PENSKE AUTOMOTIVE GROUP INC

Current report

Legal and Compliance Risks

Current report

Regulatory Issues. We are subject to a wide variety of regulatory activities and oversight, including:

Current report

Governmental regulations, claims, and legal proceedings. Governmental regulations affect almost every aspect of our business, including the fair treatment of our employees, wage and hour issues, and our financing activities with customers. In California, previous judicial decisions have called into question whether long-standing methods for compensating dealership employees comply with the local wage and hour rules and may do so again. We could be susceptible to claims or related actions if we fail to operate our business in accordance with applicable laws or it is determined that long-standing compensation methods did not comply with local laws. Many laws and regulations applicable to our business were adopted prior to the introduction of online vehicle sales, the Internet and certain digital technology, generally. As a result, we are tasked with maintaining compliance in an uncertain regulatory environment. Claims arising out of actual or alleged violations of law which may be asserted against us or any of our dealers by individuals, through class actions, or by governmental entities in civil or criminal investigations and proceedings, may expose us to substantial monetary damages which may adversely affect us.

Current report

Our financing activities with customers are subject to truth-in-lending, consumer leasing, equal credit opportunity, and similar regulations as well as motor vehicle finance laws, installment finance laws, insurance laws, usury laws, and other installment sales laws. In the U.K., the Financial Conduct Authority (the "FCA") regulates financial services firms and financial markets, including our activities in acting as broker for the financing of vehicle sales. The FCA has announced that it will investigate the historic use of discretionary commission arrangements ("DCAs") amid concerns that this practice may have been unfair to customers. The purpose of the investigation is to consider whether the historic use of DCAs caused customers to pay too much for their car loans and, if so, to consider potential remediation measures. The investigation is being undertaken after the Financial Ombudsman Service (a public body, which resolves financial complaints) determined that DCAs, in two separate cases which do not involve us, had caused financial losses to customers. We await the outcome of the FCA’s investigation which is expected in May of 2025. Any regulatory or judicial outcome that ultimately results in the refund of historical commissions paid to us or that reduces the commissions paid to us could materially and adversely affect us.

Current report

On October 25, 2024, the U.K. Court of Appeal (the second highest court in the U.K.) issued a judgment in the case Johnson v Firstrand Bank Ltd, Wrench v Firstrand Bank Ltd and Hopcraft v Close Brothers Ltd, which required those lenders to repay those customers the commissions paid to the dealers for their vehicle finance agreements, determining that, in those cases, there was a duty to the customers to disclose the amount of the commissions paid to those dealers. We believe this Judgment is contrary to existing guidance issued by the FCA and is expected to be appealed by those lenders. However, while this appeal process is pending (which is expected to take months), our U.K. consumer lending partners have begun to require changes in the process of financing the purchase of vehicles to our customers. Moreover the FCA has issued a statement that they are evaluating this new Judgment which may alter or accelerate the FCA’s investigation noted above.

Current report

In response to this Judgment, some of our lending partners have paused the issuance of new consumer financing as they evaluate this Judgment. Some of our lending partners are now requiring that we disclose the amount of any commissions we receive in connection with consumer financing, and we expect all of our lenders to make similar changes. Other lenders are now requiring that we receive only fixed commissions from our customers which commissions also are to be disclosed to the customers. We expect all of our U.K. lenders to implement additional disclosure forms for our customers pending further guidance. While this decision is appealed and pending further regulatory guidance, we may see pressure on the penetration and margins associated with our consumer financing in the U.K., although the effect of this new Judgment is uncertain. Moreover, while the focus of the FCA’s potential redress to customers, and the Judgment above, has been on the lenders and not dealers, we may experience claims for repayment of historical commissions we have received from customers, which amounts could materially and adversely affect us.

Previous report

General Risks

Previous report

We rely on third parties for the majority of our information systems and the availability and efficient operation of such systems are critical to the operation of our business.

Previous report

Our information systems are fully integrated into our operations, and we rely on them to operate effectively, including with respect to electronic interfaces with manufacturers and other vendors, customer relationship management, sales and service efforts, data storage, and financial and operational reporting. The majority of our systems are provided by or licensed from third-party vendors and suppliers; the most significant of which are the dealer management systems (“DMS”) used across our retail operations and which are provided by a limited number of suppliers. We also rely on third-party vendors to supply other key products and services to us and our customers. One or more of these third-party vendors or suppliers may experience financial distress, technology challenges, cybersecurity incidents, ransomware demands, programming errors, staffing shortages or liquidity challenges, file for bankruptcy protection, go out of business, or suffer other disruptions in their business, each of which could affect the vendors’ ability to provide services to us and our customers. If any of our vendors or suppliers fail to deliver their products or services for any reason, our business and results of operations and financial condition could be adversely impacted, and such failures may lead to broader disruptions or failures across our information systems which may expose us to customer, employee, manufacturing partner or third-party claims or other legal liabilities.

Previous report

The failure of our information systems, the failure to protect the integrity of these systems, or the interruption of these systems as discussed herein or otherwise due to natural disasters, power loss, unexpected termination of our agreements, cyber-attacks, ransomware encryptions, or other reasons such as those which resulted from the CDK Cybersecurity Incident (described below), could significantly and adversely disrupt our business operations, impact our sales, service, inventory, customer relationship management, and accounting functions and otherwise adversely affect our results of operations. For example, on June 19, 2024, we became aware that CDK Global, LLC (“CDK”), a third-party provider of information systems, including DMS software to support retail automotive and commercial truck dealership operations, was experiencing a cybersecurity incident and its systems were rendered inoperable (the “CDK Cybersecurity Incident”). Although we do not utilize CDK's DMS in our U.S. or international automotive dealership operations, our Premier Truck Group business does utilize CDK’s dealer management system and was impacted by the CDK Cybersecurity Incident. In response to the CDK Cybersecurity Incident, we immediately took precautionary containment steps to protect our systems and commenced an investigation of the incident. PTG implemented its business continuity response plans and continued to operate without the DMS at all locations through manual or alternate processes developed to respond to such incidents. On July 2, PTG was able to reconnect all of its locations to CDK’s DMS servers and restore core functionality of the software platform.

Previous report

Even where business continuity responses and contingency plans, such as those noted above, are implemented to minimize disruptions caused by information systems failures, such mitigation efforts may result in decreased operational efficiencies and limit dealership productivity. Further, despite our efforts to assess, identify, and manage material risks from cybersecurity threats to our business and operations, including through evaluating key partners and third parties with whom we share our information as well as certain customer and employee information, we may not be able to protect our various systems from disruptions.

Previous report

Cybersecurity. In the ordinary course of our business, we receive confidential information about our customers, employees, associates, and vendors. We collect, process, retain, and in some cases share this information in the normal course of our business, and such information is collected and stored primarily in our core information systems, including our DMS platforms. Our internal and third-party systems, including our DMS and customer relationship management systems, are under a heightened level of risk from state actors, cyber criminals or other individuals with malicious intent to gain unauthorized access to our systems and exploit the information, including the confidential information of our customers and employees, that we gather. Cyber-attacks, such as the CDK Cybersecurity Incident described above, and threats to information systems and network and data security are becoming increasingly diverse and sophisticated, with attacks increasing in frequency, scope, and potential harm. In addition, some of our software applications are utilized by third parties who, in turn, subcontract or otherwise outsource various processes and administrative functions to additional third parties. Such third parties may have access to confidential information that is critical to our business operations and services. While our information security program includes enhanced controls to monitor third party providers' security programs, these third parties are subject to their own risks of data breaches, cyber-attacks, and other events or actions that could damage, disrupt, or close down their networks or systems, which in turn may adversely impact our business operations.

Previous report

Despite the security measures we have in place or may implement in the future, we may be unable to fully detect, mitigate, or protect against cyber-attacks, ransomware attacks, computer viruses, security breaches, social engineering, malicious software, lost or misplaced data, programming errors, human errors, burglary, acts of vandalism, misdirected wire transfers or other events impacting us or our third-party service providers. Any security breach or event, whether by us directly or our third-party service providers, may result in an authorized party obtaining trade secrets, personally identifiable information or confidential information and may result in loss of revenue, increase the costs of doing business, harm our competitiveness, reputation or customer, vendor or manufacturer relationships, and have other negative operational impacts. In addition, such security breaches or events resulting in the loss or exposure of this information could result in liabilities and other significant financial exposures, including those derived from investigations, regulatory fines, penalties for violations of applicable laws and regulations, costs related to the remediation of ransomware events, litigation including consumer class actions, the imposition of penalties, or other means, any of which could have a material adverse effect on our business, results of operations or financial condition. In addition, our failure to respond quickly and appropriately to such a security breach, or our failure to adequately test and verify the remediation of security incidents involving third parties prior to reintegration into our information systems, could exacerbate the consequences of the breach.