party to obtain control of the authoritative copies of the electronic contracts, in violation of its contractual obligations under the transaction documents, this party could acquire an interest in the receivable which may have priority over the issuing entity’s interest. The servicer could also lose possession or control of the contracts through fraud, forgery, negligence or error, or as a result of a computer virus or a hacker’s actions or otherwise (especially in a circumstance where the contracts are held in electronic form). Furthermore, if the servicer becomes the subject of an insolvency or receivership proceeding, competing claims to ownership or security interests in the receivables could arise. These claims, even if unsuccessful, could result in delays in payments on the notes. If successful, these claims could result in losses or delays in payment to you or an acceleration of the repayment of the notes.
As a result of any of the above events, the issuing entity may not have a perfected security interest in the financed vehicles or in the receivables. The possibility that the issuing entity may not have a perfected security interest in the financed vehicles or the receivables may affect the issuing entity’s ability to receive payments on the receivables or liquidation proceeds with respect to the financed vehicles. Therefore, you may be subject to delays in payment and may incur losses on your notes.
RISKS RELATED TO THE SERVICER AND OTHER TRANSACTION PARTIES.
The sponsor faces risks related to its operational, technological and organizational infrastructure, including risks arising from the theft, loss or misuse of information (including as a result of a cyber-attack), which could adversely affect the liquidity or market value of your notes and the timing and amount of payments on your notes
Similar to other large financial institutions, the sponsor is exposed to operational risk that can manifest itself in many ways, such as errors in execution or inadequate processes, inaccurate models, faulty or disabled technological infrastructure and fraud by employees or persons outside of the company. In addition, the sponsor is heavily dependent on the security, capability and continuous availability of the technology systems that it uses to manage its internal financial and other systems, monitor risk and compliance with regulatory requirements, provide services to its customers, develop and offer new products and communicate with stakeholders.
If the sponsor does not maintain the necessary operational, technological and organizational infrastructure to operate its business, including to maintain the security of that infrastructure, the sponsor’s business and reputation could be materially adversely affected, which could adversely affect the liquidity or market value of your notes. The sponsor is also subject to disruptions to its operating systems arising from events that are wholly or partially beyond its control, which may include, computer viruses, electrical or telecommunications outages, design flaws in foundational components or platforms, availability and quality of vulnerability patches from key vendors, cyber-attacks (including Distributed Denial of Service (“DDOS”) attacks and other attacks on its infrastructure), natural disasters, public health emergencies (including COVID-19 or similar outbreaks), other damage to property or physical assets, or events arising from local or larger scale politics, including terrorist acts, civil unrest, political instability and armed conflict (such as the commencement of hostilities between the United States and a foreign nation or nations or between foreign nations). The sponsor also relies on the business infrastructure and systems of third parties with which it does business and to whom it outsources the operation, maintenance and development of its information technology and communications systems.
The sponsor may incur significant costs in connection with any future cybersecurity incidents, including infrastructure investments or remediation efforts. Technologies, systems, networks and devices of the sponsor or its employees, service providers or other third parties with whom the sponsor interacts may continue to be the subject of cyber-attacks and other security incidents, including DDOS attacks, computer viruses, hacking, malware, ransomware, credential stuffing or phishing or other forms of social engineering. Such cyber-attacks and other security incidents are designed to lead to various harmful outcomes, such as unauthorized transactions in customer accounts, unauthorized or unintended access to or release, gathering, monitoring, disclosure, loss, destruction, corruption, disablement, encryption, misuse, modification or other processing of confidential or sensitive information (including personal information), intellectual property, software, methodologies or business secrets, disruption, sabotage or degradation of service, systems or networks, or other damage. These threats may derive from, among other things, error, fraud or malice on the part of the sponsor’s employees, insiders or third parties or may result from accidental technological failure. For example, on July 29, 2019, the sponsor’s direct parent, Capital One Financial Corporation, announced that on March 22, 2019 and March 23, 2019, an outside individual gained unauthorized access to its systems. This individual obtained certain types of personal information relating to people who had applied for credit card products and to credit card customers (the “Cybersecurity Incident”). While the
24