The sponsor faces risks related to its operational, technological and organizational infrastructure, including risks arising from the theft, loss or misuse of information (including as a result of a cyber-attack), which could adversely affect the liquidity or market value of your notes and the timing and amount of payments on your notes | | Similar to other large corporations, the sponsor is exposed to operational risk that can manifest itself in many ways, such as errors related to failed or inadequate processes, inaccurate models, faulty or disabled computer systems, fraud by employees or persons outside of the company and exposure to external events. In addition, the sponsor is heavily dependent on the security, capability and continuous availability of the technology systems that it uses to manage its internal financial and other systems, monitor risk and compliance with regulatory requirements, provide services to its customers, develop and offer new products and communicate with stakeholders. If the sponsor is unable to maintain the necessary operational, technological and organizational infrastructure to operate its business, including to maintain the security of that infrastructure, the sponsor’s business and reputation could be materially adversely affected, which could adversely affect the liquidity or market value of your notes. The sponsor may also be subject to disruptions to its operating systems arising from events that are wholly or partially beyond its control, which may include, for example, computer viruses, electrical or telecommunications outages, design flaws in foundational components or platforms, availability and quality of vulnerability patches from key vendors, cyber-attacks (including Distributed Denial of Service (“DDOS”) attacks and other attacks on its infrastructure), natural disasters, other damage to property or physical assets, or events arising from local or larger scale politics, including terrorist acts. The sponsor also relies on the business infrastructure and systems of third parties with which it does business and to whom it outsources the operation, maintenance and development of its information technology and communications systems. On July 29, 2019, the sponsor’s direct parent, the Corporation, announced that on July 19, 2019 it had determined there was unauthorized access by an outside individual who obtained certain types of personal information relating to people who had applied for the Corporation’s credit card products and to the Corporation’s credit card customers (the “Cybersecurity Incident”). The Corporation may incur significant costs in connection with the Cybersecurity Incident and any future cybersecurity incidents, including infrastructure investments or remediation efforts. Technologies, systems, networks and devices of the sponsor or its customers, employees, service providers or other third parties with whom the sponsor interacts continue to be the subject of attempted unauthorized access, mishandling or misuse of information, DDOS attacks, computer viruses, website defacement, hacking, malware, ransomware, phishing or other forms of social engineering, and other forms of cyber-attacks designed to obtain confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage, and other events. These threats, such as the Cybersecurity Incident, may derive from human error, fraud or malice on the part of the sponsor’s employees, insiders or third parties or may result from accidental technological failure. In addition, the sponsor’s customers access its products and services using computers, smartphones, tablets, and other mobile devices that are beyond the sponsor’s security control systems. |