LIANY

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our unaudited consolidated financial statements and the related notes to those statements included elsewhere in this Quarterly Report on Form 10-Q and the audited financial statements and related notes thereto as of and for the year ended December 31, 2022 and the related management’s discussion and analysis of financial condition and results of operations included in our Annual Report on Form 10-K, filed with the Securities and Exchange Commission (the “SEC”) on March 28, 2023. In addition to historical financial information, the following discussion and analysis contains forward-looking statements that involve risks, uncertainties and assumptions. You should read the “Risk Factors” and “Cautionary Note Regarding Forward-Looking Statements” sections of this report and the section entitled “Risk Factors” in our Annual Report on Form 10-K and this Quarterly Report on Form 10-Q for a discussion of important factors that could cause our actual results to differ materially from the results described in or implied by the forward-looking statements contained in the following discussion and analysis. Some of the numbers included herein have been rounded for the convenience of presentation. Overview We are a clinical stage biopharmaceutical company dedicated to bringing innovative medicines to patients with unmet medical needs in Asia. Our initial focus is to in-license assets for development and commercialization in Greater China and other Asian markets. We have a pipeline of seven therapeutic candidates across oncology, ophthalmology and inflammation indications, each with its own distinct value proposition and the potential to drive new standards of care. With operations in China, Asia Pacific, and the United States, we have built a cross-border platform to provide our licensing partners access to our regulatory, development, and commercial expertise in China and other Asian markets. We have created a diverse, balanced portfolio of highly differentiated assets that represent our broad program scope and significant potential market opportunity across various stages of development, providing multiple avenues for value creation. We intend to continue to evaluate innovative, complementary product candidates with the potential to become new standards of care in Asia to deepen our pipeline. In November 2021, we completed an initial public offering (“IPO”) of our ordinary shares through the sale and issuance of 20,312,500 American Depositary Shares (“ADSs”), at a public offering price of $16.00 per ADS. Following the closing of the IPO, on December 1, 2021, the underwriters partially exercised their option to purchase additional shares and purchased an additional 593,616 ADSs at the initial public offering price of $16.00 per ADS. We received gross proceeds of $334.5 million in connection with the IPO and subsequent exercise of the underwriters’ option and aggregate net proceeds of $304.8 million after deducting underwriting discounts, commissions and other offering expenses. The following diagram depicts our corporate structure as of September 30, 2023. As of September 30, 2023, the shares of each of our subsidiaries are 100% owned by the respective entity displayed immediately above that subsidiary. Certain warrant rights are outstanding and may be exercised in the future for equity interests in our Cayman parent entity, LianBio, as described in “Note 10: Equity” in the notes to our consolidated financial statements included in our Annual Report on Form 10-K for the fiscal year ended December 31, 2022, filed with the SEC on March 28, 2023. Currently, our corporate structure contains no variable interest entities. 24 Table of Contents Within the organization, investor cash inflows have all been received by our parent Cayman entity, LianBio. Cash to fund our Chinese operations is transferred from our Cayman parent entity down through our Hong Kong entities and then into our Chinese entities through capital contributions. Cash to fund our operations in the United States is transferred from our Cayman parent entity down to our United States entity through a capital contribution. Recent Business Highlights and Clinical Development Updates Mavacamten In October 2023, we entered into an agreement with Bristol Myers Squibb (“BMS”), whereby BMS obtained our exclusive rights to develop and commercialize mavacamten in Mainland China, Hong Kong, Macau, Taiwan, Singapore and Thailand, in conjunction with termination of the exclusive license agreement we previously entered into with MyoKardia, Inc., now a wholly owned subsidiary of BMS, in August 2020 to acquire such rights. Under the terms of the agreement, we received a one-time payment of $350 million. In addition, we are released from expected payment obligations of $127.5 million in remaining milestone payments under the MyoKardia license agreement. In August 2023, we announced that data from the Phase 3 EXPLORER-CN trial of mavacamten in Chinese symptomatic obstructive hypertrophic cardiomyopathy (“oHCM”) patients were presented in a late-breaking science session at the European Society of Cardiology (ESC) Congress 2023 and simultaneously published in JAMA Cardiology, with mavacamten demonstrating statistically significant and clinically meaningful improvement in Valsalva left ventricular outflow tract (LVOT) peak gradient, the study’s primary endpoint. 25 Table of Contents TP-03 In July 2023, our partner Tarsus Pharmaceuticals announced the U.S. Food and Drug Administration’s approval of TP-03 for the treatment of adults with Demodex blepharitis. In October 2023, we announced topline data from the Phase 3 LIBRA trial of TP-03 in Chinese patients with Demodex blepharitis. The LIBRA trial met the co-primary endpoint of mite eradication at day 43 (0<0.001). A positive, but not statistically significant trend was observed for the co-primary endpoint of complete collarette cure (p=0.15). TP-03 was well tolerated with a safety profile similar to that observed in other large-scale clinical trials, and there were no treatment-related discontinuations. We plan to discuss these results with the China National Medical Products Administration and expect to use these data to support a New Drug Application filing in China. Infigratinib In October 2023, we announced the presentation of efficacy and safety data from a Phase 2a study evaluating infigratinib in Chinese patients with locally advanced or metastatic gastric cancer or gastroesophageal junction adenocarcinoma with fibroblast growth factor receptor-2 gene amplification at the 2023 European Society for Medical Oncology Congress. Confirmed objective response rate was 23.8% (95% CI: 8.2 – 47.2), disease control rate was 76.2% (95% CI: 52.8 – 91.8) and median duration of response was 3.8 months (95% CI: 3.6 – NE). Median progression-free survival was 3.3 months (95% CI: 2.3 – 4.5) and median overall survival was 8.0 months (95% CI: 4.1 – NE). BBP-398 In July 2023, we announced a clinical supply agreement with AstraZeneca in China to evaluate the safety and efficacy of BBP-398, an investigational SHP2 inhibitor, in combination with AstraZeneca’s osimertinib, an epidermal growth factor receptor (“EGFR”) inhibitor, in a Phase 1 clinical study for the treatment of patients with non-small cell lung cancer (“NSCLC”) with EGFR mutations. In August 2023, we announced that the first patient was treated in the Phase 1 trial of BBP-398 in combination with osimertinib in Chinese NSCLC patients with EGFR mutations. Corporate Developments In October 2023, we announced that our Board of Directors initiated a comprehensive strategic review of the Company. The Board of Directors expects to provide an update on its strategic review in the first half of 2024. In October 2023, the exclusivity period under our exclusivity agreement with BridgeBio Pharma, LLC expired. Factors Affecting Our Results of Operations Impact of the COVID-19 pandemic on our operations Beginning in December 2019, the outbreak of the COVID-19 pandemic created business interruptions for companies globally, including us. For example, in the biotechnology sector, companies, including our company, have experienced delays in their ability to enroll patients at clinical trial sites because of the pandemic, potentially leading to delays in the regulatory approval process. We have been carefully monitoring the COVID-19 pandemic and its impact on our business. We have taken important steps to ensure the workplace safety of our employees when working within our administrative offices, or when traveling to our clinical trial sites. We may take further actions as may be required by federal, state or local authorities. To date, we have been able to continue our key business activities and advance our clinical programs. We maintain regular communication with our vendors and clinical sites to appropriately plan for, and mitigate, the impact of the COVID-19 pandemic on our operations. 26 Table of Contents Key Components of Results of Operations Research and development expenses We believe our ability to successfully develop product candidates will be a significant factor affecting our long-term competitiveness, as well as our future growth and development. Developing high quality product candidates requires a significant investment of resources over a prolonged period of time, and a core part of our strategy is to continue making sustained investment in this area. We expect our research and development expense to increase significantly in connection with our ongoing activities, particularly as we advance the clinical development of our product candidates and initiate additional clinical trials of, and seek regulatory approval for, these and other future product candidates. These expenses include: •payments made under third party licensing and asset acquisition agreements; •employee-related expense, including salaries, related benefits, equity-based compensation and travel expenses for employees engaged in research and development functions; •expense incurred in connection with the clinical development of our product candidates, including expenses incurred under agreements with contract research organizations (“CROs”); •costs related to compliance with regulatory requirements; and •facilities, depreciation and amortization, insurance and other direct and allocated expense incurred as a result of research and development activities. The following table sets forth the components of our research and development expenses for the periods indicated: Three Months Ended September 30, 2023 Three Months Ended September 30, 2022 Nine Months Ended September 30, 2023 Nine Months Ended September 30, 2022 Research and development expenses (in thousands): Licensing fees — — 2,500 25,000 Employee related expense 2,873 3,023 8,564 8,609 CRO costs 5,489 4,417 15,768 13,463 Other costs 656 818 2,471 2,106 Total $ 9,018 $ 8,258 $ 29,303 $ 49,178 We monitor research and development expenses associated with our clinical assets at the program level to some degree. We do not allocate employee-related expenses and other costs to specific research and development programs as these costs are deployed across multiple programs under research and development and are separately classified as unallocated research and development expenses. 27 Table of Contents The following table summarizes our research and development expenses by program for the periods indicated: Three Months Ended September 30, 2023 Three Months Ended September 30, 2022 Nine Months Ended September 30, 2023 Nine Months Ended September 30, 2022 Research and development (income) expenses (in thousands): Mavacamten 2,809 2,109 6,491 10,813 Infigratinib (474) 767 466 3,088 BBP-398 1,898 536 2,785 1,315 NBTXR3 650 721 3,403 2,178 LYR210 10 86 74 5,200 TP-03 768 546 5,933 16,342 Employee related expenses 2,873 3,022 8,564 8,610 Other costs 484 471 1,587 1,632 Total $ 9,018 $ 8,258 $ 29,303 $ 49,178 General and administrative expenses Our general and administrative expenses consist primarily of salaries and other related costs for personnel in executive, finance and administrative functions. General and administrative expenses also include professional fees for legal, consulting, auditing, tax services and insurance costs. We expect that our general and administrative expenses will increase in the future to support continued development and commercialization of our product candidates. These increases will likely include increased costs related to hiring additional personnel and fees to outside consultants, attorneys and accountants, among other expenses. Additionally, we have incurred and will continue to incur increased expenses associated with being a public company, including costs of additional personnel, accounting, audit, legal, regulatory and tax-related services associated with maintaining compliance with exchange listing and SEC requirements, director and office insurance costs, and investor and public relations costs. Interest income, net Interest income, net consists of interest income received on our cash balances and marketable securities and from the amortization/accretion on the premiums/discounts on marketable securities. Other income, net Other income (expense), net consists of unrealized gains and losses on foreign currencies held in our China subsidiary, Shanghai LianBio Development Co., Ltd., unrealized foreign exchange activity from the remeasurement of our intercompany payables, bank fees incurred on our cash balances and depositary fees related to our ADSs. Income taxes Provision for income taxes consists of U.S. federal and state income taxes and income taxes in certain foreign jurisdictions in which we conduct business. We expect income tax expense to increase over time as the Company continues to grow net income. We recorded income tax expense of $0.6 million and $1.2 million for the three and nine months ended September 30, 2023 and $0.0 million and $0.0 million for the three and nine months ended September 30, 2022, respectively. 28 Table of Contents Results of Operations Comparison of the three months ended September 30, 2023 and 2022 The following table sets forth a summary of our consolidated results of operations for the periods indicated. Three Months EndedSeptember 30, 2023 Three Months EndedSeptember 30, 2022 Operating expenses (in thousands): Research and development $ 9,018 $ 8,258 General and administrative 17,283 16,291 Total operating expenses 26,301 24,549 Loss from operations (26,301) (24,549) Other income: Interest income, net 2,707 1,405 Other income, net 141 1,253 Net loss before income taxes (23,453) (21,891) Income taxes 586 6 Net loss $ (24,039) $ (21,897) Research and development expenses Research and development expenses increased by $0.7 million from $8.3 million for the three months ended September 30, 2022 to $9.0 million for the three months ended September 30, 2023. For the three months ended September 30, 2023, research and development cost was primarily attributable to (i) $2.9 million in personnel-related expenses, including share-based compensation expense, and (ii) $5.5 million attributable to development activities to support our clinical trials. The remaining expense was attributable to professional fees. For the three months ended September 30, 2022, research and development cost was primarily attributable to (i) $3.0 million in personnel-related expenses, and (ii) $4.4 million attributable to development activities to support our clinical trials. The remaining expense was attributable to professional fees. General and administrative expenses General and administrative expenses increased by $1.0 million from $16.3 million for the three months ended September 30, 2022 to $17.3 million for the three months ended September 30, 2023. The increase was primarily attributable to a $0.9 million increase in personnel-related expenses, including share-based compensation expense, for increased employee headcount. Interest income Interest income increased by $1.3 million from $1.4 million for the three months ended September 30, 2022 to $2.7 million for the three months ended September 30, 2023. The increase was primarily attributable to our investments in marketable securities and interest earned on cash holdings in foreign countries. Other income, net Other income, net decreased by $1.2 million from $1.3 million for the three months ended September 30, 2022 to $0.1 million for the three months ended September 30, 2023. The decrease is primarily attributable to foreign exchange losses in our foreign entities and a decrease in depositary fees related to our ADSs. Income taxes Our income tax expense was $586.0 thousand, resulting in an effective income tax rate of (2.5)%, for the three months ended September 30, 2023. Our income tax expense was $6.0 thousand, resulting in an effective income tax rate of 0.0%, for the three months ended September 30, 2022. The variation in the effective income tax rate was primarily due to taxable income in foreign jurisdictions in 2023. 29 Table of Contents Comparison of the nine months ended September 30, 2023 and 2022 The following table sets forth a summary of our consolidated results of operations for the periods indicated. Nine Months Ended September 30, 2023 Nine Months Ended September 30, 2022 Operating expenses (in thousands): Research and development $ 29,303 $ 49,178 General and administrative 48,011 46,930 Total operating expenses 77,314 96,108 Loss from operations (77,314) (96,108) Other income: Interest income, net 7,867 2,238 Other income, net 966 1,873 Net loss before income taxes (68,481) (91,997) Income taxes 1,224 17 Net loss $ (69,705) $ (92,014) Research and development expenses Research and development expenses decreased by $19.9 million from $49.2 million for the nine months ended September 30, 2022 to $29.3 million for the nine months ended September 30, 2023. For the nine months ended September 30, 2023, research and development cost was primarily attributable to (i) $2.5 million related to an upfront payment related to the Tarsus Pharmaceuticals, Inc. clinical supply agreement (the “Tarsus Supply Agreement”), (ii) $8.6 million in personnel-related expenses, including share-based compensation expense, and (iii) $15.7 million attributable to development activities to support our clinical trials. The remaining expense was attributable to professional fees. For the nine months ended September 30, 2022, research and development cost was primarily attributable to (i) $15.0 million related to a development milestone payment payable pursuant to the Tarsus License Agreement, (ii) $5.0 million related to a development milestone payment payable pursuant with the MyoKardia License Agreement, (iii) $5.0 million related to a development milestone payment payable pursuant with the Lyra License Agreement, (iv) $13.5 million attributable to development activities to support our clinical trials and (v) $8.6 million in personnel-related expenses, including share-based compensation expense. The remaining expense was attributable to professional fees. General and administrative expenses General and administrative expenses increased by $1.1 million from $46.9 million for the nine months ended September 30, 2022 and $48.0 million for the nine months ended September 30, 2023. The increase was primarily attributable to a $3.8 million increase in personnel-related expenses, including share-based compensation expense, for increased employee headcount. This increase was partially offset by a $1.3 million decrease in legal service costs, consulting costs and accounting services. The remaining decrease was attributable to a decrease in insurance and other operating costs. Interest income Interest income increased by $5.7 million from $2.2 million for the nine months ended September 30, 2022 to $7.9 million for the nine months ended September 30, 2023. The increase was primarily attributable to our investments in marketable securities and interest earned on cash holdings in foreign countries. Other income, net Other income, net decreased by $0.9 million from $1.9 million for the nine months ended September 30, 2022 to $1.0 million for the nine months ended September 30, 2023. The decrease is primarily attributable to foreign exchange losses in our foreign entities and a decrease in depositary fees related to our ADSs. 30 Table of Contents Income taxes Our income tax expense was $1.2 million, resulting in an effective income tax rate of (1.8)%, for the nine months ended September 30, 2023. Our income tax expense was $17.0 thousand, resulting in an effective income tax rate of 0.0%, for the nine months ended September 30, 2022. The variation in the effective income tax rate was primarily due to taxable income in foreign jurisdictions in 2023. Liquidity and Capital Resources Sources of liquidity Since our incorporation, our operations have been substantially financed with proceeds from sales of preferred shares as part of the Series Seed financing, the Series A financing, the issuance of the 2020 Convertible Notes and our IPO, which was completed in November 2021. As of September 30, 2023, we had cash and cash equivalents and marketable securities of $252.2 million. We are a holding company with no operations of our own and, as such, we may rely on dividends and other distributions on equity paid by our Chinese subsidiaries to fund any cash and financing requirements we may have, including the funds necessary to pay dividends and other cash distributions to our shareholders or holders of our ADSs or to service any debt we may incur. Deterioration in the financial condition, earnings or cash flow of our subsidiaries for any reason, as well as any changes in Chinese laws or regulations, could limit or impair their ability to pay such distributions. For additional information, see “Part I—Item 1A—Risk Factors—Risks Related to Doing Business in China and Our International Operations—We may rely on dividends and other distributions on equity paid by our Chinese subsidiaries to fund any cash and financing requirements we may have, and any limitation on the ability of our Chinese subsidiaries to make payments to us could have a material and adverse effect on our ability to conduct our business” in our Annual Report on Form 10-K for the year ended December 31, 2022. Funding requirements Our primary use of cash is to fund our operating expenditures, consisting of research and development expense (including activities within our clinical and regulatory initiatives and upfront and milestone payments) and general and administrative expenses. Our use of cash is impacted by the timing and extent of the required payments for each of these activities. To date, we have not generated any material revenue. We do not expect to generate revenue from the sale of our products unless and until we (i) complete development of any of our product candidates; (ii) obtain applicable regulatory approvals; and (iii) successfully commercialize or enter into collaborative agreements for our product candidates. We do not know with certainty when, or if, any of these items will ultimately occur. We expect to incur continuing significant losses for the foreseeable future and for our losses to increase as we ramp up our clinical development programs and begin activities related to commercial launch readiness. We may encounter unforeseen expenses, difficulties, complications, delays and other currently unknown factors that could adversely affect our business. Moreover, since the completion of our IPO, we have incurred and will continue to incur additional costs associated with operating as a publicly traded company. We will require additional capital to develop our product candidates and fund our operations into the foreseeable future. We anticipate that we will eventually need to raise substantial additional capital, the requirements for which will depend on many factors, including: •the number and scope of clinical programs we decide to pursue; •the cost, timing and outcome of preparing for and undergoing regulatory review of our product candidates; •the cost and timing associated with commercializing our product candidates, if they receive regulatory approval; •the amount of revenue, if any, received from commercial sales of our product candidates, should any of our product candidates receive regulatory approval; •the achievement of milestones or occurrence of other developments that trigger payments under any collaboration agreements we might have at such time; •the extent to which we acquire or in-license other product candidates and technologies; •the costs of preparing, filing and prosecuting patent applications, maintaining and enforcing our intellectual property rights and defending intellectual property-related claims; 31 Table of Contents •our ability to establish and maintain collaborations on favorable terms, if at all; •our efforts to enhance operational systems and our ability to attract, hire and retain qualified personnel, including personnel to support the development of our product candidates and, ultimately, the sale of our products, following regulatory approval; •the impact of the COVID-19 pandemic and the Russian invasion of Ukraine on our clinical development or operations; and •the costs associated with being a public company. A change in the outcome of any of these or other variables with respect to the development and regulatory approval of any of our product candidates could significantly change the costs and timing associated with the development of that product candidate. Furthermore, our operating plans may change in the future, and we will continue to require additional capital to meet operational needs and capital requirements associated with such operating plans. If we raise additional funds by issuing equity securities, our shareholders may experience dilution. Any future debt financing into which we enter may impose upon us additional covenants that restrict our operations, including limitations on our ability to incur liens or additional debt, pay dividends, repurchase our ordinary shares, make certain investments or engage in certain merger, consolidation or asset sale transactions. Any debt financing or additional equity that we raise may contain terms that are not favorable to us or our shareholders. Adequate funding may not be available to us on acceptable terms or at all. Our potential inability to raise capital when needed could have a negative impact on our financial condition and our ability to pursue our additional licensing opportunities. Cash flows The following table sets forth the primary sources and uses of cash and cash equivalents for each of the periods presented: Nine Months Ended September 30, 2023 Nine Months Ended September 30, 2022 Net cash (used in) provided by (in thousands): Operating activities $ (52,814) $ (68,472) Investing activities 78,044 (80,197) Financing activities — 1,710 Net cash used in operating activities During the nine months ended September 30, 2023, operating activities used approximately $52.8 million of cash, primarily due to our net loss of $69.7 million, and non-cash consideration of $3.4 million and $1.2 million related to the amortization of discounts on investments and unrealized foreign currency transaction gains, respectively, partially offset by non-cash consideration of $13.3 million related to share-based compensation expense, $1.0 million related to depreciation expense and $7.2 million related to changes in operating assets and liabilities. During the nine months ended September 30, 2022, operating activities used approximately $68.5 million of cash, primarily due to our net loss of $92.0 million, and non-cash consideration of $1.4 million related to unrealized foreign currency transaction gains, partially offset by non-cash consideration of $13.9 million related to share-based compensation expense and $10.4 million related to changes in operating assets and liabilities. Net cash used in investing activities During the nine months ended September 30, 2023, investing activities provided approximately $78.0 million, consisting of approximately $206.4 million from the sales and redemption of marketable securities, partially offset by $128.1 million from the purchases of marketable securities. During the nine months ended September 30, 2022, investing activities used approximately $80.2 million, consisting of approximately $260.4 million for purchases of marketable securities, and approximately $1.6 million for purchases of property and equipment, partially offset by the sales and redemption of marketable securities of approximately $181.8 million. 32 Table of Contents Net cash provided by financing activities During the nine months ended September 30, 2023, we did not generate any net proceeds from financing activities. During the nine months ended September 30, 2022, financing activities provided approximately $1.7 million, primarily resulting from the proceeds from the exercise of share options. Critical Accounting Policies and Significant Judgments and Estimates Our management’s discussion and analysis of our financial condition and results of operations is based on our financial statements, which we have prepared in accordance with generally accepted accounting principles in the United States. The preparation of these financial statements requires us to make estimates and assumptions that affect the reported amounts of assets and liabilities and the disclosure of contingent assets and liabilities at the date of the financial statements, as well as the reported revenues and expenses during the reporting periods. Actual results may differ from these estimates under different assumptions or conditions. During the nine months ended September 30, 2023, there were no material changes to our critical accounting policies as reported in our Annual Report on Form 10-K for the year ended December 31, 2022. Impact of New Accounting Standards The adoption of new accounting standards and the impact of recent accounting pronouncements not yet effective on our consolidated financial statements, if any, is discussed in Note 2 to the interim unaudited consolidated financial statements included in this Quarterly Report on Form 10-Q.

During the period ended September 30, 2023, there were no material changes in our market risk or how our market risk is managed, compared to those disclosed under the heading “Quantitative and Qualitative Disclosures about Market Risk” in our Annual Report on Form 10-K for the year ended December 31, 2022.

To the best of our knowledge, we are not currently the subject of any material governmental investigation, private lawsuit or other legal proceeding. From time to time, we may be involved in legal and regulatory proceedings or investigations concerning matters that arise in the ordinary course of our business and that could result in significant fines or penalties, have an adverse impact on our reputation, business and financial condition or results of operations and divert the attention of our management from the operation of our business. The outcome of any future litigation, regulatory or other proceedings cannot be predicted with certainty, and some lawsuits, claims, actions or proceedings may be disposed of unfavorably to us. In addition, intellectual property disputes often have a risk of injunctive relief which, if imposed against us, could materially and adversely affect our business, financial condition or results of operations.

Information regarding risk factors appears in Part I, Item 1A, Risk Factors, in the Company’s Annual Report on Form 10-K for the year ended December 31, 2022. The Company has reviewed the risk factors, and, except as presented below, there have been no material changes in the Company’s risk factors since those reported in its Annual Report on Form 10-K for the year ended December 31, 2022, its Quarterly Report on Form 10-Q for the quarter ended March 31, 2023 and its Quarterly Report on Form 10-Q for the quarter ended June 30, 2023. We cannot assure you that the strategic review initiated by our Board of Directors will result in any transactions or other strategic changes or outcomes; and there may be negative impacts on our business and the price of our ADSs as a result of this strategic review. In October 2023, we announced that our Board of Directors has initiated a comprehensive strategic review of the Company. The Board of Directors expects to provide an update on the strategic review in the first half of 2024. There can be no assurance that the strategic review process will result in any transactions or any other strategic changes or outcomes, or as to the timing of any of the foregoing. Whether the process will result in any transactions, and our ability to complete any such transactions, will depend on numerous factors, some of which are beyond our control, including the interest of potential acquirers or strategic partners in a potential transaction, the value potential acquirers or strategic partners attribute to our business, market conditions, interest rates and industry trends. The price of our ADSs may be adversely affected if the strategic review does not result in any transactions or any other strategic changes or outcomes, or if one or more transactions are consummated on terms that investors view as unfavorable to us. Even if one or more transactions are completed, there can be no assurance that any such transactions will be successful or have a positive effect on the value of our ADSs. In addition, our financial results and operations could be adversely affected by the strategic review process and by the uncertainty regarding its outcome. The attention of management and our Board of Directors could be diverted from our core business operations, and we may divert capital and other resources to the process that otherwise could have been used in our business operations. We could incur substantial expenses associated with identifying and evaluating potential strategic alternatives, including those related to equity compensation, severance pay and legal, accounting and financial advisor fees. In addition, the process could lead us to lose or fail to attract, retain and motivate key employees or to lose or fail to attract business partners. Furthermore, in the past, securities litigation has often followed certain significant business transactions, such as the sale of a company or announcement of any other strategic transaction. We may be exposed to such litigation even if no wrongdoing occurred. Litigation is usually expensive and diverts management’s attention and resources, which could adversely affect our business and cash resources and our ability to consummate a potential transaction or the ultimate value to of a transaction.to our shareholders and holders of our ADSs. In addition, speculation regarding any developments related to the strategic review and perceived uncertainties related to the future of the Company could cause the price of our ADSs to fluctuate significantly. Compliance with the Data Security Law of the People’s Republic of China (the “Data Security Law”), Cybersecurity Review Measures, Personal Information Protection Law of the People’s Republic of China (the “PIPL”), the regulations and guidelines relating to the multi-level protection scheme (the “MLPS”) and any other future laws and regulations may entail significant expenses and could materially affect our business. Our failure to comply with such laws and regulations could lead to government enforcement actions and significant penalties against us, materially and adversely impacting our operating results. 34 Table of Contents China has implemented extensive data protection, privacy and information security rules and is considering a number of additional proposals relating to these subject areas. Based on our understanding of these laws, regulations and policies, some of which were only recently enacted, and the government regulators’ interpretation of those legal requirements as applied to biopharmaceutical companies like us, we believe we are compliant with all of our material legal obligations. Nevertheless, we face significant uncertainties and risks which, as explained below, may materially and adversely affect our operations. General risks surrounding the types of data we process and types of processing activities in which we engage We do not maintain, nor do we intend to maintain in the future, personally identifiable health information of patients in China. We do, however, collect and maintain de-identified or anonymized health data for clinical trials in compliance with local regulations. This data could be deemed by government regulators to be “personal information,” “important data,” or “core data.” Under the Cyber Security Law of the People’s Republic of China (the “Cyber Security Law”) and the Data Security Law, data categorized as core data or important data, the latter of which will be determined by governmental authorities in the form of catalogs which have not been published, is to be processed and handled with a higher level of protection, but what data constitutes core data or important data is currently not clearly defined except for certain industry sections. Therefore, in order to comply with the statutory requirements, we will need to determine whether we possess core data or important data, monitor the important data catalogs that are expected to be published by local governments and industry regulators, perform risk assessments and comply with reporting obligations to applicable regulators. We may also be required to disclose to regulators business-sensitive or network security-sensitive details regarding our processing of core data or important data. With China’s growing emphasis on its sovereignty over data derived from China, the outbound transmission of de-identified or anonymized health data for clinical trials may be subject to the new national security legal regime, including the Cyber Security Law, Data Security Law, the PIPL, the HGR Regulations and various implementing regulations and standards. Due to operational needs, we may from time to time transfer and store personal data and information outside of China in the future. Therefore, we will need to comply with the increasingly strict regulations over cross-border data transfers and monitor any new rules or regulations published by local governments and industry regulators. Cybersecurity The Cyber Security Law, which became effective in 2017, requires companies to take certain organizational, technical and administrative measures and other necessary measures to ensure the security of their networks and data stored on their networks. Specifically, the Cyber Security Law provides that companies adopt an MLPS, under which network operators are required to perform obligations of security protection to ensure that their networks are free from interference, disruption or unauthorized access, and prevent network data on their networks from being disclosed, stolen or tampered. Under the MLPS, entities’ operating information systems must have a thorough assessment of the risks and the conditions of their information and network systems to determine the level to which the entity’s information and network systems belong, from the lowest Level 1 to the highest Level 5 pursuant to a series of national standards on the grading and implementation of the classified protection of cyber security. The grading result will determine the set of security protection obligations that entities must comply with. Entities classified as Level 2 or above should report the grade to the relevant government authority for examination and approval. Under the Cyber Security Law and Data Security Law, we are required to establish and maintain a comprehensive data and network security management system that will enable us to monitor and respond appropriately to data security and network security risks. We will need to classify and take appropriate measures to address risks created by our data processing activities and use of networks. We are obligated to notify affected individuals and appropriate Chinese regulators of and respond to any data security and network security incidents. Establishing and maintaining such systems and complying with such requirements takes substantial time, effort, and cost, and we may not be able to establish and maintain such systems or comply with such requirements as fully as needed for compliance with our legal obligations. Despite our investment, such systems and compliance efforts may not adequately protect us or enable us to appropriately respond to or mitigate all data compliance risks or data security and network security risks or incidents we face. Cybersecurity review 35 Table of Contents Following the Draft Data Security Management Regulations, the Cybersecurity Review Measures, which came into effect on February 15, 2022, confirmed that critical information infrastructure operators procuring network products and services and online platform operators carrying out data processing activities, which affect or may affect national security, are required to conduct a cybersecurity review pursuant to the provisions therein. In addition, online platform operators possessing personal information of more than one million users seeking to be listed on foreign stock markets must apply for a cybersecurity review. Pursuant to the Draft Data Security Management Regulations, data processors seeking to list on foreign stock markets shall assess their data security themselves or through data security service organizations annually, and submit the assessment reports to relevant competent authorities. We have not received any notice from any Chinese regulatory authority identifying us as a “critical information infrastructure operator” or “online platform operator” or requiring us to go through cybersecurity review procedures by the CAC pursuant to the Cybersecurity Review Measures. Based on our understanding of the Cybersecurity Review Measures and the Draft Data Security Management Regulations, if enacted as currently proposed, we do not expect ourselves to become subject to cybersecurity review by the CAC for issuing securities to foreign investors because: (i) the clinical and preclinical data we handle in our business operations, either by its nature or in scale, do not normally trigger significant concerns over Mainland China’s national security; and (ii) we have not processed, and do not anticipate to process in the foreseeable future, personal information of more than one million users or individuals. However, there remains uncertainty as to how the Cybersecurity Review Measures and the Draft Data Security Management Regulations, if enacted as currently proposed, will be interpreted or implemented and whether Chinese regulatory authorities may adopt new laws, regulations, rules, or detailed implementation and interpretation in relation, or in addition, to the Cybersecurity Review Measures and the proposed Draft Data Security Management Regulations. While we intend to closely monitor the evolving laws and regulations in this area and take all reasonable measures to mitigate compliance risks, we cannot guarantee that our business and operations will not be adversely affected by the potential impact of the Cybersecurity Review Measures, the Draft Data Security Management Regulations, if enacted, or other laws and regulations related to privacy, data protection and information security. It is also unclear at the present time how widespread the cybersecurity review requirement and the enforcement action will be and what effect they will have on the life sciences sector generally and the Company in particular. Mainland China’s regulators may impose penalties for non-compliance ranging from fines to suspension of operations, and this could lead to us delisting from the U.S. stock market. Currently, we have not been involved in any investigations on cybersecurity review initiated by the CAC or related governmental regulatory authorities, and we have not received any inquiry, notice, warning, or sanction in such respect. Cross-border data transfer requirements (security assessment; certification; standard contract) China continues to strengthen its regulation of cross-border transfers out of Mainland China of data, including important data and personal information. The requirement for some data processors to store personal information or important data in China, unless certain legally recognized protective measures are undertaken, was first introduced in 2017 under the Cyber Security Law, but is now solidified through the publication of the PIPL and the Security Assessment Measures. The PIPL requires that personal information processors processing certain quantities of personal information in accordance with relevant laws and regulations and need to transfer such information out of Mainland China to pass a security assessment organized by Chinese cyberspace regulators, and all other personal information processors that are not required to pass the security assessment and need to transfer out of Mainland China personal information to either: (i) undergo certification by specialized certification agencies in accordance with relevant regulations, (ii) conclude a standard contract designated by China cyberspace regulators with the overseas recipient of the personal information, or (iii) satisfy other conditions contemplated by laws, administrative regulations or Chinese cyberspace regulators. In addition to the above, personal information processors that need to transfer out of Mainland China personal information shall conduct a privacy impact assessment. 36 Table of Contents Notably, the PIPL provides for significant fines for serious violations of up to RMB 50 million, or 5% of annual revenues from the prior year and violators may also be ordered to suspend any related activity by competent authorities. We do not maintain, nor do we intend to maintain in the future, personally identifiable health information of patients in China. We do, however, collect and maintain de-identified or pseudonymized health data for clinical trials in compliance with local regulations. This data could be deemed as personal data or important data. We may transfer and store personal data and information that whistleblowers provide through our whistleblower hotline to, in, and using centralized databases and systems located in the United States, Mainland China, and Hong Kong. In addition, we have engaged a third-party data processor to process the personal data and information that such whistleblowers provide, on our behalf. Such personal data and information will be stored in one or more databases located on servers hosted and operated by the third party, in the United States. To implement the security assessment mechanisms for cross-border transfers out of China of data under the Cyber Security Law, the Data Security Law, and the PIPL, the CAC promulgated the Security Assessment Measures, which took effect on September 1, 2022, and published the Security Assessment Guide on August 31, 2022. Under the Security Assessment Measures, a mandatory security assessment is required for data transfers out of Mainland China under any of the following circumstances: (i) transfer of important data by data processors; (ii) transfer of personal information by critical information infrastructure operators and data processors that process personal information of more than one million individuals; (iii) transfer of personal information by data processors that have transferred either personal information of over 100,000 individuals or sensitive personal information of over 10,000 individuals abroad since January 1 of the preceding year; and (iv) other situations as determined by the CAC. The Security Assessment Measures have retroactive effect for relevant cross-border data transfers out of Mainland China conducted prior to September 1, 2022, and data processors are required to undergo mandatory security assessment for such prior relevant cross-border data transfers by February 28, 2023. We do not believe, based on our understanding of the Security Assessment Measures that our transfers of data out of Mainland China currently or in the past require us to undergo a mandatory security assessment under the Security Assessment Measures, but we may in the foreseeable future conduct cross-border data transfers of data that require us to undergo a mandatory security assessment under the Security Assessment Measures for such transfers. To implement the standard contract mechanism for cross-border transfers out of China of personal information under the PIPL, on February 24, 2023, the CAC published the PRC Standard Contract, which came into effect on June 1, 2023. After this came into effect, personal information processors may conclude a PRC Standard Contract with overseas recipients of personal information to comply with PIPL requirements for cross-border transfers out of Mainland China of personal information that do not need to undergo a security assessment. To implement the personal information protection certification mechanism for cross-border transfers out of China of personal information under the PIPL, on November 4, 2022, the CAC and SAMR jointly issued the Notification on the Implementation of Personal Information Protection Certification. In parallel, on December 16, 2022, the National Information Security Standardization Technical Committee released an updated version of the Certification Specification which provides the general principles and detailed requirements for personal information processors engaging in the cross-border transfer out of Mainland China of personal information to meet in order to obtain a personal information protection certification from qualified certification institutions for cross-border transfers out of China of personal information governed by the PIPL. Transferring data to foreign law enforcement agencies or judicial authorities The Data Security Law and PIPL prohibit entities in Mainland China from transferring data (including personal information) stored in Mainland China to foreign law enforcement agencies or judicial authorities without prior approval by the Chinese government. We may need to pass a government security review or obtain government approval in order to share data (including personal information) stored in Mainland China with judicial and law enforcement authorities outside of Mainland China. Therefore, if judicial and law enforcement authorities outside Mainland China require us to provide data stored in Mainland China, and we are not able to pass any required government security review or obtain any required government approval to do so, we may not be able to meet the foreign authorities’ requirements. The potential conflicts in legal obligations could have adverse impacts on our operations in and outside of Mainland China. Recently, the CAC has taken action against several Chinese internet companies listed on U.S. securities exchanges for alleged national security risks and improper collection and use of the personal information of Chinese data subjects. According to the official announcement, the action was initiated based on the National Security Law of the People’s Republic of China (the “National Security Law”), the Cyber Security Law and the Cybersecurity Review Measures, which are aimed at “preventing national data security risks, maintaining national security and safeguarding public interests.” Industry and local regulations 37 Table of Contents In addition, certain industry-specific laws and regulations affect the collection and transfer of personal data in Mainland China. For example, the HGR Regulation prohibits both onshore and offshore entities established or actually controlled by foreign entities and individuals from collecting or biobanking any China-Sourced HGR in China, as well as providing such China-Sourced HGR outside of China. Chinese parties are required to seek an advance approval for the collection and biobanking of all China-Sourced HGR. Approval for any export or cross-border transfer of China-Sourced HGR in the form of biospecimens is required, and transfer of derived data by Chinese parties to foreign parties or entities established or actually controlled by them also requires the Chinese parties to file, before the transfer, a copy of the data with the Human Genetic Resources Administration of China (the “HGRAC”) for record purposes and to obtain a notification filing number in order to transfer the data. The HGR Regulation also requires that foreign parties or entities established or actually controlled by them ensure the full participation of Chinese parties in international collaborations and share all records and data with the Chinese parties. To further tighten the control of China-Sourced HGR, the SCNPC issued the Eleventh Amendment to the Criminal Law of the People’s Republic of China on December 26, 2020, which became effective on March 1, 2021, criminalizing the illegal collection of China-Sourced HGR and the illegal transfer of China-sourced biospecimens outside of Mainland China. An individual who is convicted of any of these violations may be subject to public surveillance, criminal detention, a fixed-term imprisonment of up to seven years and/or a criminal fine. In October 2020, the SCNPC adopted the Biosecurity Law, which became effective on April 15, 2021. The Biosecurity Law will establish an integrated system to regulate biosecurity-related activities in Mainland China, including, among others, the security regulation of HGR and biological resources. The Biosecurity Law for the first time expressly declared that Mainland China has sovereignty over its HGR, and further endorsed the HGR Regulation by recognizing the fundamental regulatory principles and systems established by it over the utilization of China-Sourced HGR by foreign parties or entities established or actually controlled by them in Mainland China. Though the Biosecurity Law does not provide any specific new regulatory requirements on HGR, as it is a law adopted by Mainland China’s highest legislative authority, it gives Mainland China’s primary regulator of HGR, the MOST, significantly more power and discretion to regulate HGR and it is expected that the overall regulatory landscape for China-Sourced HGR will evolve and become even more rigorous and sophisticated. In addition, the interpretation and application of data protection laws in Mainland China and elsewhere are often uncertain and in flux. In May 2023, the Ministry of Science and Technology, or MOST, published the Implementing Rules of the HGR Regulation (the “HGR Implementing Rules”) which came into effect in July 2023. The HGR Implementing Rules have, among other things, provided operational details and clarified questions that have emerged in the past few years, such as further clarified the scope of China-Sourced HGR, improved the procedure rules for applicable approval, filing and security review, and refined the provisions with respect to the prohibition on the collection, preservation and export of China-Sourced HGR by foreign organizations, individuals, and the entities established or actually controlled by foreign organizations or individuals. Under the HGR Implementing Rules, clinical studies conducted for the purpose of obtaining marketing authorization for drugs and medical devices in China, if not involving the export of human genetic materials, will be eligible for a notification filing (instead of the advance approval) if the human genetic materials are collected by sites, and processed by sites or an onshore third-party specified in the clinical trial protocol. The HGR Implementing Rules also enumerate situations where a security review is required for external provision of or open access to of human genetic data, such as external provision of or open access to human genetic data about important genetic pedigrees, human genetic data from specific regions, and exome sequencing and genome sequencing information of over 500 individuals. So far, the HGRAC has disclosed a number of HGR violation cases. In one case, the sanctioned party was the Chinese subsidiary of a multinational pharmaceutical company that was found to have illegally transferred certain biospecimens to CROs for conducting certain unapproved research. In addition to a written warning and confiscation of relevant human genetic materials, the Chinese subsidiary of the multinational pharmaceutical company was requested by the HGRAC to take rectification measures and was also banned by the HGRAC from submitting any clinical trial applications until the HGRAC was satisfied with the rectification results, which rendered it unable to initiate new clinical trials in Mainland China until the ban was lifted. In another case, the CRO engaged by the Chinese subsidiary of a multinational pharmaceutical company was found to have forged an ethics committee approval in order to accelerate the HGRAC approval. Both the Chinese subsidiary of the multi-national pharmaceutical company and the CRO were debarred from initiating new applications for a period of 6 to 12 months, respectively. Uncertainties about our compliance with the changing legal landscape despite our best efforts 38 Table of Contents Interpretation, application and enforcement of these laws, rules and regulations evolve from time to time and their scope may continually change, through new legislation, amendments to existing legislation or changes in enforcement. Compliance with the Cyber Security Law, the Data Security Law, the PIPL and other related laws and regulations could significantly increase the cost to us of providing our products, require significant changes to our operations or even prevent us from providing certain products in jurisdictions in which we currently operate or in which we may operate in the future. Despite our efforts to comply with applicable laws, regulations and other obligations relating to privacy, data protection and information security, it is possible that our practices, products or platform could fail to meet all of the requirements imposed on us by the Cyber Security Law, the Data Security Law, the PIPL and/or related laws and regulations. Any failure on our part to comply with such laws or regulations or any other obligations relating to privacy, data protection or information security, or any compromise of security that results in unauthorized access, use or release of personally identifiable information or other data, or the perception or allegation that any of the foregoing types of failure or compromise has occurred, could damage our reputation, discourage new and existing counterparties from contracting with us or result in investigations, fines, suspension or other penalties by Chinese government authorities and private claims or litigation, any of which could materially adversely affect our business, financial condition and results of operations. If the Chinese parties fail to comply with data protection, data privacy and cybersecurity laws, regulations and practice standards, and our research data is obtained by unauthorized persons, used or disclosed inappropriately or destroyed, we may lose our confidential information and be subject to litigation and government enforcement actions. It is possible that these laws and regulations may be interpreted and applied in a manner that is inconsistent with our or our collaborators’ practices, potentially resulting in suspension of relevant ongoing clinical trials or delays in the initiation of new trials, delays in sharing or an inability to share or receive clinical trial data with or from our collaborators, confiscation of China-Sourced HGR, administrative fines, disgorgement of illegal gains, or temporary or permanent debarment of our or our collaborators’ entities and responsible persons from further clinical trials and, consequently, a de-facto ban on the debarred entities from initiating new clinical trials in Mainland China. In addition, a data breach affecting personal information, including health information, or a failure to comply with applicable requirements could result in significant management resources, legal and financial exposure and reputational damage that could potentially have a material adverse effect on our business and results of operations. Even if our practices are not subject to legal challenge, the perception of privacy concerns, whether or not valid, may harm our reputation and brand and adversely affect our business, financial condition and results of operations. Moreover, the legal uncertainty created by the Data Security Law, the PIPL, the Cyber Security Law, the Cybersecurity Review Measures and the recent Chinese government actions could materially adversely affect our ability, on favorable terms, to raise capital in the U.S. market in the future. The national security legal regime imposes stricter data localization requirements on personal information and human health-related data and requires us to undergo cybersecurity or other security review and assessments, obtain government approval or certification, implement technical and organizational measures for data privacy and protection, conduct privacy impact assessments, or put in place certain contractual protections before transferring personal information and human health-related data out of Mainland China. As a result, personal information, important data and health and medical data that we or our customers, vendors, clinical trial sites, pharmaceutical partners and other third parties collect, generate or process in Mainland China may be subject to such data localization requirements and heightened regulatory oversight and controls. We may need to maintain local data centers in Mainland China, enter into standard contracts with the overseas recipients of any personal information processed by us, conduct privacy impact assessments, undergo security assessments, or obtain the requisite approvals from the Chinese government for the transmission outside of Mainland China of such controlled information and data, which could significantly increase our operating costs or cause delays or disruptions in our business operations in and outside Mainland China. We expect that the evolving regulatory interpretation and enforcement of the national security legal regime will lead to increased operational and compliance costs and will require us to continually monitor and, where necessary, make changes to our operations, policies, and procedures. If our operations, or the operations of our CROs, licensees or partners, are found to be in violation of these requirements, we may suffer loss of use of data, suffer a delay in obtaining regulatory approval for our products, be unable to transfer data out of Mainland China, be unable to comply with our contractual requirements, suffer reputational harm, or be subject to penalties, including administrative, civil and criminal penalties, damages, fines, and the curtailment or restructuring of our operations. If any of these were to occur, it could materially adversely affect our ability to operate our business and our financial results.