Driveway Vehicle Solutions (LAD) Risk Analysis

We are subject to federal, state, and local laws and regulations in the geographic regions in which we operate, such as those relating to franchising, motor vehicle sales, retail installment sales, leasing, F&I, marketing, licensing, consumer protection, consumer privacy, escheatment, anti-money laundering, environmental, vehicle emissions and fuel economy, and health and safety, as well as consumer financing as discussed above. In addition, with respect to employment practices, we are subject to various laws and regulations, including complex federal, state, and local wage and hour and anti-discrimination laws. New laws and regulations are enacted on an ongoing basis. With the number of stores we operate, the number of personnel we employ and the large volume of transactions we handle, it is possible that technical mistakes will be made. These regulations affect our profitability and require ongoing training. Current practices in stores may become prohibited. We are responsible for ensuring that continued compliance with laws is maintained. If there are unauthorized activities, the jurisdictional authorities have the power to impose civil penalties and sanctions, suspend or withdraw dealer licenses or take other actions. These actions could materially impair our activities or our ability to acquire new stores in those states where violations occurred. Further, private causes of action on behalf of individuals or a class of individuals could result in significant damages or injunctive relief. We may be involved in legal proceedings arising from the conduct of our business, including litigation with customers, team member-related lawsuits, class actions, purported class actions and actions brought by or on behalf of governmental authorities. Claims arising out of actual or alleged violations of law may be asserted against us or any of our dealers by individuals, either individually or through class actions, or by governmental entities in civil or criminal investigations and proceedings. Such actions may expose us to substantial monetary damages and legal defense costs, injunctive relief, criminal and civil fines and penalties, and damage our reputation and sales. In the United Kingdom, the Financial Conduct Authority (FCA) regulates financial services firms and financial markets, including the practice of dealerships acting as the broker in arranging the financing for vehicle sales. The FCA is investigating the historic use of discretionary commission arrangements amid concerns that this practice may have been unfair to customers. We await the outcome of the FCA's investigation which is expected sometime in 2026. Any regulatory or judicial outcome that ultimately results in the refund of historical commissions paid to us or that reduces the commissions paid to us could materially and adversely affect us. Similarly, the U.S. Federal Trade Commission recently has attempted to prohibit certain automotive sales and marketing practices and establish significant new dealer disclosure and record-keeping requirements broadly applicable throughout the car-buying process. Depending on the results of ongoing litigation, regulatory review, and the final scope and implementation of the proposed rule, we may be subject to new administrative burdens that would likely increase our costs and could expose us to significant damages, other penalties, and/or adverse publicity. If we or any of our team members at any individual dealership violate or are alleged to violate laws and regulations applicable to them or protecting consumers generally, we could be subject to individual claims or consumer class actions, administrative, civil or criminal investigations or actions and adverse publicity. Such actions could expose us to substantial monetary damages and legal defense costs, injunctive relief, and criminal and civil fines and penalties, including suspension or revocation of our licenses and franchises to conduct dealership operations. Environmental laws and regulations govern, among other things, discharges into the air and water, storage of petroleum substances and chemicals, the handling and disposal of wastes and remediation of contamination arising from spills and releases. In addition, we may also have liability in connection with materials that were sent to third-party recycling, treatment and/or disposal facilities. Jurisdictional statutes impose liability for investigation and remediation of contamination without regard to fault or the legality of the conduct that contributed to the contamination. Similar to many of our competitors, we have incurred and expect to continue to incur capital and operating expenditures and other costs in complying with such statutes. In addition, we may be subject to broad liabilities arising out of contamination at our currently and formerly owned or operated facilities, at locations to which hazardous substances were transported from such facilities, and at such locations related to entities formerly affiliated with us. Although for some such potential liabilities we believe we are entitled to indemnification from other entities, we cannot assure you that such entities will view their obligations as we do or will be able or willing to satisfy them. Failure to comply with applicable laws and regulations, or significant additional expenditures required to maintain compliance therewith, may have a material adverse effect on our business, results of operations, financial condition, cash flows, and prospects.

Our information technology systems are important to operating our business efficiently. We employ information technology systems, including websites, that allow for the secure handling and processing of customers' proprietary information. The failure of our information technology systems, and those of our partner software and technology vendors, to perform as we anticipate could disrupt our business and could expose us to a risk of loss or misuse of this information, litigation and potential liability. Aspects of our operations are subject to privacy, data use, and data security regulations, which impact the way we use and handle data. We collect, process, share, disclose, transfer, and otherwise use personal information about identifiable individuals including, but not limited to, our customers, team members, partners, and vendors, and so are subject to U.S. and international laws and regulations, regarding data privacy and security such as the California Consumer Privacy Act and the U.K. General Data Protection Regulation. These laws impose comprehensive data privacy compliance obligations in relation to our processing of personal data, including providing privacy rights to the individuals whose data we process and introducing requirements to maintain policies, processes, and procedures regarding our data handing practices. Additionally, our expansion into Canada and the United Kingdom subjects us to additional privacy and security regulations which also impact the way we handle and secure data across borders. Our internal and third-party systems have been and may in the future be subject to cyber-attacks, viruses, malicious software, ransomware, break-ins, theft, computer hacking, phishing, exploitation of system vulnerabilities or misconfigurations, team member error, or malfeasance or other security breaches or loss of service. We invest in commercially reasonable security technology to protect our data and business processes against many of these risks. We also purchase insurance to mitigate the potential financial impact of many of these risks. Despite the security measures we have in place, our facilities and systems, and those of our third-party service providers, could be vulnerable to security breaches, computer viruses, lost or misplaced data, programming errors, human errors, acts of vandalism, or other events. Any security breach or event resulting in the misappropriation, loss, or other unauthorized disclosure of confidential information, or degradation or loss of services provided by critical business systems, whether by us directly or our third-party service providers, or any other loss of access to such critical business systems, could adversely affect our business operations, sales, reputation with current and potential customers, associates or vendors, as well as other operational and financial impacts derived from investigations, litigation, imposition of penalties or other means. While we have policies and procedures in place for mitigating the impact of a cybersecurity event on our business, which adhere to widely recognized standards for managing cybersecurity risk, these policies and procedures may not ultimately be sufficient or otherwise as effective as intended to eliminate, or in some cases reduce or mitigate, the impact of a cybersecurity event on our business. For example, in June 2024, one of our third-party providers, Global CDK (CDK), suspended information systems used by us in response to a cybersecurity incident impacting CDK. While we activated our cyber incident response procedures as a result of the incident, we still experienced disruption to our business in North America, including to our CDK-hosted dealer management system, which temporarily resulted in declines in same store sales during that time. For more information regarding our cybersecurity policies and procedures, see Item 1C. Cybersecurity.

We depend on our manufacturers to provide a supply of vehicles that support expected sales levels. Any event that adversely affects a manufacturer's timely delivery of new vehicles may adversely affect us by reducing our supply of popular new vehicles, leading to lower sales in our stores during those periods than may otherwise occur. For example, the shortage of semiconductor chips and labor disruptions during 2021 and 2022 significantly constrained the supply of new vehicles resulting in reduced sales volumes and increased gross profit margins on retail vehicle sales. As new vehicle availability has improved, gross profit margins have been negatively impacted. We depend on our manufacturers to deliver high-quality, defect-free vehicles. If a manufacturer experiences quality issues, our sales and financial performance may be adversely impacted. In addition, the discontinuance of a particular brand that is profitable to us could negatively impact our revenues and profitability. Vehicle manufacturers would be adversely affected by economic downturns or recessions, adverse fluctuations in currency exchange rates, significant declines in the sales of their new vehicles, increases in interest rates, constraints on financing, port closures, labor strikes or similar disruptions (including within their major suppliers), supply shortages or rising raw material costs, rising team member costs, adverse publicity that may reduce consumer demand for their products, product defects, vehicle recall campaigns, litigation, poor product mix or unappealing vehicle design, or other adverse events. These and other risks could materially adversely affect any manufacturer and limit its ability to profitably design, market, produce or distribute new vehicles, which, in turn, could materially adversely affect our business, results of operations, financial condition, and cash flows. New vehicles from five manufacturers, Honda, Toyota, Ford, BMW, and Stellantis, represent 25% of our sales. We are subject to a concentration of risk in the event of financial distress, including potential reorganization or bankruptcy, or other issue affecting one or more of these manufacturers. In the event of a manufacturer or distributor bankruptcy, we could be held liable for damages related to product liability claims, intellectual property suits or other legal actions. These legal actions are typically directed towards the vehicle manufacturer and it is customary for manufacturers to indemnify us from exposure related to any judgments associated with the claims. However, if damages could not be collected from the manufacturer or distributor, we could be named in lawsuits and judgments could be levied against us.

Vehicle retailing is a highly competitive business. Our competitors include many publicly and privately-owned dealerships. Our franchise agreements do not grant us the exclusive right to sell a manufacturer's product within a given geographic area and many of our competitors sell the same or similar makes of new and used vehicles that we offer in our markets at competitive prices, as well as competitive vehicles we may not sell. We do not have any cost advantage in purchasing new vehicles from manufacturers due to the volume of purchases or otherwise. Our F&I business and other related businesses, which have higher margins than sales of new and used vehicles, are subject to strong competition from various financial institutions and others. In addition, new manufacturers with whom we do not have franchises are entering the automotive industry. New companies have raised capital to produce fully electric vehicles or to license battery technology to existing manufacturers. Tesla and Rivian have demonstrated the ability to successfully introduce electric vehicles to the marketplace. Foreign manufacturers from China and India are producing significant volumes of new vehicles and are entering the United States and selecting partners to distribute their products. Because the automotive market in the United States is mature and the overall level of new vehicle sales may not increase in the coming years, the success of new competitors will likely be at the expense of other, established brands. This could have material adverse impact on our success in the future.