The servicer will maintain possession of the original contracts for each of the receivables in tangible form or “control” of the authoritative copies of the contracts in electronic form, and the original contracts and authoritative copies of electronic contracts will not be segregated or marked as belonging to the issuing entity. If the servicer sells or pledges the receivables and delivers the original contracts for the receivables to another party or permits another party to obtain control of the authoritative copies of the electronic contracts, in violation of its contractual obligations under the transaction documents, this party could acquire an interest in the receivable which may have priority over the issuing entity’s interest. The servicer could also lose possession or control of the contracts through fraud, forgery, negligence or error, or as a result of a computer virus or a hacker’s actions or otherwise (especially in a circumstance where the contracts are held in electronic form). Furthermore, if the servicer becomes the subject of an insolvency or receivership proceeding, competing claims to ownership or security interests in the receivables could arise. These claims, even if unsuccessful, could result in delays in payments on the notes. If successful, these claims could result in losses or delays in payment to you or an acceleration of the repayment of the notes.
As a result of any of the above events, the issuing entity may not have a perfected security interest in the financed vehicles or in the receivables. The possibility that the issuing entity may not have a perfected security interest in the financed vehicles or the receivables may affect the issuing entity’s ability to receive payments on the receivables or liquidation proceeds with respect to the financed vehicles. Therefore, you may be subject to delays in payment and may incur losses on your notes.
RISKS RELATED TO THE SERVICER AND OTHER TRANSACTION PARTIES.
The sponsor faces risks related to its operational, technological and organizational infrastructure, including risks arising from the theft, loss or misuse of information (including as a result of a cyber-attack), which could adversely affect the liquidity or market value of your notes and the timing and amount of payments on your notes
Similar to other large financial institutions, the sponsor is exposed to operational risk that can manifest itself in many ways, such as errors in execution or inadequate processes, inaccurate models, faulty or disabled technological infrastructure and fraud by employees or persons outside of the company. In addition, the sponsor is heavily dependent on the security, capability and continuous availability of the technology systems that it uses to manage its internal financial and other systems, monitor risk and compliance with regulatory requirements, provide services to its customers, develop and offer new products and communicate with stakeholders.
If the sponsor does not maintain the necessary operational, technological and organizational infrastructure to operate its business, including to maintain the security of that infrastructure, the sponsor’s business and reputation could be materially adversely affected, which could adversely affect the liquidity or market value of your notes. The sponsor is also subject to disruptions to its operating systems arising from events that are wholly or partially beyond its control, which may include, computer viruses, electrical or telecommunications outages, design flaws in foundational components or platforms, availability and quality of vulnerability patches from key vendors, cyber-attacks (including Distributed Denial of Service (“DDOS”) attacks and other attacks on its infrastructure), natural disasters, public health emergencies (including COVID-19 or similar outbreaks), other damage to property or physical assets, or events arising from local or larger scale politics, including terrorist acts and civil unrest. The sponsor also relies on the business infrastructure and systems of third parties with which it does business and to whom it outsources the operation, maintenance and development of its information technology and communications systems.
On July 29, 2019, the sponsor’s direct parent, the Corporation, announced that on March 22, 2019 and March 23, 2019, an outside individual gained unauthorized access to its systems. This individual obtained certain types of personal information relating to people who had applied for the Corporation’s credit card products and to the Corporation’s credit card customers (the “Cybersecurity Incident”). The Corporation may incur significant costs in connection with the Cybersecurity Incident and any future cybersecurity incidents, including infrastructure investments or remediation efforts. Technologies, systems, networks and devices of the sponsor or its employees, service providers or other third parties with whom the sponsor interacts may continue to be the subject of attempted unauthorized access, mishandling or misuse of information, DDOS attacks, computer viruses, website defacement, hacking, malware, ransomware, phishing or other forms of social engineering, and other forms of cyber-attacks designed to obtain confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage, and other events. These threats, such as the Cybersecurity Incident, may derive from error, fraud or malice on the part of the sponsor’s employees, insiders or third parties or may result from accidental technological
22