CPRT Copart, Inc.
CPRT's fiscal 2026 10-K introduces a new debt/leverage risk factor tied to the 2026 Credit Agreement and materially escalates tariff, cybersecurity, privacy, and anti-bribery/export-control risk language, while existing risk factors remain largely intact.
The new debt risk factor and the sharp escalation in tariff language transform the risk profile from a clean, nearly debt-free story into one carrying both financial leverage and direct trade-policy exposure. This filing materially undermines the 'hold' thesis by introducing a $1.25 billion credit facility and explicitly flagging post-2025 tariff volatility, which directly threatens the best-in-class margins that were the core reason to own the name.
CPRT files an 8-K or subsequent 10-Q confirming the 2026 Credit Agreement remains undrawn and that tariff impacts have not caused a sequential decline in gross margin below 45%.
CPRT's fiscal 2026 10-K introduces a new debt/leverage risk factor tied to the 2026 Credit Agreement and materially escalates tariff, cybersecurity, privacy, and anti-bribery/export-control risk language, while existing risk factors remain largely intact.
NEW RISKS (1)- highWe may incur substantial indebtedness and any failure to meet our debt obligations may adversely affect our business, financial condition, and results of operations. — Discloses the new 2026 Credit Agreement providing up to $1.25 billion in unsecured revolving credit maturing January 2031, with restrictive covenants and variable interest rate exposure.
- highChanges in laws or the interpretation of laws, including foreign laws and regulations, affecting the import and export of vehicles may have an adverse effect on our business and financial condition. — New language explicitly cites a material increase and considerable volatility in U.S. tariffs since 2025 and retaliatory tariffs from foreign governments, materially heightening the trade-risk outlook.
- highDisruptions to information technology systems used in our business, including failure to prevent outages, maintain security, and prevent unauthorized access to our information technology systems and confidential information, could disrupt our business and materially and adversely affect our reputation, consolidated results of operations, and financial condition. — Adds detail on AI-enabled attack methods by threat actors, expanded consequences including data loss/corruption, indemnity obligations, and explicitly extends risk to service providers processing data on CPRT's behalf.
- highOur business is subject to a variety of domestic and international laws and other obligations regarding privacy and data protection. — Significantly expanded with specific GDPR penalty figures (up to €20 million or 4% of worldwide revenue), UK GDPR implementation details, LGPD comparability, payment-card company data-security standards, and broader consequences including loss of payment-card processing ability.
- 1 10-K filing0001193125-26-405731
- 1 10-K (prior year) filing0001628280-25-042946
Signals are informational research, not individualized investment advice.