GROUP 1 AUTOMOTIVE INC
For the period ended Sep 30, 2024. Filed Nov 1, 2024.
View on SEC.govAbout this filing
A company's report for each of its first three quarters. The financial statements are not audited. It shows how the business has moved since the last annual report, and what management says changed.
Sep 30, 2024 · Filed Nov 1, 2024
GPI$261.35-1.9%Stored close · as of Nov 6, 2026
What changed in Risk Factors?
Read the current filingPrevious report: 10-Q
Period ended 2024-06-30; filed 2024-07-24.
0001031203-24-000058
Item 1A. Risk FactorsUnregistered Sales of Equity Securities and Use of ProceedsCurrent report: 10-Q
Period ended 2024-09-30; filed 2024-11-01.
0001031203-24-000073
Item 1A. Risk FactorsUnregistered Sales of Equity Securities and Use of ProceedsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 17 previous paragraphs and 22 current paragraphs.
14 unchanged; 3 reworded; 5 added; 0 removed; 0 previous and 0 current paragraphs rearranged.
Tables are not compared: 1 previous and 1 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (5)
Current report
We are subject to automotive and other laws and regulations, which, if we are found to have violated, may adversely affect our business and results of operations.
Current report
A number of laws and regulations applicable to automotive companies affect our business and conduct, including, but not limited to, our sales, operations, financing, insurance, advertising and employment practices. Other rules such as franchise laws and regulations, consumer protection laws and other extensive laws and regulations apply to new and used motor vehicle dealers. Additionally, in every jurisdiction in which we operate, we must obtain various permits and licenses in order to conduct our business. Any failure to comply with these laws and regulations may result in administrative, civil or criminal penalties, the imposition of investigatory remedial obligations or the limitations on certain aspects of our operations.
Current report
In the U.K., the Financial Conduct Authority (the “FCA”) regulates financial services firms and financial markets, including our activities in acting as broker for the financing of vehicle sales. In January 2024, the FCA announced that it planned to undertake a formal review into the historic use of discretionary commission arrangements (“DCAs”) amid concerns that the practice of linking brokers’ commissions to the interest rate charged to customers may have been unfair to customers, resulting in customers paying too much for their car loans.
Current report
Additionally in the U.K., on October 25, 2024, the U.K. Court of Appeal issued a judgment in the three joined appeals for Johnson v Firstrand Bank Ltd, Wrench v Firstrand Bank Ltd and Hopcraft v Close Brothers Ltd (collectively, the “COA litigation”), finding that the claimants in those cases are entitled to be paid a sum equivalent to the undisclosed commission paid by their lenders to the dealerships from which they acquired their cars plus interest. Underlying the Court’s judgment were the findings that, among other things, brokers owe fiduciary and/or disinterested duties to customers, which, among other things, require disclosure to the customer of the rate and amount of the commission paid and the basis for its calculation. As a result, the failure to provide such full commission disclosure effectively results in the failure to obtain a customer’s fully informed consent to the payment of commission. The judgment also appears to extend beyond DCAs to address all commission disclosures generally. Finally, the U.K. Court of Appeal held where there is a failure to disclose, lenders and dealerships who acted as brokers are jointly and severally liable for the repayment of the commission.
Current report
The final outcomes of the FCA’s DCA review and the COA litigation, including an anticipated appeal thereof to The Supreme Court of the United Kingdom, are uncertain. Any judicial outcome or regulatory redress scheme, which ultimately results in a wider legal or regulatory requirement to refund historical commissions paid to us, could materially and adversely affect our U.K. operations.
Reworded paragraphs (3)
Previous wording
We depend on the efficient operation of our information systems and those of our third-party service providers and rely on information systems at our dealerships in all aspects of our sales and service efforts, as well as in the preparation of our consolidated financial and operating data. All of our dealerships currently operate on two DMSs, one DMS for the U.S and one DMS for the U.K. Additionally, in the ordinary course of business, we receive significant PII about our customers and our employees. Such PII is primarily collected at our dealerships and through our Acceleride® platform via an online DMS. A security incident to obtain such information could be caused by malicious insiders and third parties using sophisticated, targeted methods to circumvent firewalls, encryption and other security defenses, including hacking, malware, fraud, trickery, or other forms of deception. Although many companies across many industries are affected by malicious efforts to obtain access to PII, the automotive dealership industry has been a particular target of identity thieves. The techniques used by cyber attackers change frequently and may be difficult to detect. We have implemented security measures that are designed to detect and protect against cyberattacks.
Current wording
We depend on the efficient operation of our information systems and those of our third-party service providers and rely on information systems at our dealerships in all aspects of our sales and service efforts, as well as in the preparation of our consolidated financial and operating data. All of our dealerships currently operate on two DMSs, one DMS for the U.S and one DMS for the U.K. Additionally, in the ordinary course of business, we receive significant PII about our customers and our employees. Such PII is primarily collected at our dealerships and through our Acceleride® platform via an online DMS. A security incident to obtain such information could be caused by malicious insiders and third parties using sophisticated, targeted methods to circumvent firewalls, encryption and other security defenses, including hacking, malware, fraud, trickery, or other forms of deception. Although companies across all industries are affected by malicious efforts to obtain access to PII, the automotive dealership industry has been a particular target of identity thieves. The techniques used by cyber attackers change frequently and may be difficult to detect. We have implemented security measures that are designed to detect and protect against cyberattacks.
Previous wording
Despite ongoing efforts to improve our ability to protect data from compromise, we may not be able to protect all of our data across our diverse systems and third-party vendors. For example, during the quarter ended June 30, 2024, we were informed of a cybersecurity incident experienced by CDK, which resulted in service outages on CDK’s dealers’ systems. CDK provides clients in the automotive industry, including our dealerships in the U.S., with a SaaS platform used by dealerships in managing customer relationships, sales, financing, service, inventory and back-office operations. In response to the CDK Incident, we immediately activated our cyber incident response procedures and proactively took measures to protect and isolate our systems from CDK’s platform. All of our U.S. dealerships continued to conduct business using alternative processes until CDK’s dealers’ systems were fully back online. We also do not believe that the CDK Incident resulted in a breach of any PII about our customers or employees. The Company’s dealerships in the U.K. do not use CDK’s dealers’ systems and were therefore not impacted by the CDK service outage. As a consequence, while we do not expect the CDK Incident to have a material impact on the Company’s overall financial condition or on its ongoing results of operations, if we, or any of our third-party services providers were to experience a material cybersecurity event, our business and results of operations and financial condition could be materially and adversely impacted.
Current wording
Despite ongoing efforts to improve our ability to protect data from compromise, we may not be able to protect all of our data across our diverse systems and third-party vendors. For example, during the quarter ended June 30, 2024, we were informed of a cybersecurity incident experienced by CDK, which resulted in service outages on CDK’s dealers’ systems. CDK provides clients in the automotive industry, including our dealerships in the U.S., with a SaaS platform used by dealerships in managing customer relationships, sales, financing, service, inventory and back-office operations. In response to the CDK Incident, we immediately activated our cyber incident response procedures and proactively took measures to protect and isolate our systems from CDK’s platform. All of our U.S. dealerships continued to conduct business using alternative processes until CDK’s dealers’ systems were fully back online. We also do not believe that the CDK Incident resulted in a breach of any PII about our customers or employees. Our dealerships in the U.K. do not use CDK’s dealers’ systems and were therefore not impacted by the CDK service outage. As a consequence, while we do not expect the CDK Incident to have a material impact on our overall financial condition or on its ongoing results of operations, if we, or any of our third-party services providers were to experience a material cybersecurity event, our business and results of operations and financial condition could be materially and adversely impacted.
Previous wording
Future share repurchases are subject to the business judgment of our Board of Directors and management, taking into consideration our historical and projected results of operations, financial condition, cash flows, capital requirements, covenant compliance, changes in laws and regulations, current economic environment and other factors considered relevant. As of June 30, 2024, we had$204.6 million available under our current share repurchase authorization. Refer to Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations for additional information on share repurchases and authorization.
Current wording
Future share repurchases are subject to the business judgment of our Board of Directors and management, taking into consideration our historical and projected results of operations, financial condition, cash flows, capital requirements, covenant compliance, changes in laws and regulations, current economic environment and other factors considered relevant. As of September 30, 2024, we had$174.8 million available under our current share repurchase authorization. Refer to Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations for additional information on share repurchases and authorization.