GROUP 1 AUTOMOTIVE INC

Current report

Existing and potential new trade policies, such as tariffs, could adversely affect our operations, costs and business.

Current report

President Donald Trump has issued a series of executive orders since taking office in January 2025, including executive orders regarding tariffs. Refer to Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations — Recent Events, for additional information regarding these executive orders, including those related to tariffs.

Current report

While the possibility exists for delays, reductions or exemptions of the automotive and reciprocal tariffs, the potential impacts of the tariffs described above remain uncertain and may cause a significant impact on the price of our products as well as the future mix of and demand for vehicles provided by our manufacturers, as well as alter the mix of supply and demand for used vehicles. To the extent any such tariffs remain in place for a sustained period of time, or in the event a global or domestic recession results therefrom, the disposable income of our customers could be significantly reduced, which may result in our customers deciding to delay new or used vehicle purchases or vehicle maintenance and repairs, or forego them entirely, each of which could adversely affect our results of operations and financial condition. Additionally, reciprocal tariffs, tariffs on steel and aluminum and the elevated tariffs against China could negatively impact business or consumer sentiment, demand for our products, our manufacturers’ global supply chains, and the United States or global economy generally. Manufacturers’ supply chain dependencies and production facility locations vary, and as a result, certain manufacturers could be impacted more significantly by the imposition of tariffs than others.

Current report

Additional actions taken by the U.S. that restrict or could impact the economics of trade — including additional tariffs, trade barriers, and other similar measures — could have the potential to further disrupt existing supply chains and trigger retaliatory efforts by other countries, including the imposition of tariffs, raising taxation, setting foreign exchange or capital controls, or establishing embargoes, sanctions, or other import/export restrictions, thereby negatively impacting our business, both directly and indirectly. These developments, or the perception that more of them could occur, may materially create or increase business uncertainty and could adversely affect the global economy and stability of global financial markets, potentially reducing trade and depressing economic activity, including demand for our products. Such changes in international trade policies may result in direct impacts to our business or indirectly to our customers or suppliers through increased costs, changes in business prospects or operating results, which could adversely affect our financial condition. The extent of such impacts cannot be predicted at this time.

Previous report

We rely on third-party vendors and suppliers for key components of our business.

Previous report

Many components of our business, including data management, key operational processes and critical customer systems, are provided by or licensed from various third-party vendors and suppliers. In addition, we also rely on third-party vendors to supply key products and services to us and our customers. One or more of these third-party vendors or suppliers may experience financial distress, technology challenges, cybersecurity incidents, staffing shortages or liquidity challenges, file for bankruptcy protection, go out of business, or suffer other disruptions in their business, each of which could affect their ability to serve us and our customers. If any of our vendors or suppliers fail to deliver their products or services for any reason, our business and results of operations and financial condition could be adversely impacted.

Previous report

A failure of any of our information systems or those of our third-party service providers or a cybersecurity incident, including loss or unauthorized access of confidential information or personally identifiable information (“PII”) about our customers or employees, could negatively affect our business, operations and financial condition.

Previous report

We depend on the efficient operation of our information systems and those of our third-party service providers and rely on information systems at our dealerships in all aspects of our sales and service efforts, as well as in the preparation of our consolidated financial and operating data. All of our dealerships currently operate on two DMSs, one DMS for the U.S and one DMS for the U.K. Additionally, in the ordinary course of business, we receive significant PII about our customers and our employees. Such PII is primarily collected at our dealerships and through our Acceleride® platform via an online DMS. A security incident to obtain such information could be caused by malicious insiders and third parties using sophisticated, targeted methods to circumvent firewalls, encryption and other security defenses, including hacking, malware, fraud, trickery, or other forms of deception. Although companies across all industries are affected by malicious efforts to obtain access to PII, the automotive dealership industry has been a particular target of identity thieves. The techniques used by cyber attackers change frequently and may be difficult to detect. We have implemented security measures that are designed to detect and protect against cyberattacks.

Previous report

Despite these measures and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, malware, lost or misplaced data, programming errors, scams, ransomware, burglary, human errors, acts of vandalism, misdirected wire transfers or other events. If an unauthorized party is successful in obtaining trade secrets, PII, confidential, or otherwise protected information of our dealerships or our customers or in disrupting our operations through a cyberattack, the attack could result in loss of revenue, increase the costs of doing business, harm our competitiveness, reputation or customer or vendor relationships, satisfaction or loyalty. In addition, security breaches and other security incidents could expose us to a risk of loss or exposure of this information, which could result in potential liability, investigations, regulatory fines, penalties for violation of applicable laws or regulations, costs related to remediation or the payment of ransom, and litigation including individual claims or consumer class actions, administrative, and civil or criminal investigations or actions, any of which could have a material adverse effect on our business, results of operations or financial condition. Likewise, our business could be significantly disrupted if (i) the DMS fails to integrate with other third-party information systems, customer relations management tools or other software, or to the extent that any of these systems become unavailable to us or fail to perform as designed for an extended period of time or (ii) our relationship with our DMS providers or any other third-party provider deteriorates.

Previous report

Despite ongoing efforts to improve our ability to protect data from compromise, we may not be able to protect all of our data across our diverse systems and third-party vendors. For example, during the quarter ended June 30, 2024, we were informed of a cybersecurity incident experienced by CDK, which resulted in service outages on CDK’s dealers’ systems. CDK provides clients in the automotive industry, including our dealerships in the U.S., with a SaaS platform used by dealerships in managing customer relationships, sales, financing, service, inventory and back-office operations. In response to the CDK Incident, we immediately activated our cyber incident response procedures and proactively took measures to protect and isolate our systems from CDK’s platform. All of our U.S. dealerships continued to conduct business using alternative processes until CDK’s dealers’ systems were fully back online. We also do not believe that the CDK Incident resulted in a breach of any PII about our customers or employees. Our dealerships in the U.K. do not use CDK’s dealers’ systems and were therefore not impacted by the CDK service outage. As a consequence, while we do not expect the CDK Incident to have a material impact on our overall financial condition or on its ongoing results of operations, if we, or any of our third-party services providers were to experience a material cybersecurity event, our business and results of operations and financial condition could be materially and adversely impacted.

Previous report

We are subject to automotive and other laws and regulations, which, if we are found to have violated, may adversely affect our business and results of operations.

Previous report

A number of laws and regulations applicable to automotive companies affect our business and conduct, including, but not limited to, our sales, operations, financing, insurance, advertising and employment practices. Other rules such as franchise laws and regulations, consumer protection laws and other extensive laws and regulations apply to new and used motor vehicle dealers. Additionally, in every jurisdiction in which we operate, we must obtain various permits and licenses in order to conduct our business. Any failure to comply with these laws and regulations may result in administrative, civil or criminal penalties, the imposition of investigatory remedial obligations or the limitations on certain aspects of our operations.

Previous report

In the U.K., the Financial Conduct Authority (the “FCA”) regulates financial services firms and financial markets, including our activities in acting as broker for the financing of vehicle sales. In January 2024, the FCA announced that it planned to undertake a formal review into the historic use of discretionary commission arrangements (“DCAs”) amid concerns that the practice of linking brokers’ commissions to the interest rate charged to customers may have been unfair to customers, resulting in customers paying too much for their car loans.

Previous report

Additionally in the U.K., on October 25, 2024, the U.K. Court of Appeal issued a judgment in the three joined appeals for Johnson v Firstrand Bank Ltd, Wrench v Firstrand Bank Ltd and Hopcraft v Close Brothers Ltd (collectively, the “COA litigation”), finding that the claimants in those cases are entitled to be paid a sum equivalent to the undisclosed commission paid by their lenders to the dealerships from which they acquired their cars plus interest. Underlying the Court’s judgment were the findings that, among other things, brokers owe fiduciary and/or disinterested duties to customers, which, among other things, require disclosure to the customer of the rate and amount of the commission paid and the basis for its calculation. As a result, the failure to provide such full commission disclosure effectively results in the failure to obtain a customer’s fully informed consent to the payment of commission. The judgment also appears to extend beyond DCAs to address all commission disclosures generally. Finally, the U.K. Court of Appeal held where there is a failure to disclose, lenders and dealerships who acted as brokers are jointly and severally liable for the repayment of the commission.

Previous report

The final outcomes of the FCA’s DCA review and the COA litigation, including an anticipated appeal thereof to The Supreme Court of the United Kingdom, are uncertain. Any judicial outcome or regulatory redress scheme, which ultimately results in a wider legal or regulatory requirement to refund historical commissions paid to us, could materially and adversely affect our U.K. operations.