. In September 2024, we presented the independently reviewed data from the IGNYTE trial, including key secondary endpoints and subgroup analysis as a late-breaking abstract during an oral session at the European Society for Medical Oncology, or ESMO. Data presented at ESMO showed activity across all subgroups, including patients who had prior anti-PD-1 and anti-CTLA-4 treatment had an ORR of 27.7% and patients who had primary resistance to anti-PD-1 had an ORR of 35.9% by modified RECIST v1.1. In November 2024, we presented a late-breaking abstract featuring the IGNYTE trial primary analysis that had been selected for oral presentation at the 39th Annual Meeting of the Society for Immunotherapy of Cancer (SITC 2024). The data presented at SITC 2024 included further clinical subgroup and initial biomarker data from the IGNYTE trial.

In November 2024, we announced submission of a biologics license application, or BLA, to the FDA for RP1 (vusolimogene oderparepvec) in combination with nivolumab for the treatment of adult patients with advanced melanoma who have previously received an anti-PD-1 containing regimen and that the FDA has granted Breakthrough Therapy designation to RP1 in combination with nivolumab in the same setting. The submission was made under the accelerated approval pathway. The FDA accepted our BLA and granted priority review with a Prescription Drug User Fee Act, or PDUFA, goal date of July

1

TABLE OF CONTENTS

22, 2025. The FDA recently completed their late-cycle review meeting and all manufacturing inspections for the BLA and we believe we remain on track for the July 22, 2025 PDUFA date.

In August 2024, we announced the dosing of the first patient in the IGNYTE-3 trial, or the I-3 trial, a confirmatory study design concept consisting of a 2-arm randomized Phase 3 clinical trial with physician's choice of treatment as a comparator arm in anti-PD-1 failed melanoma patients. With over 100 sites planned globally and an expectation to enroll 400 patients, the I-3 trial will assess RP1 in combination with nivolumab in patients with advanced melanoma who have progressed on anti-PD-1 and anti-CTLA-4 therapies or are ineligible for anti-CTLA-4 treatment. We continue to enroll patients in the I-3 trial.

In our non-melanoma skin cancer, or NMSC, cohort of the IGNYTE trial, we provided a data update in December 2023 from the first 30 patients with at least 6 months of follow up including patients with cutaneous squamous cell carcinoma, or CSCC, Merkel cell carcinoma, or MCC, basal cell carcinoma, and angiosarcoma in this cohort. The data showed that treatment with RP1 in combination with nivolumab led to an ORR of 30% which is consistent with data from the anti-PD-1 failed melanoma cohort with approximately one-third of patients responding and 60% demonstrating clinical benefit. The combination of RP1 and nivolumab was well tolerated in this patient population with a safety profile consistent with the overall experience seen with this treatment regimen to date. Enrollment remains open in this cohort.

Furthering development of RP1, we have open for enrollment a Phase 1b/2 clinical trial of single agent RP1 in solid organ transplant recipients with skin cancers, including CSCC, which we refer to as the ARTACUS trial. We believe that the ARTACUS trial will be potentially registrational (in its own right or, subject to discussion with regulatory authorities, following enrollment of additional patients, including as a potential label expansion after an initial approval of RP1 in a different indication). We are currently enrolling up to 65 patients in the ARTACUS trial to assess the safety and efficacy of RP1 in liver, kidney, heart, lung, and hematopoietic cell transplant patients with skin cancers. In November 2023 we presented initial data from the ARTACUS trial of RP1 monotherapy in solid organ transplant recipients with skin cancers at the Society for Immunotherapy of Cancer’s, or SITC, 38th Annual Meeting. The data included 23 evaluable patients with CSCC (n=20) and MCC (n=3), demonstrating an ORR of 34.5% and a complete response, or CR, of 21%. RP1 monotherapy was well tolerated in these patients and the safety profile was similar to that observed in our other RP1 clinical trials in patients who are not immune suppressed. No immune-mediated adverse events or evidence of allograft rejection were observed to result from RP1. This data was also presented during oral presentation at the American Association of Cancer Research 2024 Annual Meeting in April 2024. We continue to enroll patients into the ARTACUS trial.

As previously reported, our clinical trial of RP1 in patients with CSCC, which we refer to as the CERPASS trial, continues as planned to follow patients that were dosed in the trial.

We are also developing or are continuing to develop additional product candidates, RP2 and RP3, that have been further engineered to enhance anti-tumor immune responses and are intended to address additional tumor types, including traditionally less immune responsive tumor types. In addition to the expression of GALV-GP R(-) and human GM-CSF as in RP1, RP2 has been engineered to express an antibody-like molecule intended to block the activity of CTLA-4, a protein that inhibits the full activation of an immune response, including to tumors. RP3 has been engineered with the intent to further stimulate an anti-tumor immune response through activation of immune co-stimulatory pathways through the additional expression of the ligands for CD40 and 4-1BBL, as well as anti-CTLA-4 and GALV-GP R(-), but without the expression of GM-CSF.

We continue the development of our product candidate RP2 with the goal of moving beyond skin cancers and aiming to treat the more prevalent tumor types commonly found in liver and lung metastasis and including those involving primary liver cancer. Notably, as previously reported, from our Phase-1 clinical trial of RP2 alone and in combination with nivolumab, we have seen durable responses from a monotherapy cohort in a variety of difficult to treat tumors as well as in combination with anti-PD1 and in particular in patients with metastatic uveal melanoma, or mUM. In November 2023, we presented updated data from a cohort of mUM patients during a Plenary Session at the 20th Annual International Society for Melanoma Research Congress. The updated data showed RP2 led to an ORR of 29.4% (5 of 17 patients; one of the responding patients was treated with RP2 monotherapy and four of the responding patients were treated with RP2 combined with nivolumab), including responses in patients with liver, lung, and bone metastases. The median DOR at the data cutoff was 11.47 months (range of 2.78 to 21.22 with responses ongoing). Nearly all patients (15 of 17, 88.2%) in the study had progressed on or after immunotherapy with 12 of 17 patients (70.6%) having previously received both anti-PD1 and anti-CTLA-4 therapies, including four of the responding patients. RP2 was generally well tolerated both as monotherapy and in combination with nivolumab with no additive adverse events observed. The most common grade 1 or 2 treatment related adverse events, or TRAEs, overall in both cohorts were pyrexia, chills, fatigue, hypotension and pruritis. Six patients had grade 3 TRAEs, including two cases of hypotension. There were no grade 4 or 5 TRAEs. In June 2024, we presented that the disease control rate for this cohort of mUM patients was 58.8%.

2

TABLE OF CONTENTS

We have initiated and are enrolling patients in a registration-directed study, or the REVEAL study, of RP2 in mUM patients who are immune checkpoints inhibitor-naive. The REVEAL study is a randomized, phase 2/3 open label study to investigate the efficacy and safety of RP2 in combination with nivolunab vs. ipilimumab in combination with nivolunab in immune checkpoint inhibitor naive adult patients with metastatic uveal melanoma.

We continue our signal finding trial of RP2 in combination with atezolizumab and bevacizumab in the 2L setting of patients with hepatocellular carcinoma, or HCC, in collaboration with Roche. This Phase 2 clinical trial is currently open and enrollment is underway.

RP1, RP2 and RP3 are administered by direct injection into solid tumors, guided either visually or by ultrasound, computerized tomography or other imaging methods. We believe that direct injection maximizes virus-mediated tumor cell death, provides the most efficient delivery of virus-encoded immune activating proteins into the tumor with the goal of activating systemic immunity, and limits the systemic toxicities that could be associated with intravenous administration. Activation of systemic immunity through local administration is intended to lead to the induction of anti-tumor immune responses leading to clinical response of tumors that have not themselves been injected.

Our approach — Oncolytic immunotherapy

Our product candidates are designed to induce a robust immune response against a patient’s cancer. To achieve this objective, we use oncolytic immunotherapies that combine multiple mechanisms in a single product candidate. We believe our product candidates will initiate or enhance an immune response in patients with no or minimal pre-existing cancer immunity, including to tumor neo-antigens, and thereby increase the effectiveness of immune checkpoint blockade therapies.

Our product candidates are intended to act at several key points in the pathways involved in the initiation of an immune response. Following direct injection into tumors, our viruses are intended to replicate in cancer cells and then lyse, or break them open, releasing tumor antigens, including neo-antigens specific to the patient, which could otherwise be hidden from the immune system. This process of necrotic cell death releases intra-cellular markers of “danger,” the danger associated molecular patterns, or DAMPs, while the virus produces pathogen associated markers of danger, or PAMPs. These trigger various pathways of the innate immune system, including the STING pathway and pathways mediated through toll-like receptors, or TLRs, each resulting in the production of interferon. Innate immune activation would be expected to itself provide anti-tumor effects, as interferon activates natural killer cells which can destroy tumor cells. Innate immune activation would also be expected to help trigger adaptive anti-cancer immunity, in which antigen presenting cells, or APCs, are attracted to the injected tumor. APCs internalize cancer antigens, including neo-antigens, and traffic back to the draining lymph nodes where they present the antigens to T cells. Primed with the antigens, these T cells then proliferate and disperse systemically to seek and destroy cancer cells with the same antigen profile throughout the body, resulting in the potential destruction of distant tumor deposits.

To further augment these intended effects, our product candidates are genetically encoded with multiple strong, cell-killing and immune-stimulating proteins — in other words, our product candidates are “armed” with these therapeutic genes. The foundation of our oncolytic immunotherapy product candidates consists of a proprietary strain of HSV-1 that we have engineered to replicate selectively in tumors and to express a fusogenic glycoprotein, a protein that triggers the fusion of the membranes between cells. HSV-1 is both highly cell lytic and inflammatory, and also has a large carrying capacity, which makes it possible to incorporate multiple genes encoding therapeutic proteins. We believe our combination of HSV-1 with the expression of the fusogenic glycoprotein increases the natural ability of HSV-1 to kill tumor cells and to induce an anti-tumor immune response. The fusogenic functionality of our product candidates is intended not only to increase the number of tumor cells that are killed, but also to cause highly immunogenic death of tumor cells. We believe that these factors will increase the potency of the systemic anti-tumor immune response that is generated by our product candidates. With the intention of further amplifying the anti-tumor response, we have also engineered product candidates that express a range of additional potent, immune activating genes encoding therapeutic proteins in tumors.

RP1 serves as our lead product candidate, with additional product candidates, RP2 and RP3, designed to express additional therapeutic proteins. We believe that our development approach of further enhancing our product candidates with additional therapeutic proteins reduces clinical risk, as we are able to study the safety profile of each therapeutic protein that is intended to provide more potent anti-tumor immune effects.

We believe that our ability to incorporate multiple mechanisms of action into a practical “off-the-shelf”, or a pre-manufactured drug product, approach to initiating or enhancing an anti-tumor immune response, including to neo-antigens, will offer significant advantages over the various approaches to immune activation that are currently in development, including personalized vaccine treatments. Tumor neo-antigens are uniquely present in tumors, rather than normal tissue, because they

3

TABLE OF CONTENTS

result from the genetic changes that occur as cancer develops. Unlike the antigens present in normal tissue, the immune system identifies neo-antigens as foreign. As a result, the immune system is able to mount an immune response to tumor neo-antigens in the same way that it would to the antigens contained in disease-causing micro-organisms, which the immune system also identifies as foreign. Researchers believe immune responses to tumor neo-antigens are particularly important in the immune system’s ability to combat cancer, and as a consequence various “personalized vaccine” approaches to generating immune responses to tumor neo-antigens are in development. These approaches are generally both expensive and time consuming because a vaccine cannot be designed and manufactured until a tumor biopsy is taken and analyzed in the laboratory to identify the mutated tumor antigens that will be targeted by the treatment. We also believe that our “off-the-shelf” approach may offer significant advantages over other approaches to anti-cancer immune activation that only target a single pathway of the immune system, as is the case with most of the other immuno-oncology therapies currently under development. Importantly, our product candidates are intended to maximally activate an immune response against cancer, which we believe is the missing element needed to allow anti-PD-1 or anti-PD(L)-1 therapy to treat more patients and tumor types, unlike some other therapies that are intended to act by blocking additional defense mechanisms against an anti-tumor immune response once it has been initiated.

Our Oncolytic Immunotherapy platform and product candidates

Our current product candidate pipeline is summarized in the table below:

Lead product candidate: RP1

Our lead product candidate, RP1, is a selectively replicating version of HSV-1 that expresses GALV-GP R(-) and human GM-CSF. RP1 has the following properties:

•we have deleted the ICP34.5-encoding gene, which enables tumor-selective virus replication;

•we have deleted the ICP47-encoding gene, which is intended to prevent the inhibition of the antigen presentation pathway otherwise caused by ICP47 binding to the transporter associated with antigen presentation. ICP47 deletion is also intended to result in the increased and earlier expression of the HSV-1 US11 gene by placing the HSV-1 US11 gene under the control of ICP47 promoter which we believe will increase virus replication in tumors without reducing tumor-selectivity; and

•we have inserted the sequences for GALV-GP R(-) and human GM-CSF, resulting in the expression of these therapeutic proteins with the intention of increasing both the direct tumor cell killing and the potency of the anti-tumor immune response that is induced.

We have developed RP1 as a monotherapy and for use in combination with immune checkpoint blockade therapy, particularly therapies targeting PD-1 or PD-(L)-1. We believe that the robust release of tumor antigens and the highly immunogenic tumor cell death intended to be caused by RP1 will further increase the previously observed synergy between oncolytic viruses and immune checkpoint blockade therapy.

4

TABLE OF CONTENTS

RP1 Leading Indications

Our lead indication for our lead product candidate, RP1, is the potential treatment of advanced melanoma, which is currently under BLA review with the FDA. Melanoma is a form of skin cancer characterized by the uncontrolled growth of pigment-producing cells (melanocytes) located in the skin. Metastatic melanoma is the deadliest form of the disease and occurs when cancer spreads beyond the surface of the skin to other organs. The incidence of melanoma has been increasing steadily for the last 30 years. Globally, the World Health Organization estimates that by 2035, melanoma incidence will reach 424,102, with 94,308 related deaths. We anticipate the commercial opportunity for RP1 to help improve the lives of patients with advanced melanoma is significant.

We estimate approximately 13,000 patients progress on or after PD-1 treatment annually in the U.S. with approximately 80% of these patients eligible for treatment with RP1 in combination with nivolumab, if approved. Importantly, we believe these treatments will take place in the outpatient setting, not require hospitalization and that nearly all of these patients are being treated in healthcare settings that have interventional radiology onsite or readily accessible, further supporting the anticipated rapid adoption of RP1.

Our following indications with our lead product candidate, RP1, include patients that develop skin cancers following a solid organ transplant. Individuals who receive an organ transplant face a significantly higher risk, greater than 50 times higher, of developing skin cancer following the transplant. These individuals are also on chronic immuno-suppressive treatments to reduce the risk of transplant rejection by their immune system. Adding to this risk for these individuals, anti-PD-1/L1 based cancer treatment options, which are approved and/or used in other skin cancer settings carry a high risk of transplant rejection, potentially leaving these patients without many treatment options.

We are also investigating RP1 as a potential product candidate for the treatment of non-melanoma skin cancers, or NMSC, which is a collection of common cancer types which occurs mainly in fair-skinned populations. About 80% of all NMSC are basal cell carcinomas, squamous cell carcinomas represent about 20%, with other diagnoses representing around 1% or less.

Pipeline product candidates: RP2 and RP3

We have designed our RP2 product candidate to express an anti-CTLA-4 antibody-like protein intended to block the inhibition of the immune response otherwise caused by CTLA-4. We believe that RP2 may offer advantages compared with current CTLA-4 approaches, including ipilimumab. By expressing anti-CTLA-4 only locally in the tumor and draining lymph nodes, we believe that activity will be retained, but that toxicity will be reduced. We expect that our RP2 product candidate will be used as monotherapy and/or in combination with other treatment approaches, including anti-PD-1 therapy, which, when used in combination, we believe will result in both synergy with the oncolytic immunotherapy and the expression of anti-CTLA-4 in the tumor.

RP2 Leading Indication

Uveal melanoma, or mUM, represents the predominant primary intraocular malignancy among adults, comprising over 95% of cases. Globally, the estimated annual incidence of mUM is approximately 4,800 individuals, with an estimated 1,700 new diagnoses occurring in the U.S. each year. Risk factors for developing mUM include fair skin, light-colored eyes, congenital ocular melanocytosis, melanocytoma, and the BAP1-tumour predisposition syndrome. It is estimated that greater than about 90% of mUM cases develop metastatic liver tumors. Historically, one-year survival rate of patients with distant metastases (such as liver metastases) is 15%, while reported median survival time is less than 1 year ranging from four to fifteen months. RP2 is currently being investigated in a randomized , phase 2/3 open label study to investigate the efficacy and safety of RP2 in combination with nivolunab vs. ipilimumab in combination with nivolunab in immune checkpoint inhibitor naive adult patients with metastatic uveal melanoma.

We have another product candidate in the portfolio as well and have designed our RP3 product candidate to express further immune-activating proteins that stimulate T cells, in addition to anti-CTLA-4 and GALV-GP R(-). These immune activating proteins are the ligands for two immune co-stimulatory pathways responsible for T cell proliferation and/or activation, the CD40L and 4-1BBL pathways. Due to program prioritization we are currently not pursuing further development of RP3 at this time.

Intellectual property

We believe our rights under our issued patents and, anticipated future patents from our patent applications, will provide a competitive advantage. Our success depends in part on our ability to obtain and maintain proprietary protection for our product candidates, technology and know-how, to operate without infringing the proprietary rights of others and to prevent others from

5

TABLE OF CONTENTS

infringing upon our proprietary rights. Our policy is to seek to protect our proprietary position by, among other methods, filing United States and foreign patent applications related to our proprietary technology, inventions and improvements that are important to the development of our business. We also rely on trade secrets, know-how and continuing technological innovation to develop and maintain our proprietary position.

For the core technology in our RPx platform and each of our product candidates, we initially filed six patent applications under the Patent Cooperation Treaty, or PCT. All six of these PCT applications have entered the national phase and are in different stages of pending and/or issued in a range of countries. Patent examination has started and continues in these national phase applications. Six U.S. patents have been granted by the applicable authorities in the U.S. Four patents have been granted by the applicable authorities in each of the European Union and Japan. Three patents have been granted by the applicable authorities in Hong Kong, two patents have been granted by the applicable authorities in each of China and Israel and one patent has been granted by the applicable authorities in each of Singapore, India, Mexico and Australia. The granted U.S. patents include US patent numbers 10,570,377; 10,612,005; 10,626,377; 10,947,513; 11,427,810; 11,473,063; 12,024,724; 12,049,647; and 12,059,444 and include description and claims directed to oncolytic virus compositions of matter, pharmaceutical compositions encompassing an oncolytic virus and methods of use in treating cancer with oncolytic virus compositions. We have successfully defended all oppositions that have been brought by third-parties against our issued patents to-date and have maintained our proprietary position. We continue to vigorously pursue advancement and defense of our patents and patent applications through the respective patent offices in which they are granted or pending throughout the world. See "Risk factors - Risks Related to intellectual property."

The term of individual patents depends upon the legal term of the patents in the countries in which they are obtained. In many countries in which we file, the patent term is 20 years from the earliest date of filing a non-provisional patent application. In the United States, the patent term of a patent that covers an FDA-approved drug may also be eligible for patent term extension, which permits patent term restoration of a portion of the patent term lost during the U.S. clinical development and FDA regulatory review process. The Hatch-Waxman Act permits a patent term extension of up to five years beyond the expiration of the patent. The length of the patent term extension is related to the length of time the drug is under clinical development in the United States and the length of time the drug is under regulatory review. Patent term extension cannot extend the remaining term of a patent beyond a total of 14 years from the date of product approval and only one patent applicable to an approved drug may be extended. Similar provisions are available in Europe and other foreign jurisdictions to extend the term of a patent that covers an approved drug. In the future, if and when our products receive FDA approval, and if and when patents grant, we expect to apply for patent term extensions on patents covering those products. We plan to seek patent term extensions to any of our issued patents in any jurisdiction where these are available, however there is no guarantee that the applicable authorities, including the FDA in the United States, will agree with our assessment of whether such extensions should be granted, and if granted, the length of such extensions.

We may rely, in some circumstances, on trade secrets to protect our technology. We seek to protect our proprietary technology and processes, in part, by confidentiality agreements with our employees, consultants, scientific advisors and other contractors, as well as physical security of our premises and our information technology systems.

Competition

The biotechnology and pharmaceutical industries are characterized by rapidly advancing technologies, intense competition and a strong emphasis on proprietary rights. We compete in the highly competitive markets that address cancer and face significant competition from many sources, including pharmaceutical, biopharmaceutical and biotechnology companies, as well as universities and private and public research institutions. Many of our competitors have significantly greater financial, manufacturing, marketing and drug development resources than we do. Large biopharmaceutical companies in particular have extensive experience in clinical testing and in obtaining regulatory approvals for drugs and biologicals. These companies also have significantly greater research capabilities than we do. Smaller or early-stage companies may also prove to be significant competitors, particularly through collaborative arrangements with large and established companies or universities and research institutions.

Our competitors fall primarily into the following groups of treatment:

•traditional cancer therapies, including chemotherapy, surgery, radiation and targeted therapies;

•approved immunotherapy antibodies and immunotherapy antibodies in clinical trials;

•oncolytic immunotherapies, including T-Vec and other oncolytic immunotherapies in clinical trials;

•therapies aimed at activating innate immunity such as those targeting STING and TLRs;

•cancer vaccines including personalized vaccines and those targeting tumor neo-antigens; and

6

TABLE OF CONTENTS

•cell-based therapies, such as TILs, CAR-T, T cell receptor-based, and natural killer cell therapies.

Our commercial opportunity will be reduced or eliminated if our competitors develop and commercialize products that are safer, more effective, have fewer side effects, are easier to administer or are less expensive alone or in combination with other therapies than any products that we may develop alone or in combination with other therapies, especially if these get to market sooner than our products. These third parties also compete with us in recruiting and retaining qualified scientific and management personnel, establishing clinical trial sites and patient registration for clinical trials, as well as in acquiring technologies and technology licenses complementary to our programs or advantageous to our business.

Our oncolytic product candidates, if and when marketed, will compete with a number of drugs that are currently marketed or in development that also target cancer but that utilize a different mechanism of action. To compete effectively with these agents, our product candidates will need to demonstrate advantages that lead to improved clinical efficacy and safety compared with these competitors. At the same time, however, we believe that our oncolytic product candidates, if and when ultimately marketed, would likely be used principally in combination with checkpoint blockade therapies in addition to existing cancer therapies, including surgery, chemotherapy, radiation therapy and other biological therapies such as antibodies targeting particular surface receptors. We therefore believe that our product candidates, if and when marketed, would largely complement rather than compete directly with some of these existing treatment options.

We do, however, expect to face direct and increasing competition from a number of companies that are also seeking to develop cancer therapies based on oncolytic viruses and other ways to prime the immune system, including neo-antigen vaccination, TILs or the like. We believe that our ability to successfully compete will depend, among other things, on our ability to:

•expeditiously advance the development of our product candidates;

•design, enroll patients in and successfully complete appropriate clinical trials in a timely fashion;

•gain regulatory approval for our product candidates in their first indications as well as further indications;

•establish collaborations and partnerships for the development and marketing of our product candidates;

•commercialize our product candidates successfully, including demonstrating the safety and efficacy of our product candidates over currently approved therapies to physicians, insurers and third-party payors;

•secure sufficient coverage from insurers and other payors;

•secure, maintain and protect intellectual property rights based on our innovations; and

•manufacture or otherwise obtain and sell commercial quantities of future products to the market.

Manufacturing and suppliers

We have established an operations leadership team that we believe has extensive experience in manufacturing biologics based on viruses, including oncolytic products and gene therapy products and we operate our own in-house, approximately 63,000 square foot, U.S. based manufacturing facility in Framingham, Massachusetts. We operate our in-house manufacturing facility in order to secure our product candidates for our ongoing and planned clinical studies and, if approved, commercial launch and supply. The facility has been designed to allow us to produce enough material to cover full global commercialization of all our product candidates that are currently in development. The facility is intended to give us control over key aspects of the supply chain for our products and product candidates.

By controlling our own manufacturing facility, we aim to minimize or eliminate reliance on contract manufacturing organizations, which typically have limited capacity at commercial scale and long-lead time to conduct manufacturing campaigns. We believe that having control over the whole manufacturing process, in the U.S., will allow us to reduce cycle times, cost of goods for commercial production, other potential political or territorial cost efficiencies, and to shorten overall timelines for new product candidates in our development pipeline, as well as help us to develop drug formulations or presentations to simplify distribution and/or administration of future oncolytic immunotherapies. We also believe that having a dedicated manufacturing facility will allow us to optimize commercial-scale processes and to enhance security of supply to support market launch and commercialization of our product candidates, if approved. While we do control our own manufacturing facility, we rely on industry suppliers for raw materials and other process supplies, such as single-use manufacturing components, formulation components, sterile filters, bioreactors and other consumable components.

Sales and marketing

7

TABLE OF CONTENTS

None of our product candidates have been approved for sale. If and when our product candidates advance closer to marketing approval, we intend to commercialize them on our own in the United States and potentially with pharmaceutical or biotechnology partners in other geographies. We may take different approaches to commercialization in different geographies. We continue to build our in-house sales, marketing and commercialization capabilities with the addition of sales, marketing, trade and distribution, as well as other related expertise. Clinical data, the size of the opportunity for our product candidates, and the size of the commercial infrastructure required will influence our commercialization plans and decision making.

Collaborations

BMS

In February 2018, we entered into a Clinical Trial Collaboration and Supply Agreement with BMS. Pursuant to the agreement, BMS is providing to us, at no cost, nivolumab, its anti-PD-1 therapy, for use in combination with RP1 in our ongoing Phase 1/2 clinical trial. Under the agreement, we will sponsor, fund and conduct the clinical trial in accordance with an agreed-upon protocol. BMS granted us a non-exclusive, non-transferrable, royalty-free license (with a right to sublicense) under its intellectual property to use nivolumab in the clinical trial and has agreed to supply nivolumab, at no cost to us, for use in the clinical trial. Both parties will own the study data produced in the clinical trial, other than study data related solely to nivolumab, which will belong solely to BMS, or study data related solely to RP1, which will belong solely to us. In January 2020, the agreement was expanded to cover an additional cohort of 125 patients with anti-PD-1 failed melanoma.

Unless earlier terminated, the agreement will remain in effect until (i) the completion of the clinical trial, (ii) all related clinical trial data have been delivered to both parties and (iii) the completion of any statistical analyses and bioanalyses contemplated by the clinical trial protocol or any analysis otherwise agreed upon by the parties. The agreement may be terminated by either party (x) in the event of an uncured material breach by the other party, (y) in the event the other party is insolvent or in bankruptcy proceedings or (z) for safety reasons. Upon termination, the licenses granted to us to use nivolumab in the clinical trial will terminate. The agreement contains representations, warranties, undertakings and indemnities customary for a transaction of this nature.

In April 2019, we entered into a separate agreement with BMS on terms similar to the terms set forth in the agreement described above, pursuant to which BMS will provide, at no cost to us, nivolumab for use in our Phase 1 clinical trial of RP2 in combination with nivolumab.

Roche

In December 2022, we entered into a Master Clinical Trial Collaboration and Supply Agreement with Roche in relation to our RP2 and RP3 programs in colorectal cancer, or CRC, and HCC. Under the agreement, the companies intended to collaborate in 30 patient cohort signal finding studies in third-line, or 3L, CRC and in first- and second-line, or 1L and 2L, respectively, HCC. Following our re-prioritization of our product development portfolio in December 2023, we have agreed with Roche to terminate the CRC collaboration and pursue the 2L cohort in HCC with RP2 only. Roche has continued to supply its currently approved drugs, atezolizumab and bevacizumab for the 2L cohort in HCC but is not sharing costs following our re-prioritization. Under the terms of the initial agreement we retained the responsibility of operating the clinical trials as well as retaining all the rights to the development and commercialization of our product candidates. The agreement may be terminated by either party upon sixty days prior written notice to the other party.

Regulatory matters

Government authorities in the United States, at the federal, state, and local level, and in other countries, extensively regulate, among other things, the research, development, testing, approval, manufacture, packaging, storage, recordkeeping, labeling, advertising, promotion, distribution, marketing, import, and export of biopharmaceutical products such as those we are developing. In addition, manufacturers of biopharmaceutical products participating in Medicaid and Medicare are required to comply with mandatory price reporting, discount, and rebate requirements. The processes for obtaining regulatory approvals in the United States and in foreign countries, along with compliance with applicable statutes and regulations, require the expenditure of substantial time and financial resources. Regulatory requirements are also continually evolving. By example, the FDA and governmental authorities in other countries have issued a growing body of guidance documents on various regulatory matters, including those specific to cell and gene therapy development. While FDA’s guidance is not binding, it does provide FDA’s current interpretation and approach.

FDA and EU regulation

8

TABLE OF CONTENTS

In the United States, the FDA regulates biologics under the Federal Food, Drug, and Cosmetic Act, or FDCA, the Public Health Services Act, or PHSA, and their implementing regulations. The process required by the FDA before product candidates may be marketed in the United States generally involves the following:

•completion of preclinical laboratory tests, animal studies, and formulation studies in compliance with good laboratory practice, or GLP, regulations;

•submission to the FDA of an investigational new drug application, or IND, which must become effective before human clinical trials may begin at United States clinical trial sites;

•approval by an institutional review board, or IRB, for each clinical site, or centrally, before each trial may be initiated;

•performance of adequate and well-controlled human clinical trials to establish the safety, purity, and potency of the proposed product candidate for its intended use, performed in accordance with good clinical practices, or GCPs;

•development and maintenance of manufacturing processes to ensure the product candidate’s identity, strength, quality, purity, and potency;

•preparation and submission to the FDA of a BLA;

•satisfactory completion of an FDA advisory committee review, if applicable;

•satisfactory completion of an FDA inspection or remote regulatory assessment of the manufacturing facility or facilities at which the products are produced to assess compliance with current good manufacturing practices, or cGMPs, and to assure that the facilities, methods, and controls are adequate to preserve the therapeutics’ identity, strength, quality, purity, and potency as well as satisfactory completion of an FDA inspection or remote regulatory assessment of selected clinical sites and selected clinical investigators to determine GCP compliance; and

•FDA review and approval of the BLA to permit commercial marketing for particular indications for use.

The process in the European Union and other countries with developed regulatory regimes is broadly comparable save that there is no dedicated BLA route in Europe as a Marketing Authorisation, or MAA, covers both small molecules, and biologics and cell and gene therapies.

Preclinical studies and IND submission

The testing and approval process of product candidates requires substantial time, effort, and financial resources. Satisfaction of the FDA’s and other countries’ regulatory authorities’ pre-market approval requirements typically takes many years and the actual time required may vary substantially based upon the type, complexity, and novelty of the product or disease. Preclinical studies include laboratory evaluation of chemistry, pharmacology, toxicity, and product formulation, as well as animal studies to assess potential safety and efficacy. Such studies must generally be conducted in accordance with GLPs. Recently, however, in the U.S., new methods of non-animal preclinical testing are being explored. For instance, in 2025, FDA outlined a stepwise plan to reduce animal testing in preclinical safety studies with scientifically validated new approach methodologies, or NAMs, which may include organ-on-a-chip systems, computational modeling, and advanced in vitro assays, and other data.

Prior to commencing the first clinical trial at a United States or other country’s investigational site under and IND with a product candidate, an IND sponsor must submit the results of the preclinical tests and preclinical literature, together with manufacturing information, analytical data, any available clinical data or literature, and proposed clinical study protocols among other things, to the FDA as part of an IND (or equivalent in other countries). Additional preclinical testing, such as animal tests of reproductive adverse events and carcinogenicity, may continue after the IND is submitted.

An IND automatically becomes effective 30 days after receipt by the FDA, unless the FDA, within the 30-day time period, notifies the applicant of safety concerns or questions related to one or more proposed clinical trials and places the trial on a clinical hold. In such a case, the IND sponsor and the FDA must resolve any outstanding concerns before the clinical trial can begin. Clinical holds also may be imposed by the FDA at any time before or during trials due to safety concerns or non-compliance. As a result, submission of an IND may not result in FDA authorization to commence a clinical trial. A separate submission to an existing IND must also be made for each successive clinical trial conducted during product development.

Clinical trials

Clinical trials involve the administration of the investigational product to human subjects under the supervision of qualified investigators in accordance with federal regulations and GCP requirements, which include the requirements that all research subjects provide their informed consent in writing for their participation in any clinical trial, as well as review and approval of

9

TABLE OF CONTENTS

the study by an IRB. Investigators must also provide certain information to the clinical trial sponsors to allow the sponsors to make certain financial disclosures to the FDA. Clinical trials are conducted under protocols detailing, among other things, the objectives of the trial, the trial procedures, the parameters to be used in monitoring safety, the effectiveness criteria to be evaluated, and a statistical analysis plan. A protocol for each clinical trial, and any subsequent protocol amendments, must be submitted to the FDA as part of the IND. Sponsors will also be required to provide FDA with diversity action plans. In addition, an IRB at each study site participating in the clinical trial or a central IRB must review and approve the plan for any clinical trial, informed consent forms, and communications to study subjects before a study commences at that site. An IRB considers, among other things, whether the risks to individuals participating in the trials are minimized and are reasonable in relation to anticipated benefits, and whether the planned human subject protections are adequate. The IRB must continue to oversee the clinical trial while it is being conducted. Special clinical trial ethical considerations also must be taken into account if a study involves children. Once an IND is in effect, each new clinical protocol and any amendments to the protocol must be added to the IND for FDA review and sent to the IRB for approval. If a product candidate is being investigated for multiple intended indications, separate INDs may also be required. Progress reports detailing the results of the clinical trials must also be submitted at least annually to the FDA and the IRB and more frequently if serious adverse events or other significant safety information is found.

The FDA may order the temporary, or permanent, discontinuation of a clinical trial at any time, or impose other sanctions, if it believes that the clinical trial either is not being conducted in accordance with FDA requirements or presents an unacceptable risk to the clinical trial patients. An IRB may also require the clinical trial at the site to be halted, either temporarily or permanently, for failure to comply with the IRB’s requirements or if the trial poses an unexpected serious harm to subjects. The FDA or an IRB may also impose conditions on the conduct of a clinical trial. Clinical trial sponsors may also choose to discontinue clinical trials as a result of risks to subjects, a lack of favorable results, or changing business priorities.

Information about certain clinical trials, including a description of the study and study results, must be submitted within specific timeframes to the National Institutes of Health, or NIH, for public dissemination on their clinicaltrials.gov website. Manufacturers or distributors of investigational products for the diagnosis, monitoring, or treatment of one or more serious diseases or conditions must also have a publicly available policy on evaluating and responding to requests for expanded access requests.

Additionally, some clinical trials are overseen by an independent group of qualified experts organized by the clinical trial sponsor, known as a data monitoring committee, or DMC, that regularly reviews accumulated data and advises the study sponsor regarding the continuing safety of the trial. This group may also review interim data to assess the continuing validity and scientific merit of the clinical trial. This group receives special access to unblinded data during the clinical trial and may advise the sponsor to halt the clinical trial if it determined there is an unacceptable safety risk for subjects or on other grounds, such as no demonstration of efficacy.

Moreover, certain studies involving recombinant and synthetic nucleic acid molecules are subject to review by Institutional Biosafety Committees, or IBCs, under the National Institutes of Health Guidelines for Research Involving Recombinant or Synthetic Nucleic Acid Molecules.

The manufacture of investigational biologics for the conduct of human clinical trials is subject to cGMP requirements. Investigational biologics and active ingredients imported into the United States are also subject to regulation by the FDA. Further, the export of investigational products outside of the United States is subject to regulatory requirements of the receiving country as well as United States export requirements under the FDCA.

In general, for purposes of BLA approval, human clinical trials are typically conducted in three sequential phases, which may overlap, be divided, or be combined.

•Phase 1 — Trials are initially conducted in healthy human volunteers or subjects with the target disease or condition and test the product candidate for safety, dosage tolerance, structure-activity relationships, mechanism of action, absorption, metabolism, distribution, and excretion. If possible, Phase 1 trials may also be used to gain an initial indication of the activity of the product candidate.

•Phase 2 —  Trials are conducted in limited subject populations with a specified disease or condition to evaluate the effectiveness of the product candidate for a particular indication or indications, identify optimal dosages, dosage tolerance and schedule, possible adverse effects and safety risks, and expanded evidence of safety.

•Phase 3 — These adequate and well controlled clinical trials are undertaken in expanded subject populations, generally at geographically dispersed clinical trial sites, to generate enough data to provide statistically significant evidence of clinical efficacy and safety of the product for approval, to establish the overall risk benefit profile of the product, and to provide adequate information for the labeling of the product. Typically, two Phase 3 trials are required by the FDA for product approval. Under some limited circumstances, however, approval may be based upon a single adequate and

10

TABLE OF CONTENTS

well-controlled clinical trial plus confirmatory evidence or a single large multicenter trial without confirmatory evidence.

Additional kinds of data may also help to support a BLA, such as patient experience data and real-world evidence. Real world evidence may also be used to assist in clinical trial design. For appropriate indications sought through supplemental BLAs, data summaries may provide marketing application support. For genetically targeted products and variant protein targeted products intended to address an unmet medical need in one or more patient subgroups with a serious or life threatening rare disease or condition, the FDA may allow a sponsor to rely upon data and information previously developed by the sponsor or for which the sponsor has a right of reference, that was submitted previously to support an approved application for a product that incorporates or utilizes the same or similar genetically targeted technology or a product that is the same or utilizes the same variant protein targeted drug as the product that is the subject of the application. More recently, a program was established whereby a platform technology that is incorporated within or utilized by an approved drug or biologic product may be designated as a platform technology, provided that certain conditions are met and provided that the technology is considered a platform technology under FDA's definition, in which case development and approval of subsequent products using such technology may be streamlined.

Further, under certain circumstances, manufacturers and sponsors of investigational biopharmaceutical product candidates can provide access to the product candidates to certain qualifying patients outside of clinical trials. For instance, under the FDA’s expanded access program, with FDA approval and subject to certain requirements, sponsors may provide access to product candidates to patients with serious or immediately life threatening diseases or conditions for which there is no comparable or satisfactory alternative therapy, provided that the potential patient benefit justifies the risks, the risks are not unreasonable in the context of the disease or condition to be treated, and the provision of the product candidate for the requested use will not interfere with clinical investigations. The specific expanded access criteria and requirements depend on the number of expanded access patients. Sponsors and investigators of expanded access programs must still comply with the FDA’s clinical trial guidelines and are subject to subject protection regulations. Federal and state laws in the United States, referred to as right to try laws, also establish a separate mechanism through which certain patients with life threatening diseases or conditions, who have exhausted all approved treatment options and are unable to participate in a clinical trial, may request access to investigational product candidates that have completed a Phase 1 clinical trial. While certain criteria must be met for a patient to be eligible for access to product candidates under right to try laws, these laws do not require the FDA to approve the use of the product candidate and do not require compliance with the majority of the FDA’s clinical trial regulations.

The FDA may also require, or companies may conduct, additional clinical trials for the same indication after a product is approved to further assess the product’s safety and effectiveness, and to ensure that population representative data is collected. These so-called Phase 4 trials may be made a condition to be satisfied after approval. The results of Phase 4 trials can confirm or refute the effectiveness of a product candidate and can provide important safety information.

Concurrent with clinical trials, companies usually complete additional animal studies and must also develop additional information about the chemistry and physical characteristics of the product candidate as well as finalize a process for manufacturing the product in commercial quantities in accordance with cGMP requirements. The manufacturing process must be capable of consistently producing quality batches of the product candidate and, among other things, manufacturers must develop methods for testing the identity, strength, quality, potency, and purity of the final product. Additionally, appropriate packaging must be selected and tested, and stability studies must be conducted to demonstrate that the product candidate does not undergo unacceptable deterioration over its shelf life.

In relation to the clinical trial in the United Kingdom and in so far as trials will be conducted in other countries with a view to obtaining a marketing authorization from the Medicines and Healthcare products Regulatory Agency, or MHRA, and the European Medicines Agency, there are broadly equivalent GLP, GCP, cGMP and ethical approval requirements. In the European Union, these rules are memorialized in the form of Regulations, which are directly enforceable in all European Union member states or Directives, which must be implemented nationally. However, enforcement of such rules is conducted by the regulatory authority in which the trial is carried out, which is the MHRA in the United Kingdom. With the full departure of the United Kingdom from the European Union in January 2021, the United Kingdom is not covered by the European Union Clinical Trial Regulation, in force since January 2022, which inter alia introduced a portal to streamline cross-border trial applications, and is instead subject to rules equivalent to the previous 2001 EU Clinical Trials Directive.

Combination products

Biologic products may be regulated as combination products if they are intended for use in conjunction with medical devices, such as a delivery device. In such cases, the use of the two products together (i.e., the biological product and the device) must be shown to be safe and effective for the proposed intended use, and, the labeling of the two products must reflect their combined use. In some cases, the device component may require a separate premarket submission; for example, when the device component is intended for use with multiple therapeutics. Sponsors of clinical studies using investigational devices are

11

TABLE OF CONTENTS

required to comply with FDA’s investigational device exemption regulations. Once approved or cleared, the sponsor of the device component submission (or the combination product submission, if both components are covered by one premarket submission) would need to comply with FDA’s post-market device requirements, including establishment registration, device listing, device labeling, unique device identifier, quality system regulations, medical device reporting, and reporting of corrections and removals. In the European Union there are specific quality requirements for drug-device combinations.

BLA submission, review by the FDA, and marketing approval

Assuming successful completion of the required clinical and preclinical testing, the results of product development, including chemistry, manufacture, and controls, non-clinical studies, and clinical trial results, including negative or ambiguous results as well as positive findings, are all submitted to the FDA, along with the proposed labeling, as part of a BLA requesting approval to market the product for one or more indications. In most cases, the submission of a BLA is subject to a substantial application user fee. These user fees must be paid at the time of the first submission of the application, even if the application is being submitted on a rolling basis. Fee waivers or reductions are available in certain circumstances. One basis for a waiver of the application user fee is if the applicant employs fewer than 500 employees, including employees of affiliates, the applicant does not have an approved marketing application for a product that has been introduced or delivered for introduction into interstate commerce, and the applicant, including its affiliates, is submitting its first marketing application.

In addition, under the Pediatric Research Equity Act, or PREA, a BLA or supplement to a BLA for a new active ingredient, indication, dosage form, dosage regimen, or route of administration, must contain data that are adequate to assess the safety and effectiveness of the product for the claimed indications in all relevant pediatric subpopulations, and to support dosing and administration for each pediatric subpopulation for which the product is safe and effective. Also, under the FDA Reauthorization Act of 2017, for applications for product candidates intended for the treatment of adult cancer which are directed at molecular targets that the FDA determines to be substantially relevant to the growth or progression of pediatric cancer, in place of the PREA investigations, sponsors must submit, with the application, reports from molecularly targeted pediatric cancer investigations designed to yield clinically meaningful pediatric study data, using appropriate formulations, to inform potential pediatric labeling. The FDA may, on its own initiative or at the request of the applicant, grant deferrals for submission of some or all pediatric data until after approval of the product for use in adults, or full or partial waivers from the pediatric data requirements.

The FDA also may require submission of a REMS to ensure that the benefits of the biologic outweigh the risks. The REMS plan could include medication guides, physician communication plans, and elements to assure safe use, such as restricted distribution methods, patient registries, or other risk minimization tools. An assessment of the REMS must also be conducted at set intervals. Following product approval, a REMS may also be required by the FDA if new safety information is discovered and the FDA determines that a REMS is necessary to ensure that the benefits of the biologic outweigh the risks.

Once the FDA receives an application, it has 60 days to review the BLA to determine if it is substantially complete to permit a substantive review before it accepts the application for filing. The FDA may request additional information rather than accept a BLA for filing. In this event, the application must be resubmitted with the additional information. The resubmitted application is also subject to review before the FDA accepts it for filing. Once the submission is accepted for filing, the FDA begins an in-depth substantive review.

Under the goals and policies agreed to by the FDA under PDUFA, the FDA has set the review goal of completing its review of 90% of all applications within ten months from the 60-day filing date for its initial review of a BLA. The FDA does not always meet its PDUFA goal dates for BLA submissions, and the review process may be extended if the FDA requests or the sponsor otherwise provides additional information or clarification regarding the submission.

The FDA may also refer certain applications to an advisory committee. An advisory committee is typically a panel that includes clinicians and other experts, and may at times includes patients, which review, evaluate, and make a recommendation as to whether the application should be approved and under what conditions. The FDA is not bound by the recommendations of an advisory committee, but it considers such recommendations carefully when making decisions.

The FDA reviews applications to determine, among other things, whether a product is safe, pure and potent and whether the manufacturing methods and controls are adequate to assure and preserve the product’s identity, strength, quality, potency, and purity. Before approving a BLA, the FDA typically will inspect or conduct a remote regulatory assessment of the facility or facilities where the product is manufactured, referred to as a Pre-Approval Inspection. The FDA will not approve an application unless it determines that the manufacturing processes and facilities, including contract manufacturers and subcontractors, are in compliance with cGMP requirements and adequate to assure consistent production of the product within required specifications. Additionally, before approving a BLA the FDA will inspect or conduct a remote regulatory assessment of one or more clinical trial sites to assure compliance with GCPs.

12

TABLE OF CONTENTS

After evaluating the BLA and all related information, including the advisory committee recommendation, if any, and inspection reports regarding the manufacturing facilities and clinical trial sites, the FDA may issue an approval letter, or, in some cases, a Complete Response Letter, or CRL. A CRL indicates that the review cycle of the application is complete and the application is not ready for approval, and describes all of the specific deficiencies that the FDA identified in the BLA. A CRL generally contains a statement of specific conditions that must be met in order to secure final approval of the BLA and may require additional clinical or preclinical testing in order for the FDA to reconsider the application. The deficiencies identified may be minor, for example, requiring labeling changes, or major, for example, requiring additional clinical trials. If a CRL is issued, the applicant may either: resubmit the BLA, addressing all of the deficiencies identified in the letter; withdraw the application; or request an opportunity for a hearing. The FDA has the goal of reviewing 90% of application resubmissions in either two or six months of the resubmission date, depending on the kind of resubmission. Even with submission of this additional information, the FDA ultimately may decide that the application does not satisfy the regulatory criteria for approval. If and when those conditions have been met to the FDA’s satisfaction, the FDA may issue an approval letter. An approval letter authorizes commercial marketing of the product with specific prescribing information for specific indications.

Even if the FDA approves a product, it may limit the approved indications or populations for use of the product, require that contraindications, warnings, or precautions be included in the product labeling, including a boxed warning, require that post-approval studies, including Phase 4 clinical trials, be conducted to further assess a product’s safety and efficacy after approval, require testing and surveillance programs to monitor the product after commercialization, or impose other conditions, including distribution restrictions or other risk management mechanisms under a REMS which can materially affect the potential market and profitability of the product. The FDA may also not approve label statements that are necessary for successful commercialization and marketing.

After approval, some types of changes to the approved product, such as adding new indications, manufacturing changes, and additional labeling claims, are subject to further testing requirements and FDA review and approval. The FDA may also withdraw the product approval if compliance with the pre- and post-marketing regulatory standards are not maintained or if problems occur after the product reaches the marketplace. Further, should new safety information arise, additional testing, product labeling, or FDA notification may be required.

While there is no direct equivalent to the separate route for biologics, broadly equivalent requirements and controls similarly apply to the submission of pediatric testing and marketing authorization applications to the European Medicines Agency in the European Union and, post-approval, to the holding of such marketing authorizations, including conditionality.

Additional FDA expedited review and approval programs

FDA’s fast track, priority review, accelerated approval, and breakthrough therapy programs are special programs and pathways at the agency that are intended to facilitate and expedite product development and approval. Product candidates may be eligible for fast track designation if they are intended to treat a serious or life-threatening disease or condition and demonstrate the potential to address an unmet medical need. If a sponsor applies for and receives fast track designation, the designated product candidate may be eligible for more frequent FDA interactions as well as rolling review of sections of an application before the application is complete. To qualify for rolling review, the applicant must provide and FDA must approve a schedule for the submission of the full application. User fees must also be paid before FDA will commence its review of an application submitted on a rolling basis.

Priority review may be available to product candidates that are intended to treat serious conditions and, if approved, would provide significant improvements in the safety or effectiveness of the treatment, diagnosis, or prevention of the serious condition. If a product receives priority review, FDA’s PDUFA review goal is shortened to six months following FDA acceptance of a BLA, rather than the standard review of ten months.

Product candidates eligible for FDA’s accelerated approval pathway are those that are intended to treat serious or life-threatening illnesses that provide meaningful therapeutic benefit to patients over existing treatments. Under this pathway, FDA may approve a marketing application based upon adequate and well-controlled clinical trials that evaluate a product candidate’s effect on a surrogate endpoint, which is an endpoint that is reasonably likely to predict clinical benefit, or a product’s effect on a clinical endpoint that can be measured earlier than irreversible morbidity or mortality and that is reasonably likely to predict an effect on irreversible morbidity or mortality, taking into account the severity, rarity, or prevalence of the condition and availability or lack of alternative treatments. Products approved under the accelerated approval pathway must complete Phase 4 clinical trials to demonstrate the product’s clinical benefit. By the date of approval of an accelerated approval product, FDA must specify the conditions for the required post approval studies, including enrollment targets, the study protocol, milestones, and target completion dates. FDA may also, and frequently does, require that the confirmatory Phase 4 studies be commenced prior to FDA granting a product accelerated approval. If a Phase 4 study is not sufficiently advanced at the time of a marketing application, FDA can issue a complete response letter rather than approve the product. Reports on the progress of the required Phase 4 confirmatory studies must be submitted to FDA every 180 days after approval. If the confirmatory Phase 4 studies fail

13

TABLE OF CONTENTS

to verify the clinical benefit of the product, the FDA may withdraw approval of the application through a statutorily defined streamlined process. Failure to conduct the required Phase 4 confirmatory studies or to conduct such studies with due diligence, as well as failure to submit the required update reports can subject a sponsor to penalties. Promotional materials for a drug or biologic approved under the accelerated approval pathway are subject to FDA prior review.

A third program that may be available is the breakthrough therapy program, which is for products that are intended, alone or in combination with one or more other products, to treat a serious or life-threatening disease or condition, and for which preliminary clinical evidence indicates that the product may demonstrate substantial improvement over existing therapies on one or more clinically significant endpoints. Breakthrough therapy products may be eligible for intensive FDA guidance on development programs as early as Phase 1 clinical trials, FDA organization commitment to involve senior managers and experienced review and regulatory management staff in a proactive collaborative, proactive, and cross-disciplinary reviews, and marketing application rolling review.

FDA designations may be rescinded if the applicable qualifying criteria are no longer met.

Biosimilars and exclusivity

The Biologic Product Competition and Innovation Act, or BPCIA, created an abbreviated approval pathway for biological products shown to be "biosimilar to" or "interchangeable with" an FDA-licensed reference biological product. Biosimilarity sufficient to reference a prior FDA-approved product requires a high similarity to the reference product notwithstanding minor differences in clinically inactive components, and no clinically meaningful differences between the biological product and the reference product in terms of safety, purity, and potency. Biosimilarity must be shown through analytical studies, animal studies, and at least one clinical trial, absent a waiver by the FDA. There must be no difference between the reference product and a biosimilar in mechanism of action, conditions of use (though a biosimilar may be licensed for fewer indications than that of its reference product), route of administration, dosage form, and strength. A biosimilar product may be deemed interchangeable with a prior approved product if it meets the higher hurdle of demonstrating that it can be expected to produce the same clinical results as the reference product and, for products administered multiple times, the biosimilar and the reference biologic may be switched after one has been previously administered without increasing safety risks or risks of diminished efficacy relative to exclusive use of the reference biologic. The FDA has issued a number of guidance documents outlining its approach for review and approval of biosimilars, including guidance documents on the demonstration of interchangeability and the licensure of biosimilar and interchangeable products for fewer than all of the reference product’s licensed conditions of use.

A reference biologic is granted 12 years of exclusivity from the time of first licensure of the reference product, and no application for a biosimilar can be submitted for four years from the date of licensure of the reference product and not approved for another 8 years from the date of licensure of the reference product. However, certain changes and supplements to an approved BLA, and subsequent applications filed by the same sponsor, manufacturer, licensor, predecessor in interest, or other related entity do not qualify for the twelve-year exclusivity period. The PHSA also includes provisions to protect reference products that have patent protection. The biosimilar product sponsor and reference product sponsor may exchange certain patent and product information for the purpose of determining whether there should be a legal patent challenge. Based on the outcome of negotiations surrounding the exchanged information, the reference product sponsor may bring a patent infringement suit and injunction proceedings against the biosimilar product sponsor. The biosimilar applicant may also be able to bring an action for declaratory judgment concerning the patent.

The FDA maintains a publicly-available online database of licensed biological products, which is commonly referred to as the “Purple Book”. The Purple Book lists product names, dates of licensure, and applicable periods of exclusivity. Further, pursuant to a statute to enable biological product patent transparency, the reference product sponsor must provide patent information and patent expiry dates to the FDA following the exchange of patent information between biosimilar and reference product sponsors. This information is then published in the Purple Book.

In the European Union there is a period of 10 years (or 11 years for significant new indications) of data exclusivity so that those seeking to market biosimilars cannot apply on an abridged basis for a marketing authorization for eight years from when the product was first marketed in the European Union and cannot place it on the market for 10 or 11 years from such first marketing although the European Union has proposed legislation reducing these exclusivity periods.

If approved, biologics may also be eligible for periods of United States patent term restoration. If a timely application is made and if granted, patent term restoration extends the patent life of a single unexpired patent, that has not previously been extended, for a maximum of five years. The total patent life with the extension also cannot exceed fourteen years from the product’s approval date. Subject to the prior limitations, the period of the extension is calculated by adding half of the time from the effective date of an IND to the initial submission of a full marketing application, and all of the time between the submission of the full marketing application and its approval. This period may also be reduced by any time that the applicant did not act with due diligence.

14

TABLE OF CONTENTS

In the European Union, a supplementary protection certificate, or SPC, can similarly extend a patent term for a maximum of five years. A further six-month additional extension is available if the SPC relates to a medicinal product for which data has been submitted according to a Pediatric Investigation Plan.

In an effort to increase competition in the biologic product marketplace, Congress, the executive branch, and FDA have taken certain legislative and regulatory steps. By way of example, measures have been proposed and implemented to facilitate product importation. Moreover, the 2020 Further Consolidated Appropriations Act included provisions requiring that sponsors of approved biologic products, including those subject to REMS, provide samples of the approved products to persons developing biosimilar products within specified timeframes, in sufficient quantities, and on commercially reasonable market-based terms. Failure to do so can subject the approved product sponsor to civil actions, penalties, and responsibility for attorney’s fees and costs of the civil action. More recently, the U.S. President issued an Executive Order to require FDA to provide administrative and legislative recommendations to accelerate approval of biosimilar products.

Post-approval requirements

Any products manufactured or distributed pursuant to FDA approvals are subject to pervasive and continuing regulation by the FDA, including, among other things, requirements related to manufacturing, recordkeeping, and reporting, including adverse experience reporting, deviation reporting, shortage reporting, risk management plans, supply chain security, and periodic reporting, product distribution, advertising, marketing, promotion, certain electronic records and signatures, and post-approval obligations imposed as a condition of approval, such as Phase 4 clinical trials, REMS, and surveillance to assess safety and effectiveness after commercialization.

After approval, most changes to the approved product, such as adding new indications or other labeling claims are subject to prior FDA notice or review and approval. There also are continuing annual program user fee requirements for approved products. In addition, manufacturers and other entities involved in the manufacture and distribution of approved therapeutics are required to register their establishments with the FDA and certain state agencies, list their products, and are subject to periodic announced and unannounced inspections or remote regulatory assessment by the FDA and these state agencies for compliance with cGMP and other requirements, which impose certain procedural and documentation requirements upon sponsors and third-party manufacturers. The information that must be submitted to FDA regarding manufactured products was expanded through the Coronavirus Aid, Relief, and Economic Security, or CARES, Act to include the volume of drugs produced during the prior year. Manufacturers must continue to expend time, money, and effort in the areas of production and quality-control to maintain compliance with cGMPs. Regulatory authorities may withdraw product approvals, require label modifications or request product recalls, among other actions, if a company fails to comply with regulatory standards, if it encounters problems following initial marketing, or if previously unrecognized problems are subsequently discovered. Many states also regulate the distribution of drug product samples and commercial product.

Changes to the manufacturing process are strictly regulated and often require prior FDA approval or notification before being implemented. FDA regulations also require investigation and correction of any deviations from cGMP and specifications and impose reporting and documentation requirements upon the sponsor and any third-party manufacturers that the sponsor may decide to use. Accordingly, manufacturers must continue to expend time, money, and effort in the area of production and quality control to maintain cGMP compliance.

The FDA also strictly regulates marketing, labeling, advertising, and promotion of products that are placed on the market. A company can make only those claims relating to safety and efficacy, purity, and potency that are consistent with the FDA approved label. All promotional and advertising statements must further be truthful and non-misleading, adequately substantiated, and must contain a fair balance between product benefit and risk information. Recently, FDA has taken a few actions in the advertising and promotional spaces, including issuing a final rule and a guidance on risk and efficacy disclosures in direct to consumer advertising, and a guidance on communication of off-label scientific information about approved products. Physicians, in their independent professional medical judgment, may prescribe legally available products for unapproved indications that are not described in the product’s labeling and that differ from those tested and approved by the FDA. Biopharmaceutical companies, however, are required to promote their products only for the approved indications and in accordance with the provisions of the approved label. The FDA and other agencies actively enforce the laws and regulations prohibiting the promotion of off-label uses, and a company that is found to have improperly promoted off-label uses may be subject to significant liability, including, but not limited to, criminal and civil penalties under the FDCA and False Claims Act, exclusion from participation in federal healthcare programs, mandatory compliance programs under corporate integrity agreements, suspension and debarment from government procurement and non-procurement programs, and refusal of orders under existing government contracts.

15

TABLE OF CONTENTS

Moreover, the Drug Quality and Security Act imposes obligations on manufacturers of biopharmaceutical products related to product tracking and tracing. Among the requirements of this legislation, manufacturers are required to provide certain information regarding the products to individuals and entities to which product ownership is transferred, are required to label products with a product identifier, and are required to keep certain records regarding the product. The transfer of information to subsequent product owners must be transferred electronically. FDA is also phasing in requirements with respect to the interoperable exchange of electronic product tracing at the package level. Manufacturers must further verify that purchasers of the manufacturers’ products are appropriately licensed. Additionally, under this legislation, manufactures have product investigation, quarantine, disposition, and notification responsibilities related to counterfeit, diverted, stolen, and intentionally adulterated products that would result in serious adverse health consequences or death to humans, as well as products that are the subject of fraudulent transactions or which are otherwise unfit for distribution such that they would be reasonably likely to result in serious health consequences or death. Similar requirements additionally are imposed through this legislation on other companies within the biopharmaceutical product supply chain, such as distributors and dispensers.

Adverse event reporting and submission of periodic reports, including annual reports and deviation reports, are required following FDA approval of a BLA. Later discovery of previously unknown problems with a product, including adverse events of unanticipated severity or frequency, or with manufacturing processes, or failure to comply with regulatory requirements, may result in significant regulatory actions. Such actions may include refusal to approve pending applications, license suspension or revocation, imposition of a clinical hold or termination of clinical trials, warning letters, untitled letters, cyber letters, modification of promotional materials or labeling, provision of corrective information, imposition of post-market requirements including the need for additional testing, imposition of distribution or other restrictions under a REMS, product recalls, product seizures or detentions, refusal to allow imports or exports, total or partial suspension of production or distribution, FDA debarment, injunctions, fines, consent decrees, corporate integrity agreements, suspension and debarment from government procurement and non-procurement programs, refusal of orders under existing government contracts, exclusion from participation in federal and state healthcare programs, restitution, disgorgement, civil penalties, criminal fines and imprisonment, and result in adverse publicity, among other adverse consequences.

The FDA post-approval requirements are continually evolving. For example, in March 2020, the U.S. Congress passed the CARES Act, which includes various provisions regarding FDA drug shortage and manufacturing volume reporting requirements, as well as provisions regarding supply chain security, such as risk management plan requirements, and the promotion of supply chain redundancy and domestic manufacturing. As part of the CARES Act implementation, the FDA issued guidance on the reporting of the volume of drugs produced, which reporting will require additional administrative efforts by drug manufacturers. In recent years, both the U.S. Congress and the President have taken actions to encourage the use of domestic pharmaceutical suppliers.

Broadly equivalent requirements, controls and sanctions similarly apply to supply, QA, manufacture, labelling, advertising, pharmacovigilance and tracing of medicinal products as imposed by European Union laws and enforced by European Union national regulatory authorities.

Additional controls for biologics and oncology programs

To help reduce the increased risk of the introduction of adventitious agents, the PHSA emphasizes the importance of manufacturing controls for products whose attributes cannot be precisely defined. The PHSA also provides authority to the FDA to immediately suspend licenses in situations where there exists a danger to public health, to prepare or procure products in the event of shortages and critical public health needs, and to authorize the creation and enforcement of regulations to prevent the introduction or spread of communicable diseases in the United States and between states.

After a BLA is approved, the product may also be subject to official lot release as a condition of approval. As part of the manufacturing process, the manufacturer is required to perform certain tests on each lot of the product before it is released for distribution. If the product is subject to official release by the FDA, the manufacturer submits samples of each lot of product to the FDA together with a release protocol showing the results of all of the manufacturer’s tests performed on the lot. The FDA may also perform certain confirmatory tests on lots of some products before releasing the lots for distribution by the manufacturer.

In addition, the FDA conducts laboratory research related to the regulatory standards on the safety, purity, potency, and effectiveness of biological products. There are also a number of additional standards that apply to oncolytic virus products. The FDA has issued various applicable guidance documents on factors that the agency considers during product development including, but not limited to, preclinical assessments; chemistry manufacturing and controls; and long-term patient and clinical study subject follow up and regulatory reporting. In the European Union, while there is no direct equivalent to the separate route for biologics, the EMA issues scientific guidelines on biological medicinal products and the standard Common Technical Document structure is modified for biologicals and plasma-derived products.

16

TABLE OF CONTENTS

With respect to oncology product candidates, FDA has also established a number of different projects, intended to address different aspects of oncology development. For instance, FDA’s Project Optimus is an initiative at FDA to reform dose optimization and selection. Project FrontRunner is aimed at encouraging drug sponsors to potentially pursue the development of products for earlier clinical settings, rather than for the treatment of patients who have received a number of different prior therapies. Project Confirm is a third FDA initiative, which aims to promote transparency regarding the outcomes related to accelerated approval products.

Other regulatory agencies may also regulate our use of biological materials, which may necessitate that we, our manufacturers, or other third parties with whom we work obtain permits and otherwise comply with regulatory requirements.

Fraud and abuse, data privacy and security, and transparency laws and regulations

Our business activities, including but not limited to, research, sales, promotion, distribution, medical education, and other activities following product approval will be subject to regulation by numerous federal and state regulatory and law enforcement authorities in the United States in addition to the FDA, including potentially the Department of Justice, the Department of Health and Human Services and its various divisions, including the Centers for Medicare & Medicaid Services, or CMS and the Health Resources and Services Administration, the Department of Veterans Affairs, the Department of Defense, and state and local governments. Our business activities must comply with numerous healthcare laws, including but not limited to, anti-kickback and false claims laws and regulations as well as data privacy and security laws and regulations, which are described below, as well as state and federal consumer protection and unfair competition laws.

The federal Anti-Kickback Statute, which regulates, among other things, marketing practices, educational programs, pricing policies, and relationships with healthcare providers or other entities, prohibits, among other things, any person or entity from knowingly and willfully offering, paying, soliciting, or receiving any remuneration, directly or indirectly, overtly or covertly, in cash or in kind, to induce or in return for purchasing, leasing, ordering, or arranging for or recommending the purchase, lease, or order, or the referral to another for the furnishing or arranging for the furnishing of any item or service reimbursable under Medicare, Medicaid, or other federal healthcare programs, in whole or in part. The term “remuneration” has been interpreted broadly to include anything of value. The Anti-Kickback Statute has been interpreted to apply to arrangements between biopharmaceutical manufacturers on one hand and prescribers, purchasers, and formulary managers, on the other, as well as to free trial and starter prescriptions provided through pharmacies. There are certain statutory exceptions and regulatory safe harbors protecting some common activities from prosecution. Health and Human Services, or HHS, recently promulgated a regulation that is effective in two phases. First, the regulation excludes from the definition of “remuneration” limited categories of (a) PBM rebates or other reductions in price to a plan sponsor under Medicare Part D or a Medicaid Managed Care Organization plan reflected in point-of sale reductions in price and (b) PBM service fees. Second, the regulation expressly provides that rebates to plan sponsors under Medicare Part D either directly to the plan sponsor under Medicare Part D, or indirectly through a pharmacy benefit manager will not be protected under the anti-kickback discount safe harbor. Recent legislation has delayed implementation of the aforementioned regulation until January 1, 2032. The exceptions and safe harbors are drawn narrowly, and practices that involve remuneration that may be alleged to be intended to induce prescribing, purchases, or recommendations may be subject to scrutiny if they do not qualify for an exception or safe harbor. Failure to meet all of the requirements of a particular applicable statutory exception or regulatory safe harbor does not make the conduct per se illegal under the Anti-Kickback Statute. Instead, the legality of the arrangement will be evaluated on a case-by-case basis based on a cumulative review of all of the facts and circumstances. Several courts have interpreted the statute’s intent requirement to mean that if any one purpose of an arrangement involving remuneration is to induce referrals of federal healthcare covered business, including purchases of products paid by federal healthcare programs, the statute has been violated. The ACA modified the intent requirement under the Anti-Kickback Statute to a stricter standard, such that a person or entity no longer needs to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation. In addition, the ACA also provided that a violation of the federal Anti-Kickback Statute is grounds for the government or a whistleblower to assert that a claim for payment of items or services resulting from such violation constitutes a false or fraudulent claim for purposes of the federal civil False Claims Act.

The federal civil False Claims Act prohibits, among other things, any person or entity from knowingly presenting, or causing to be presented, a false or fraudulent claim for payment to, or approval by, the federal government, knowingly making, using, or causing to be made or used a false record or statement material to a false or fraudulent claim to the federal government, or avoiding, decreasing, or concealing an obligation to pay money to the federal government. A claim includes “any request or demand” for money or property presented to the U.S. government. The civil False Claims Act has been used to assert liability on the basis of kickbacks and other improper referrals, improperly reported government pricing metrics such as Best Price or Average Manufacturer Price, improper use of Medicare provider or supplier numbers when detailing a provider of services, improper promotion of off-label uses not expressly approved by the FDA in a product’s label, failure to comply with cGMP requirements, and allegations as to misrepresentations with respect to products, contract requirements and services

17

TABLE OF CONTENTS

rendered. In addition, private payers have filed follow-on lawsuits alleging fraudulent misrepresentation. Intent to deceive is not required to establish liability under the civil False Claims Act. Civil False Claims Act actions may be brought by the government or may be brought by private individuals on behalf of the government, called “qui tam” actions. If the government decides to intervene in a qui tam action and prevails in the lawsuit, the individual will share in the proceeds from any fines or settlement funds. If the government declines to intervene, the individual may pursue the case alone. The civil False Claims Act provides for treble damages and a civil penalty for each false claim, such as an invoice or pharmacy claim for reimbursement, which can aggregate into hundreds of millions of dollars. For these reasons, since 2004, civil False Claims Act lawsuits against biopharmaceutical companies have increased significantly in volume and breadth, leading to several substantial civil and criminal settlements, as much as $3.0 billion, regarding certain sales practices and promoting off label uses. Civil False Claims Act liability may further be imposed for known Medicare or Medicaid overpayments that are not refunded within 60 days of discovering the overpayment, even if the overpayment was not caused by a false or fraudulent act. In addition, judgment for violating the civil False Claims Act may result in exclusion from participation in federal health care programs, suspension and debarment from government procurement and non-procurement programs, and refusal of orders under existing government contracts.

The government may further prosecute conduct constituting a false claim under the criminal False Claims Act. The criminal False Claims Act prohibits the making or presenting of a claim to the government knowing such claim to be false, fictitious, or fraudulent. Unlike the civil False Claims Act, the criminal False Claims Act requires proof of intent to submit a false claim.

The civil monetary penalties statute is another potential statute under which biopharmaceutical companies may be subject to enforcement. Among other things, the civil monetary penalties statute imposes penalties against any person who is determined to have knowingly presented, or caused to be presented, claims to a federal healthcare program that the person knows, or should know, is for an item or service that was not provided as claimed or is false or fraudulent.

Payment or reimbursement of prescription therapeutics, including, but not limited to, by Medicaid or Medicare requires manufacturers to submit certified pricing information to CMS. The Medicaid Drug Rebate statute requires manufacturers to calculate and report price points, which are used to determine Medicaid rebate payments shared between the states and the federal government and Medicaid payment rates for certain therapeutics. The Medicaid Drug Rebate statute also imposes inflation penalties, and recent legislative changes have removed the caps limiting the magnitude of these Medicaid penalties and the implementation of new inflation penalties applicable to the Medicare program. In addition to the Medicaid statutory rebate, states are authorized to negotiate supplemental rebates on pharmaceuticals included in their formularies. For therapeutics paid under Medicare Part B, manufacturers must also calculate and report their Average Sales Price, which is used to determine the Medicare Part B payment rate. For products approved under a BLA (including biosimilars), or an NDA, the Veterans Health Care Act, or VHCA, requires manufacturers to calculate and report to the Department Veterans Affairs, or VA, a different price called the Non-Federal Average Manufacturer Price, which is used to determine the maximum price that can be charged to certain federal agencies, referred to as the Federal Ceiling Price, or FCP. Like the Medicaid rebate amount, the FCP includes an inflation penalty. A Department of Defense regulation requires manufacturers to provide this discount on therapeutics dispensed by retail pharmacies when paid by the TRICARE Program. All of these price reporting requirements create risk of inadvertently submitting false information to the government, and potential FCA liability.

The VHCA also requires manufacturers of covered therapeutics participating in the Medicaid program to enter into Federal Supply Schedule contracts with the VA through which their covered therapeutics must be sold to certain federal agencies at FCP. This necessitates compliance with applicable federal procurement laws and regulations (e.g., Federal Acquisition Regulations), including submission of commercial sales and pricing information and certification of compliance with the Trade Agreements Act, and subjects us to contractual remedies as well as administrative, civil, and criminal sanctions. In addition, the VHCA requires manufacturers participating in Medicaid to agree to provide different mandatory discounts to certain Public Health Service grantees and other safety net hospitals and clinics under the 340B program based on the manufacturer’s reported Medicaid pricing information. The 340B program has its own regulatory authority to impose sanctions for non-compliance and adjudicate overcharge claims against manufacturers by the purchasing entities.

The federal Health Insurance Portability and Accountability Act of 1996, as amended, or HIPAA, also created federal criminal statutes that prohibit, among other actions, knowingly and willfully executing, or attempting to execute, a scheme to defraud or to obtain, by means of false or fraudulent pretenses, representations or promises, any of the money or property owned by, or under the custody or control of, a healthcare benefit program, regardless of whether the payor is public or private, in connection with the delivery or payment for health care benefits, knowingly and willfully embezzling or stealing from a health care benefit program, willfully obstructing a criminal investigation of a health care offense and knowingly and willfully falsifying, concealing, or covering up by any trick or device a material fact or making any materially false statements in connection with the delivery of, or payment for, healthcare benefits, items, or services relating to healthcare matters.

18

TABLE OF CONTENTS

Additionally, the ACA amended the intent requirement of certain of these criminal statutes under HIPAA so that a person or entity no longer needs to have actual knowledge of the statute, or the specific intent to violate it, to have committed a violation.

Under the federal Physician Payments Sunshine Act and its implementing regulations, manufacturers of biologics for which payment is available under Medicare, Medicaid, or the Children’s Health Insurance Program (with certain exceptions) must make annual reports to CMS regarding payments and other transfers of value made to or at the request of covered recipients, such as, but not limited to, physicians, physician assistants, nurse practitioners, clinical nurse specialists, and certified registered nurse anesthetists and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family. Certain research payments, including for clinical trials, are included within the ambit of this law. CMS makes the reported information publicly available.

Further, we may be subject to data privacy and security regulation by both the federal government and the states in which we conduct our business. HIPAA, as amended by the Health Information Technology for Economics and Clinical Health Act, or HITECH Act, and its respective implementing regulations imposes requirements on covered entities relating to the privacy, security, and transmission of certain individually identifiable health information known as protected health information. Among other things, the HITECH Act, through its implementing regulations, makes HIPAA’s security standards and certain privacy standards directly applicable to business associates, defined as a person or organization, other than a member of a covered entity’s workforce, that creates, receives, maintains, or transmits protected health information on behalf of a covered entity for a function or activity regulated by HIPAA. The HITECH Act also strengthened the civil and criminal penalties that may be imposed against covered entities, business associates, and individuals, and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorney’s fees and costs associated with pursuing federal civil actions. HIPAA imposes certain privacy requirements with respect to the use and disclosure of protected health information for research purposes, which will impact how we conduct our clinical trials. In addition, other federal and state laws, such as the California Consumer Privacy Act, may govern the privacy and security of health and other information in certain circumstances, many of which differ from each other in significant ways and may not be preempted by HIPAA, thus complicating compliance efforts. For example, certain states, such as Washington, Nevada and Connecticut, have enacted new privacy laws with respect to consumer health data that is not protected health information governed by HIPAA.

Many states have also adopted laws similar to each of the above federal laws, which may be broader in scope and apply to items or services reimbursed by any third-party payor, including commercial insurers. Certain state laws also regulate manufacturers’ use of prescriber-identifiable data. Certain states also require implementation of commercial compliance programs and compliance with the pharmaceutical industry’s voluntary compliance guidelines and the applicable compliance guidance promulgated by the federal government, or otherwise restrict payments or the provision of other items of value that may be made to healthcare providers and other potential referral sources; impose restrictions on marketing practices; or require manufacturers to track and report information related to payments, gifts, and other items of value to physicians and other healthcare providers. Recently, states have enacted or are considering legislation intended to make drug prices more transparent and deter significant price increases. These laws may affect our future sales, marketing, and other promotional activities by imposing administrative and compliance burdens.

If our operations are found to be in violation of any of the laws or regulations described above or any other laws that apply to us, we may be subject to penalties or other enforcement actions, including significant civil monetary penalties, damages, criminal fines, disgorgement, imprisonment, exclusion from participation in government healthcare programs, corporate integrity agreements, non- and deferred prosecution agreements, suspension and debarment from government procurement and non-procurement programs, and refusal of orders under existing government contracts, reputational harm, diminished profits and future earnings, and the curtailment or restructuring of our operations, any of which could adversely affect our ability to operate our business and our results of operations.

To the extent that any of our products are sold in a foreign country, we may be subject to similar foreign laws and regulations, which may include, for instance, applicable post-marketing requirements, including safety surveillance, anti-fraud and abuse laws, and implementation of corporate compliance programs and reporting of payments or transfers of value to healthcare professionals.

The European Union General Data Protection Regulation, the United Kingdom General Data Protection Regulation and related data protection, cybersecurity and e-privacy laws in the European Union, European Economic Area, or the EEA, and the United Kingdom, (collectively referred to herein as the “GDPR, and equivalent Swiss laws may apply to some or all of the clinical or other personal data obtained, transmitted, stored or otherwise processed by us (or on our behalf) from those jurisdictions. The GDPR contains potentially strict requirements with respect to lawfully processing personal data in connection with clinical trials and other business activities in Europe (including with respect to obtaining consents, securing personal data, notifying personal data breaches to supervisory authorities and affected data subjects, and transferring personal data outside

19

TABLE OF CONTENTS

Europe). The GDPR and Swiss law allow supervisory authorities to potentially impose high regulatory fines (among other enforcement tools) in the event of violations, for example, under the GDPR up to 4% of global annual group turnover or EUR 20 million (whichever is the higher amount). Supervisory authorities in the European Union and EEA, Switzerland and the United Kingdom may potentially levy such fines directly upon on the non-compliant entity and/or on the parent company (so-called “undertaking”) of the non-compliant entity. Separate from regulatory enforcement actions, individuals may bring private actions (including potentially group or representative actions). There is no statutory cap in the GDPR on the amount of compensation or the damages which individuals may recover.

Overall, the significant costs of GDPR and Swiss law compliance, risk of regulatory enforcement actions and private litigation under, and other burdens imposed by these laws as well as under other regulatory schemes throughout the world related to privacy and security of health information and other personal and private data could have an adverse impact on our business, reputation, financial condition, and results of operations. We may also be subject to additional industry-specific privacy, cybersecurity, data protection, operational and information systems resilience, and artificial intelligence-related laws in Europe which may subject us to additional similar risks and impacts.

Coverage and reimbursement generally

The commercial success of our product candidates and our ability to commercialize any approved product candidates successfully will depend in part on the extent to which governmental payor programs at the federal and state levels, including, but not limited to, Medicare and Medicaid, private health insurers, and other third-party payors, provide coverage for and establish adequate reimbursement levels for our product candidates. Government authorities, private health insurers, and other organizations generally decide which therapeutics they will pay for and establish reimbursement levels for healthcare. Medicare is a federally funded program managed by CMS through local fiscal intermediaries and carriers that administer coverage and reimbursement for certain healthcare items and services furnished to the elderly and disabled. Medicaid is an insurance program for certain categories of patients whose income and assets fall below state defined levels and who are otherwise uninsured that is both federally and state funded and managed by each state. The federal government sets general guidelines for Medicaid and each state creates specific regulations that govern its individual program, including supplemental rebate programs that restrict coverage to therapeutics on the state Preferred Drug List. Similarly, government laws and regulations establish the parameters for coverage of prescription therapeutics by health plans participating in state exchanges and Tricare, the health care program for military personnel, retirees, and related beneficiaries. Some states have also created pharmacy assistance programs for individuals who do not qualify for federal programs. In the United States, private health insurers and other third-party payors often provide reimbursement for products and services based on the level at which the government provides reimbursement through, amongst others, the Medicare or Medicaid programs for such products and services.

In the United States, the European Union, and other potentially significant markets for our product candidates, government authorities and third-party payors are increasingly attempting to limit or regulate the price of medical products and services, particularly for new and innovative products and therapies, which often has resulted in average selling prices lower than they would otherwise be and sometimes at or below the provider’s acquisition cost. In the United States, it is also common for government and private health plans to use coverage determinations to leverage rebates from manufacturers in order to reduce the plans’ net costs. These restrictions and limitations influence the purchase of healthcare services and products and lower the realization on manufacturers’ sales of prescription therapeutics. Third-party payors are developing increasingly sophisticated methods of controlling healthcare costs. Third-party payors may limit coverage to specific therapeutic products on an approved list, or formulary, which might not include all of the FDA-approved products for a particular indication or might impose high copayment amounts to influence patient choice. Third-party payors also control costs by requiring prior authorization or imposing other dispensing restrictions, such as, but not limited to step edits, before covering certain products and by broadening therapeutic classes to increase competition. Third-party payors are increasingly challenging the price and examining the medical necessity and cost-effectiveness of medical products and services, in addition to their safety and efficacy. Absent clinical differentiators, third-party payors may treat products as therapeutically equivalent and base formulary decisions on net cost. To lower the prescription cost, manufacturers frequently rebate a portion of the prescription price to the third-party payors. Recently, purchasers and third-party payors have begun to focus on value of new therapeutics and sought agreements in which price is based on achievement of performance metrics.

Federal programs also impose price controls through mandatory ceiling prices on purchases by federal agencies and federally funded hospitals and clinics and mandatory rebates on retail pharmacy prescriptions paid by Medicaid and Tricare. These restrictions and limitations influence the purchase of healthcare services and products. Legislative proposals to reform healthcare or reduce costs under government programs may result in lower reimbursement for our product candidates or exclusion of our product candidates from coverage. In addition, government programs like Medicaid include substantial penalties for increasing commercial prices over the rate of inflation over the lifecycle of a product. All of these conditions can affect realization and return on investment.

20

TABLE OF CONTENTS

Private payors often rely on the lead of the governmental payors in rendering coverage and reimbursement determinations. Therefore, achieving favorable CMS coverage and reimbursement is usually a significant gating issue for successful introduction of a new product. In addition, many government programs as a condition of participation mandate fixed discounts or rebates from manufacturers regardless of formulary position or utilization, and then rely on competition in the market to attain further price reductions, which can greatly reduce realization on the sale.

Further, the increased emphasis on managed healthcare in the United States and on country and regional pricing and reimbursement controls in the European Union will put additional pressure on product pricing, reimbursement, and utilization, which may adversely affect our future product sales and results of operations. These pressures can arise from rules and practices of managed care groups, competition within therapeutic classes, judicial decisions and governmental laws and regulations related to, amongst others, Medicare, Medicaid, and healthcare reform, biopharmaceutical coverage and reimbursement policies, and pricing in general. Patients who are prescribed treatments for their conditions and providers performing the prescribed services generally rely on third-party payors to reimburse all or part of the associated healthcare costs. Sales of our product candidates will therefore depend substantially, both domestically and abroad, on the extent to which the costs of our products will be paid by health maintenance, managed care, pharmacy benefit and similar healthcare management organizations, or reimbursed by government health administration authorities, such as, but not limited to, Medicare and Medicaid, private health insurers, and other third-party payors.

As a result of the above, we may need to conduct expensive pharmacoeconomic and/or health technology assessment studies in order to demonstrate the medical necessity and cost-effectiveness of our products, in addition to the costs required to obtain the FDA and EMA approvals. Our product candidates may not be considered medically necessary or cost-effective, or the rebate percentages required to secure coverage may not yield an adequate margin over cost.

Moreover, a payor’s decision to provide coverage for a product does not imply that an adequate reimbursement rate will be approved. Adequate third-party reimbursement may not be available to enable us to maintain price levels sufficient to realize an appropriate return on our investment in therapeutic development. Legislative or regulatory proposals to reform healthcare or reduce costs under government insurance programs may result in lower reimbursement for our products and product candidates or exclusion of our products and product candidates from coverage. The cost containment measures that healthcare payors and providers are instituting and any healthcare reform could significantly reduce our revenues from the sale of any approved product candidates. We cannot provide any assurances that we will be able to obtain and maintain third-party coverage or adequate reimbursement for our product candidates in whole or in part.

The absence in Europe of any substantive harmonization of pricing and reimbursement regimes, including health technology assessment, means that separate negotiations will need to take place with the relevant authorities in each member state and may include a variety of risk share agreements with payors.

Healthcare reform measures

The United States and some foreign jurisdictions are considering or have enacted a number of legislative and regulatory proposals designed to change the healthcare system in ways that could affect our ability to sell our products profitably. Among policy makers and payors in the United States and elsewhere, there is significant interest in promoting changes in healthcare systems with the stated goals of containing healthcare costs, improving quality, and expanding access. In the United States, the biopharmaceutical industry has been a particular focus of these efforts and has been significantly affected by major legislative initiatives, such as, but not limited to, the Inflation Reduction Act, or IRA, and the Bayh-Dole Act march-in rights expansion.

For example, on November 27, 2020, CMS issued an interim final rule implementing a Most Favored Nation payment model under which reimbursement for certain Medicare Part B drugs and biologicals would have been based on a price that reflected the lowest per capita Gross Domestic Product-adjusted (GDP-adjusted) price of any non-U.S. member country of the Organization for Economic Co-operation and Development (OECD) with a GDP per capita that was at least sixty percent of the U.S. GDP per capita. Any reduction in reimbursement from Medicare and other government programs may result in a similar reduction in payments from private payors. This rule has now been rescinded, but similar programs have been described in recent legislative proposals. Our results of operations could be adversely affected by current and future healthcare legislation and reforms.

Moreover, the ACA broadened access to health insurance, attempts to reduce or constrain the growth of healthcare spending, enhanced remedies against fraud and abuse, added new transparency requirements for healthcare and health insurance industries, imposed new taxes and fees on the health care industry, and imposed additional health policy reforms. The law expanded the eligibility criteria and mandatory eligibility categories for Medicaid programs, thereby potentially increasing both the volume of sales and manufacturers’ Medicaid rebate liability. The law also expanded the 340B discount program that mandates discounts to certain hospitals, community centers, and other qualifying providers, by expanding the categories of entities eligible to purchase under the program. In addition, the ACA authorized civil monetary penalties for violating 340B

21

TABLE OF CONTENTS

pricing requirements, and regulations implementing this authority became effective on January 1, 2019. The ACA revised the definition of “average manufacturer price”, or AMP, for reporting purposes, which generally increased the amount of Medicaid rebates to states and created a separate AMP for certain categories of administered therapeutics provided in non-retail outpatient settings. The law additionally extended manufacturer’s Medicaid rebate liability to covered therapeutics dispensed to patients enrolled in Medicaid managed care organizations and increased the statutory minimum rebates a manufacturer must pay under the Medicaid Drug Rebate program. The revisions to the AMP definition and Medicaid rebate formula can have the further effect of increasing the required 340B discounts. Further, the ACA required manufacturers of covered therapeutics to pay mandatory Medicare Part D coverage gap rebates, and the Bipartisan Budget Act of 2018, increased the required percentage to 70% of the pharmacy charge to Medicare Part D patients while they are in the coverage gap. Finally, the ACA imposes a significant annual fee on companies that manufacture or import branded prescription therapeutic products. Substantial new provisions affecting compliance have also been enacted through the ACA and otherwise, including the reporting of therapeutic sample distribution, which may require us to modify our business practices with healthcare practitioners. Although the ACA was later amended to repeal the individual insurance mandate, and efforts to repeal and replace portions of the law may continue, it is likely that pressure on biopharmaceutical pricing, especially under the Medicare program, will continue, and may also increase our regulatory burdens and operating costs. Moreover, in the coming years, additional changes could be made to governmental healthcare programs that could significantly impact the success of our product candidates.

Most recently, on April 15, 2025, the U.S. Administration released Executive Order entitled Lowering Drug Prices by Once Again Putting Americans First. Amongst other agencies, it directs the Secretary of HHS to take wide-ranging steps aimed to lower U.S. drug prices, including prices for biologic products. Solely by example, the Executive Order requires the Secretary to propose and seek comment and guidance on the differential treatment of small and large molecule drug products under the IRA’s Medicare Drug Price Negotiation Program. Depending on the ultimate outcome of these steps, the pricing and reimbursement rates for any of our approved drug products, and our ultimate revenue realization could be adversely impacted.

The cost of biopharmaceuticals continues to generate substantial governmental and third-party payor interest. We expect that the biopharmaceutical industry will experience pricing pressures due to the trend toward managed healthcare, the increasing influence of managed care organizations and additional legislative proposals. Our results of operations could be adversely affected by current and future healthcare reforms.

Some third-party payors also require pre-approval of coverage for new or innovative devices or therapies before they will reimburse healthcare providers that use such therapies. While we cannot predict whether any proposed cost-containment measures will be adopted or otherwise implemented in the future, the announcement or adoption of these proposals could have a material adverse effect on our ability to obtain adequate prices for our product candidates.

In addition, other legislative changes have been proposed and adopted since the ACA was enacted. The Budget Control Act of 2011, as amended, created the Joint Select Committee on Deficit Reduction to recommend proposals in spending reductions to Congress. The Joint Select Committee on Deficit Reduction did not achieve its targeted deficit reduction of at least $1.2 trillion for the years 2013 through 2021, triggering the legislation’s automatic reductions to several government programs. These reductions include aggregate reductions to Medicare payments to providers of up to 2% per fiscal year. The Bipartisan Budget Act of 2018 retained the federal budget “sequestration” Medicare payment reductions of 2%, at present that reduction has been extended through 2030. The American Taxpayer Relief Act of 2012 further reduced Medicare payments to several categories of healthcare providers and increased the statute of limitations period for the government to recover overpayments to providers from three to five years. These and other healthcare reform initiatives may result in additional reductions in Medicare and other healthcare funding, which could have a material adverse effect on our financial operations. We expect that additional state and federal healthcare reform measures will be adopted in the future, any of which could limit the amounts that federal and state governments will pay for healthcare products and services, which could further limit the prices we are able to charge, or the amounts of reimbursement available, for our product candidates if approved and commercialized. The Bipartisan Budget Act also extended Manufacturer responsibility for prescription costs in the Medicare Part D coverage gap to biosimilars, which had previously been exempt.

The Foreign Corrupt Practices Act

The Foreign Corrupt Practices Act, or FCPA, prohibits any U.S. individual or business from paying, offering, or authorizing payment or offering of anything of value, directly or indirectly, to any foreign official, political party, or candidate or representatives of international organizations for the purpose of influencing any act or decision of the foreign entity in order to assist the individual or business in obtaining or retaining business or obtaining an improper advantage. The FCPA also obligates companies whose securities are listed in the United States to comply with books and records and accounting control provisions requiring the company to maintain books and records that accurately and fairly reflect all transactions of the corporation, including international subsidiaries, and to devise and maintain an adequate system of internal accounting controls for international operations. Activities that violate the FCPA, even if they occur wholly outside the United States, can result in

22

TABLE OF CONTENTS

criminal and civil fines, imprisonment, disgorgement, oversight by compliance monitors, and suspension and debarment from government contracts, and refusal of orders under existing government contracts.

Other foreign anti-corruption regimes are arguably of wider application. For instance, the U.K. Bribery Act 2010 applies to dealings with any decision maker whether in the private or public sector in a position of trust.

Human capital

As of March 31, 2025, we employed 479 employees, all of which are full-time employees. Of the 479 employees, 347 are in research and development and 132 are in selling, general and administrative functions. We have never had a work stoppage, and none of our employees are represented by a labor organization or under any collective bargaining arrangements. We consider our employee relations to be good.

We believe that developing an inclusive culture with talent reflecting a diverse range of backgrounds, experiences, and perspectives is important to attracting and retaining the top talent necessary to deliver on our growth strategy. As such, we strive for, and are investing in, a work environment where our employees feel inspired and included.

We focus on identifying, attracting, retaining and developing highly talented and motivated employees. Our equity and cash incentive plans are aligned to attract, retain and reward our employees through the granting of stock-based and cash-based compensation awards. We conduct annual internal and external pay reviews to ensure fair and equitable pay for our employees, which includes an internal pay equity analysis, as well as the use of an external compensation analysis expert for the review of our employees' pay against external market data. We believe motivating our employees to perform at their highest level and take pride in achieving company goals increases stockholder value.

We are committed to our employees’ health, safety and well-being. Our work paradigm is flexible and designed to accommodate a range of work profiles. Our workforce is a combination of full-time on-site, hybrid, and fully remote employees, including both at our manufacturing facility as well as in our offices in Woburn and the United Kingdom. We offer a wide variety of competitive benefits to support our employees' physical, mental and financial well-being. Our benefits package is comprehensive in coverage and offers options to support all employees in staying healthy, planning for their future and developing their careers. Our management continues to assess and respond to the evolving needs of our workforce.

Corporate information

We are a Delaware corporation organized in July 2017. Our principal executive offices are located at 500 Unicorn Park Drive, Suite 303, Woburn, MA 01801, and our telephone number is (781) 222-9600. Our website is www.replimune.com. Information that is contained on, or that can be accessed through, our website is not incorporated by reference into this Annual Report on Form 10-K, and you should not consider information on our website to be part of this Annual Report on Form 10-K.

Available information

We make available free of charge on the investor relations portion of our website our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, Proxy Statements for our annual meetings of stockholders, and amendments to those reports, as soon as reasonably practicable after we file such material with, or furnish it to, the Securities and Exchange Commission, or SEC. These filings are available for download free of charge on the investor relations portion of our website located at https://ir.replimune.com. The SEC also maintains a website that contains reports, proxy and information statements and other information about issuers, like us, that file electronically with the SEC. The address of that website is https://www.sec.gov.