Vroom, Inc. (VRM) Risk Analysis

Our businesses are and will continue to be subject to extensive U.S. federal, state and local laws and regulations and executive orders. The financing of motor vehicles is regulated by every state in which we operate and by the U.S. federal government. Our prior ecommerce business, including the advertising and sale of used vehicles, titling and registration of vehicles, and the sale of value-added products, also was regulated by state laws, and such state laws can vary significantly from state to state. In addition, we are subject to regulations and laws specifically governing the internet and ecommerce and the collection, storage and use of personal information and other customer data. We are also subject to federal and state consumer protection laws, including prohibitions against unfair or deceptive acts or practices. The federal governmental agencies that regulate our business and have the authority to enforce such regulations and laws against us include agencies such as the U.S. Federal Trade Commission ("FTC"), the U.S. Consumer Financial Protection Bureau ("CFPB"), the U.S. Occupational Health and Safety Administration, the U.S. Department of Justice and the U.S. Federal Communications Commission ("FCC"). Additionally, we are subject to regulation by state consumer protection agencies and state financial regulatory agencies. In our prior ecommerce business, we have been subject to audits, requests for information, investigations and other inquiries from our regulators related to customer complaints. As we encountered operational challenges in keeping up with our rapid growth from 2020 through the first quarter of 2022, we experienced an increase in customer complaints, leading to an increase in such regulatory inquiries. We endeavored to promptly respond to any such inquiries and cooperate with our regulators. However, we have incurred fines in certain states and in April 2022, the Attorney General of Texas filed a lawsuit on behalf of the State of Texas in the District Court of Travis County, Texas against the Company, alleging violation of the Texas Deceptive Trade Practices - Consumer Protection Act and Texas Business and Commerce Code § 17.41 et seq. In December 2023, Vroom, Inc., Vroom Automotive, LLC and the Attorney General of the State of Texas reached a final agreement to resolve all claims in the petition, without any admission of wrongdoing by either Vroom entity. Under the agreement, the Company will pay a total of $2 million in civil penalties and $1 million in attorneys' fees, with the first half due in September 2024 and the remaining half due in September 2025, and abide permanently by an injunction of certain operational practices that were previously implemented. The agreement was approved by the District Court of Travis County on December 13, 2023. See Part II, Item 1 – "Legal Proceedings." In addition, In January 2022, the Company received a non-public civil investigative demand from the Federal Trade Commission ("FTC"), seeking the production of information related to certain of the Company's business practices and the Company responded to those information requests. On February 23, 2024, the FTC notified the Company that it has reason to believe that the Company violated Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); the FTC's Mail, Internet, or Telephone Order Merchandise Rule, 16 C.F.R. Part 435; the FTC's Used Motor Vehicle Trade Regulation Rule,16 C.F.R. Part 455; and the FTC's Pre-Sale Availability Rule, 16 C.F.R. Part 702. The FTC advised the Company that it is authorized to negotiate a stipulated order and the Company intends to work cooperatively with the FTC towards a resolution. Because the matter is at an early stage and the outcome of any complex legal proceeding is inherently unpredictable and subject to significant uncertainties, the Company cannot determine at present whether any potential liability would have a material adverse effect on the Company's financial condition, cash flows, or results of operations. In relation to our prior ecommerce business, we have been licensed as a dealer in the states of Texas, Florida, Arizona, California, Ohio and Wisconsin. We also have a motor vehicle sales finance license in Texas in connection with our Texas dealer license, a retail installment seller license in Florida in connection with our Florida dealer license, a retail installment seller license in Pennsylvania, and filed the required notice in Arizona in connection with our Arizona dealer license. As a result of the Ecommerce Wind-Down, we are terminating the foregoing licenses once all transactions, including title and registration transactions on behalf of our customers, are completed in the relevant jurisdiction. UACC's financing operations are subject to U.S. federal, state, and local laws and regulations regarding contract origination, acquiring motor vehicle installment sales contracts from retail sellers, furnishing data to credit reporting agencies, servicing, debt collection practices, and securitization transactions. Certain states require UACC to have a sales finance license, consumer credit license, or similar applicable license. UACC has obtained licenses in all states where licensing is required. In addition, UACC is subject to enforcement by the CFPB and state consumer protection agencies, including state attorney general offices and state financial regulatory agencies. Any failure to renew or maintain or any revocation of any of UACC's licenses would materially and adversely affect our business, financial condition and results of operations. In addition to these laws and regulations that apply specifically to the sale and financing of used vehicles, our facilities and business operations are subject to laws and regulations and executive orders relating to environmental protection, occupational health and safety, and other broadly applicable legal obligations. We also are subject to laws and regulations and executive orders involving taxes, tariffs, privacy and data security, anti-spam, pricing, content protection, electronic contracts and communications, mobile communications, consumer protection, information reporting requirements, unencumbered internet access to our platform, the design and operation of websites and internet neutrality. We are also subject to laws and regulations affecting public companies, including securities laws and Nasdaq listing rules. The violation of any of these laws or regulations could result in administrative, civil or criminal penalties or in a cease-and-desist order against our business operations, any of which could damage our reputation and have a material adverse effect on our business, financial condition and results of operations. We have incurred and will continue to incur capital and operating expenses and other costs to comply with these laws and regulations. The foregoing description of laws and regulations and other legal obligations to which we are or may be subject is not exhaustive, and the regulatory framework governing our operations is subject to evolving interpretations and continuous change. The enactment of new laws, regulations and executive orders, the interpretation of existing or new laws and regulations and executive orders in unpredictable or unfavorable ways, and changing enforcement priorities may affect the operation of our business, directly or indirectly, which could result in substantial regulatory compliance costs, civil or criminal penalties, including fines, adverse publicity, decreased revenues, and increased expenses.

We are subject to various litigation matters from time to time, the outcome of which could have a material adverse effect on our business, financial condition and results of operations. Claims arising out of actual or alleged violations of law could be asserted against us by individuals, either individually or through class actions, by governmental entities in civil or criminal investigations and proceedings or by other entities. These claims could be asserted under a variety of laws, including but not limited to consumer finance laws, consumer protection laws, intellectual property laws, privacy laws, labor and employment laws, securities laws and employee benefit laws. These actions could expose us to adverse publicity and to substantial monetary damages and legal defense costs, injunctive relief and criminal and civil fines and penalties, including but not limited to suspension or revocation of licenses to conduct business. For example, a consolidated class action is pending in the U.S. District Court for the Southern District of New York asserting claims on behalf of a putative class of Company stockholders against us, certain of our officers, and certain of our directors, among others, alleging violations of the federal securities laws. We also are a party to certain stockholder derivative suits in which the Company is named as a nominal defendant in suits that various individual stockholders seek to bring on behalf of the Company against certain of our current and former directors and officers. These suits are pending in the U.S. District Court for the Southern District of New York and the U.S. District Court for the District of Delaware and are based on the same general course of conduct alleged in the consolidated securities class action. We believe these lawsuits are without merit and intend to vigorously contest these claims. Further, the Company expects that the claims asserted in all six of the above derivative suits will be dismissed because the claims were released by the January 8, 2025 order of the U.S. Bankruptcy Court for the Southern District of Texas confirming the Company's plan of reorganization. In January 2022, the Company received a non-public civil investigative demand from the Federal Trade Commission ("FTC"), seeking the production of information related to certain of the Company's business practices and the Company responded to those information requests. On February 23, 2024, the FTC notified the Company that it has reason to believe that the Company violated Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); the FTC's Mail, Internet, or Telephone Order Merchandise Rule, 16 C.F.R. Part 435; the FTC's Used Motor Vehicle Trade Regulation Rule,16 C.F.R. Part 455; and the FTC's Pre-Sale Availability Rule, 16 C.F.R. Part 702. On May 6, 2024, Vroom, Inc., Vroom Automotive, LLC and the FTC reached an agreement to resolve the FTC's allegations without any admission of wrongdoing by either Vroom entity, subject to final approval by the FTC and the court. Under the agreement, the Company agreed to pay a total of $1 million in customer redress and abide permanently by an injunction. The FTC issued its final approval of the agreement on July 2, 2024, and a mutually agreed upon order reflecting the agreement was entered by the Court on July 10, 2024. The case is captioned Federal Trade Commission v. Vroom, Inc. et al., Case No. 4:24-cv-02496. In addition, in April 2022, the Attorney General of Texas filed a lawsuit on behalf of the State of Texas in the District Court of Travis County, Texas against the Company, alleging violation of the Texas Deceptive Trade Practices - Consumer Protection Act and Texas Business and Commerce Code § 17.41 et seq. In December 2023, Vroom, Inc., Vroom Automotive, LLC and the Attorney General of the State of Texas reached a final agreement to resolve all claims in the petition, without any admission of wrongdoing by either Vroom entity. Under the agreement, the Company agreed to pay a total of $2 million in civil penalties and $1 million in attorneys' fees, with the first half due in September 2024 and the remaining half due in September 2025, and abide permanently by an injunction of certain operational practices that were previously implemented. The agreement was approved by the District Court of Travis County on December 13, 2023. It is not possible to predict with certainty what, if any, future litigation we may become involved in, nor the final resolution of such litigation. The impact of any such litigation on our businesses and financial stability, however, could be material. See Part I, Item 3. "Legal Proceedings" for more information about these matters and the other legal proceedings to which we are subject.

We are subject to U.S. federal income tax, as well as income tax in certain states. Our provision for income taxes and cash tax liability in the future could be adversely affected by numerous factors including, changes in tax laws, regulations, accounting principles or interpretations thereof, which could materially and adversely impact our cash flows and our business, financial condition and results of operations in future periods. Increases in our effective tax rate could also materially affect our net results. In addition, the U.S. government may enact significant changes to the taxation of business entities including, among others, an increase in the corporate income tax rate and the imposition of minimum taxes, which may have a material adverse effect on our customers, our business, results of operations and financial condition. The likelihood of these changes being enacted or implemented is unclear. We are currently unable to predict whether such changes will occur and, if so, the ultimate impact on our business. Further, we are subject to the examination of our income and other tax returns by the IRS and state and local tax authorities, which could have an impact on our business, financial condition and results of operations.

There are numerous federal, state and local laws and regulations regarding privacy and the collection, processing, storing, sharing, disclosing, using and protecting of personal information and other data, the scope of which are constantly changing, subject to differing interpretations, and which may be costly to comply with, inconsistent between jurisdictions or conflicting with other rules. We are also subject to specific contractual requirements contained in third-party agreements governing our use and protection of personal information and other data. We are subject to the terms of our privacy policies and the privacy- and security-related obligations to third parties. We strive to comply with applicable laws, policies, legal obligations and industry codes of conduct relating to privacy and data protection, to the extent possible. However, it is possible that these obligations may be interpreted and applied in new ways or in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules or our practices. Additionally, new regulations could be enacted with which we are not familiar. Any failure or perceived failure by us to comply with our privacy policies, our privacy-related obligations to customers or other third parties, our privacy-related legal obligations or any compromise of security that results in the unauthorized release or transfer of sensitive information, which may include personally identifiable information or other customer data, may result in governmental enforcement actions, litigation or public statements against us by consumer advocacy groups or others and could cause customers, vendors and third-party business partners to lose trust in us, which could have a material adverse effect on our business, financial condition and results of operations. Additionally, if vendors, developers or other third parties that we work with violate applicable laws or our policies, such violations may also put customers', vendors' or receivables-purchasers' information at risk and could in turn harm our business, financial condition and results of operations. Moreover, laws, regulations, and standards covering marketing, advertising, and other activities conducted by telephone, email, mobile devices, and the internet may be or become applicable to our business, such as the Federal Communications Act, the Federal Wiretap Act, the Electronic Communications Privacy Act, the Telephone Consumer Protection Act (the "TCPA"), the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (the "CAN-SPAM Act"), and similar state consumer protection and communication privacy laws, such as California's Invasion of Privacy Act. We use telephone calls and send short message service ("SMS") text messages to customers. The actual or perceived improper sending of text messages may subject us to potential risks, including liabilities or claims relating to consumer protection laws such as the TCPA. Numerous class-action suits under federal and state laws have been filed in recent years against companies who conduct telemarketing and/or SMS texting programs, with many resulting in multi-million-dollar settlements to the plaintiffs. Any future such litigation against us could be costly and time-consuming to defend. In particular, the TCPA imposes significant restrictions on the ability to make telephone calls or send text messages to mobile telephone numbers without the prior consent of the person being contacted. Federal or state regulatory authorities or private litigants may claim that the notices and disclosures we provide, form of consents we obtain or our outreach practices are not adequate or violate applicable law. This may in the future result in civil claims against us. Claims that we have violated the TCPA could be costly to litigate, whether or not they have merit, and could expose us to substantial statutory damages or costly settlements. We may send marketing messages via email, subjecting us to the CAN-SPAM Act. The CAN-SPAM Act imposes certain obligations regarding the content of emails and providing opt-outs (with the corresponding requirement to honor such opt-outs promptly). While we strive to ensure that all of our marketing communications comply with the requirements set forth in the CAN-SPAM Act, any violations could result in the Federal Trade Commission seeking civil penalties against us. We expect that industry standards, laws and regulations will continue to develop regarding privacy, data protection, information security and artificial intelligence in many jurisdictions. In recent years, certain states have adopted or modified data privacy and security laws and regulations that may apply to our business. For example, the California Consumer Privacy Act ("CCPA") requires businesses that process personal information of California residents to, among other things: provide certain disclosures to California residents regarding the business's collection, use, and disclosure of their personal information; receive and respond to requests from California residents to access, delete, and correct their personal information, or to opt-out of certain disclosures of their personal information; and enter into specific contractual provisions with service providers that process California resident personal information on the business's behalf. The enactment of the CCPA is prompting a wave of similar legislative developments in other states in the United States, which creates a patchwork of overlapping but different state laws. Similar laws have been proposed in many other states and at the federal level as well. Complying with these evolving obligations is costly. For instance, expanding definitions and interpretations of what constitutes "personal data" (or the equivalent) within the United States may increase our compliance costs and legal liability. Even though we believe we and our vendors are generally in compliance with applicable laws, rules and regulations relating to privacy and data security, these laws are in some cases relatively new and the interpretation and application of these laws are uncertain. A significant data breach or any failure, or perceived failure, by us to comply with any federal, state or local privacy or consumer protection-related laws, regulations or other principles or orders to which we may be subject or other legal obligations relating to privacy or consumer protection could adversely affect our reputation, brand and business, and may result in claims, investigations, proceedings or actions against us by governmental entities or others or other penalties or liabilities or require us to change our operations and/or cease using certain data sets. Depending on the nature of the information compromised, we may also have obligations to notify users, law enforcement or payment companies about the incident and may need to provide some form of remedy, such as refunds, for the individuals affected by the incident. If any of these events were to occur, our business, results of operations, and financial condition could be materially adversely affected.

The protection of intellectual property, technology and confidential information is crucial to the success of our businesses. Moreover, we will work to preserve the value of our Vroom intellectual property rights where appropriate following the Ecommerce Wind-Down. We rely on a combination of trademark, trade secret, patent and copyright law, as well as contractual restrictions, to protect our intellectual property (including our brand, technology and confidential information). While it is our policy to protect and defend our rights to our intellectual property, we cannot predict whether steps taken by us to protect our intellectual property will be adequate to prevent infringement, misappropriation, dilution or other violations of our intellectual property rights. We also cannot guarantee that others will not independently develop technology that has the same or similar functionality as our technology. Unauthorized parties may also attempt to copy or obtain and use our technology to develop competing solutions, and policing unauthorized use of our technology and intellectual property rights may be difficult and ineffective. Changes in the law or adverse court rulings may also negatively affect our ability to prevent others from using our technology. If our intellectual property rights are used or misappropriated by third parties, the value of our brand and intellectual property may be diminished and competitors may be able to more effectively mimic our products and methods of operations. Any of these events could materially adversely affect our business, financial condition or results of operations. Furthermore, we may face claims of infringement of third-party intellectual property that could interfere with our ability to market, promote and sell our brands, products and services. Any litigation to enforce our intellectual property rights or defend ourselves against claims of infringement of third-party intellectual property rights, regardless of merit, could be costly, divert attention of management and may not ultimately be resolved in our favor. Moreover, if we are unable to successfully defend against claims that we have infringed the intellectual property rights of others, we may be prevented from using certain intellectual property and may be liable for damages, which in turn could materially adversely affect our business, financial condition or results of operations. Even if we were to prevail, the time and resources necessary to resolve such disputes could be costly, time-consuming and divert the attention of management from our business operations. A number of aspects of intellectual property protection in the field of AI and machine learning are currently under development, and there is uncertainty and ongoing litigation in different jurisdictions as to the degree and extent of protection warranted for AI and machine learning systems and relevant system input and outputs. If we fail to obtain protection for the intellectual property rights concerning our AI Tools, or later have our intellectual property rights invalidated or otherwise diminished, our competitors may be able to take advantage of our research and development efforts to develop competing products. Given the long history of development of AI Tools, other parties may have (or in the future may obtain) patents or other proprietary rights that would prevent, limit or interfere with our ability to make, use or sell our own AI Tools. We are currently the registrant of the vroom.com, texasdirectauto.com, carstory.com, vast.com and unitedautocredit.net internet domain names and various other related domain names. The regulation of domain names in the United States is subject to change. Regulatory bodies could establish additional top-level domains, appoint additional domain name registrars or modify the requirements for holding domain names. As a result, we may not be able to acquire or maintain domain names that are important for our business. In addition, we have registered certain trademarks that are important to our business, such as the "Vroom", "Sell Us Your Car", "CarStory", "Vast" and "United Auto Credit" trademarks. While we are seeking, and have secured registration of several of our trademarks in the U.S. and other foreign jurisdictions (including Canada and Europe), it is possible that others may assert senior rights to similar trademarks and seek to prevent our use and further registration of our trademarks in certain jurisdictions. Additionally, our pending trademark or service mark applications may not result in such marks being registered in a timely manner or at all. If we fail to adequately protect or enforce our rights under these trademarks, we may lose the ability to use those trademarks or to prevent others from using them, which could adversely harm our reputation and our business, financial condition and results of operations. While software can be protected under copyright law, we have chosen not to register any copyrights in our proprietary software, and instead, primarily rely on trade secret law to protect our proprietary software. In order to bring a copyright infringement lawsuit in the United States, the copyright must be registered. Accordingly, the remedies and damages available to us for unauthorized use of our software may be limited. Furthermore, our trade secrets, know-how and other proprietary materials may be revealed to the public or our competitors or independently developed by our competitors and, as a result, may no longer provide protection for the related intellectual property. Our CarStory business has a number of patents and we may obtain additional patents in the future. We may fail to apply for patents on important products, methods and technologies in a timely fashion or at all, or we may fail to apply for patents in potentially relevant jurisdictions. Moreover, we may fail to obtain issuance of any of the patent applications we do file. Effective protection of patents is complex, expensive and difficult to maintain, both in terms of filing costs as well as the costs of defending and enforcing our rights in our patents. For example, the U.S. Patent and Trademark Office and various foreign governmental patent agencies require compliance with a number of procedural requirements to complete the patent application process and to maintain issued patents, and noncompliance or non-payment could result in abandonment or lapse of a patent or patent application, resulting in partial or complete loss of patent rights in a relevant jurisdiction.

We and certain of our third-party providers collect, maintain and process data about current and prospective customers, employees, business partners and others, including personally identifiable information, as well as proprietary information belonging to our business such as trade secrets (collectively, "Confidential Information"). We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, "IT Systems"). We own and manage some of these IT Systems but also rely on third parties that are not directly under our control to manage certain areas of these operations. For example, we rely on encryption, storage, and processing technology developed by third parties to securely transmit, operate on and store such information. Successful cyberattacks that disrupt or result in unauthorized access to third party IT Systems can materially impact our operation and financial results. Due to the volume and sensitivity of the personal information and data we and these third parties manage and expect to manage in the future, as well as the nature of our customer base, the security features of our information systems are critical. Any failure or perceived failure by us or by third parties who access our IT Systems and/or Confidential Information to maintain the security of personal and other data that is provided to us by customers, employees and vendors could harm our reputation and brand and expose us to a risk of loss or litigation and possible liability, any of which could adversely affect our business, financial condition, and results of operations. While we employ a number of security measures designed to protect the security of our IT Systems and Confidential Information, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, and of third parties we rely on will be fully implemented, complied with or effective in protecting our IT Systems and Confidential Information. Additionally, concerns about our practices with regard to the collection, use or disclosure of personal information or other privacy-related matters, even if unfounded, could harm our business, financial condition and results of operations. We are subject to numerous federal, state and local laws, regulations and industry standards regarding privacy, cybersecurity and the collection, use, disclosure and other processing of personal information and other data. The scope and interpretation of these laws continue to evolve and may be inconsistent across jurisdictions. New laws also may be enacted. See "-Failure to comply with federal, state and local laws and regulations relating to privacy, data protection and consumer protection, or the expansion of current or the enactment of new laws or regulations relating to privacy, data protection and consumer protection, as well as our actual or perceived failure to protect such information could harm our reputation and could adversely affect our business, financial condition and results of operations." Further, we are subject to contractual requirements and others' privacy policies that govern how we use and protect personal information and other data. These obligations may be interpreted and applied inconsistently and may conflict with other rules or our practices. Any failure or perceived failure by us to comply with our privacy policies or obligations may result in regulatory investigations, governmental enforcement actions, litigation (such as class actions), fines or penalties or negative publicity that could have an adverse effect on our business. If our third-party service providers violate applicable laws, contractual obligations or our policies, then such violations also may put consumer, employee and vendor information at risk and could, in turn, harm our reputation, business and operating results.

Our platform utilizes open-source software, and we expect to use open-source software in the future in connection with our platform. To the extent that our platform depends upon the successful operation of open-source software, any undetected errors or defects in this open-source software could prevent the deployment or impair the functionality of our platform, delay the introduction of new solutions, result in a failure of our platform, introduce cybersecurity vulnerabilities, and injure our reputation. For example, undetected errors or defects in open-source software could render it vulnerable to breaches or security attacks, and, in conjunction, make our systems more vulnerable to data breaches. In addition, the terms of various open-source licenses have not been fully interpreted by United States courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our platform. Our utilization of some open-source licenses in conjunction with our proprietary software might require us to make the source code for our proprietary software publicly available at no cost or require us to make our source code publicly available for modifications or derivative works, including if our source code is based upon, incorporates, or was created using the open-source software. Although we monitor our use of open-source software to avoid subjecting our software to such requirements or other conditions we do not intend, we cannot assure you that our processes for controlling our use of open-source software will always be effective. Furthermore, we could be subject to third-party claims asserting ownership of, or demanding release of, the open-source software or derivative works that we developed using such software, or otherwise seeking to enforce the terms of the applicable open-source license. Such claims could result in litigation and/or substantial costs to defend and resolve. In addition to risks related to open-source license requirements, usage of open-source software can lead to greater risks than use of third-party commercial software, as open-source licensors generally do not provide warranties, support services, indemnification or other contractual provisions regarding the quality of the code or intellectual property infringement claims protections, nor controls on the origin of the software. Many of the risks associated with usage of open-source software cannot be eliminated and could materially and adversely affect our business, financial condition and results of operations.

UACC is dependent upon establishing and maintaining relationships with a large number of manufacturer-franchised and independent motor vehicle dealers to supply it with automobile contracts. During the years ended December 31, 2020 through 2024, no single dealer accounted for 1% or more of the automobile contracts UACC purchased, other than Vroom, through our former ecommerce business. The agreements UACC has with dealers to purchase automobile contracts do not require dealers to submit a minimum number of automobile contracts for purchase. The failure of dealers to submit automobile contracts that meet UACC's underwriting criteria could result in reductions in its revenues or the cash flows available to it, and, therefore, could have an adverse effect on UACC's and our results of operations. As of January 2024, when we commenced the Ecommerce Wind-Down, automobile contracts originated from Vroom customers or purchased from Vroom represented approximately 29.7% of UACC's total serviced loan portfolio. If UACC is unable to replace the volume of automobile contracts it previously originated through Vroom's ecommerce business, our business, financial condition, and operating results could be materially adversely affected.

We provide suggested offer pricing to our dealer partners as part of the CarStory platform using data science and proprietary algorithms based on a number of factors, including mechanical soundness, consumer desirability, vehicle history, market prices and relative value as prospective inventory. We also may leverage the CarStory Real Market Price for vehicle valuations in UACC's underwriting and servicing. If we are unable to provide accurate and competitive pricing through the CarStory Real Market Price, our revenue, gross margins and results of operations would be affected, which could have an adverse effect on our business, financial condition and results of operations.

Changes in demographics and population, local and regional downturns or severe weather conditions and other catastrophic occurrences in any of the states where UACC has a high concentration of borrowers or dealership partners could result in payment delays and increased risk of losses and could materially and adversely affect our revenues and results of operations. During the year ended December 31, 2024, 41.03% of UACC's originations were located in UACC's three largest states (measured by aggregate financed amount). While we believe that we have a diverse geographic presence, we expect that these three states will continue to generate significant amounts of our loans due to economic, demographic, regulatory, competitive and other conditions in these states. Adverse developments in these states could lead to reduced demand for automotive financing, and could materially adversely affect our financial condition and results of operations.