What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2020-07-30 compared with 2020-05-07 · 195 added, 22 removed, 69 unchanged (76% of the section changed)

3 unchanged sentences

These risk factors, as well as our condensed consolidated financial statements and notes thereto and the other information appearing in this report, should be reviewed carefully for important information regarding risks that affect us.

The recent novel coronavirus (COVID-19) outbreak could materially and adversely affect our business, our financial condition, and results of operations.

The novel strain of the coronavirus identified in late 2019 has spread globally, and the outbreak was characterized as a pandemic by the World Health Organization in March 2020.

The novel coronavirus (“COVID-19”) outbreak could materially and adversely affect our business, financial condition, and results of operations.

The novel strain of the coronavirus identified in late 2019 has spread globally, and the World Health Organization characterized the outbreak as a pandemic in March 2020.

The outbreak has resulted in government authorities and businesses throughout the world implementing numerous measures intended to contain and limit the spread of COVID-19, including travel bans and restrictions, quarantines, shelter-in-place and lock-down orders, and business limitations and shutdowns.

1 unchanged sentence

While governments around the world have taken steps to attempt to mitigate some of the more severe anticipated economic effects of COVID-19, there can be no assurance that such steps will be effective or achieve their desired results in a timely fashion.

The COVID-19 outbreak has adversely impacted and is likely to further adversely impact our results of operations, as well as the operations of our customers, suppliers, vendors and other business partners.

As the COVID-19 outbreak has spread, cross-border activity and domestic commerce have sharply declined, due in large part to the measures described above intended to contain and limit the outbreak’s spread.

These measures may remain in place for a significant period of time and are likely to continue to adversely affect our business, results of operations and financial condition.

The COVID-19 outbreak has adversely impacted and is likely to further adversely impact the operations of our customers, suppliers, vendors and other business partners, and may adversely impact our results of operations in the future.

Cross-border activity and domestic commerce may be adversely impacted by the measures described above, which are intended to contain and limit the outbreak’s spread.

While many of these mitigation measures are gradually being lifted, to the extent they may remain in place or are reinstated for significant periods of time, they may adversely affect our business, financial condition, and results of operations.

In particular, we have experienced and may continue to experience adverse financial impacts from a number of operational factors, including, but not limited to, the following:

Merchants selling goods or services in advance of the date of their delivery (e.g., travel and events verticals) or experiencing bankruptcy, business failure, or other business interruption, which could result in our being liable to the buyers of such goods or services, either through our buyer protection program or through chargebacks on payment cards used by customers to fund their payments;

• Merchants selling goods or services in advance of the date of their delivery (e.g., travel and events verticals) or experiencing bankruptcy, insolvency, business failure, or other business interruption, which could result in our becoming liable to the buyers of such goods or services, either through our buyer protection program or through chargebacks on payment cards used by customers to fund their payments;

• Merchants who utilize our PayPal Working Capital and PayPal Business Loan products defaulting on their payment obligations;

2 unchanged sentences

consumer receivables owned by Synchrony Bank ;

Increased cyber and payment fraud risk related to COVID-19, as cybercriminals attempt to profit from the disruption in light of increased online banking, ecommerce, and other online activity;

Challenges to the availability and reliability of our products and services resulting from changes to our normal operations, including due to one or more clusters of COVID-19 cases occurring at our data centers or customer service and operations centers or the temporary closure of sites due to mandatory local lockdown requirements, which may impact our employees and/or the systems or employees of our customers and business partners;

• Increased cyber and payment fraud risk related to COVID-19, as cybercriminals attempt to profit from the disruption in light of increased online banking, e-commerce, and other online activity;

• Challenges to the availability and reliability of our products and services resulting from changes to our normal operations, including due to one or more clusters of COVID-19 cases occurring at our data centers or customer service and operations centers or the temporary closure of sites due to mandatory local lock-down requirements, which may impact our employees and/or the systems or employees of our customers and business partners;

• An increased volume of unanticipated customer requests for support (resulting in increased call center volume to our customer support and operations centers) and regulatory requests for information and support or additional regulatory requirements, which could require additional resources and costs to address.

These factors may remain prevalent for a significant period of time and may continue to adversely affect our business, results of operations and financial condition, even after the COVID-19 outbreak has subsided.

A sustained or prolonged COVID-19 outbreak or a resurgence could exacerbate the factors described above and intensify the impact on our business, and the resumption of economic activity and business operations to pre-pandemic levels may be delayed or constrained by lingering effects on our merchants and consumers.

Accordingly, these factors may adversely affect our business, financial condition, and results of operations, even after the COVID-19 outbreak has subsided.

In addition, actions that we have taken or may take in the future intended to assist customers impacted by COVID-19 (e.g., waiving certain fees and deferring repayments on business loans for certain affected small business customers) may negatively impact our results of operations.

While the current macroeconomic environment as a result of the COVID-19 outbreak has adversely impacted general consumer and merchant spending with a more pronounced impact on travel and events verticals, the spread of COVID-19 has also accelerated the shift from in-store shopping and traditional in-store payment methods (e.g., credit cards, debit cards, cash) towards e-commerce and digital payments and resulted in increased customer demand for safer payment and delivery solutions (e.g.

contactless payment methods, buy online and pick up in store) and a significant increase in online spending in certain verticals that have historically had a strong in-store presence.

On balance, our business has benefited from these behavioral shifts, including a significant increase in net new active accounts and payments volume.

To the extent that consumer preferences revert to pre-COVID-19 behaviors as mitigation measures to limit the spread of COVID-19 are lifted, our business, financial condition and results of operations could be adversely impacted.

The COVID-19 outbreak has required and is likely to continue to require significant management attention and substantial investments of time and resources across our enterprise.

The spread of COVID-19 has caused us to make significant modifications to our business practices, including restrictions on employee travel, closings or significant limitations on employee work locations, and cancellation of physical participation in meetings, events, and conferences.

An increased number of our employees are working remotely as a result of the outbreak, and an extended period of remote work arrangements and subsequent reintroduction into the workplace could introduce operational risk, increase cybersecurity risk, strain our business continuity plans, negatively impact productivity, give rise to claims by employees, and impair our ability to manage our business or otherwise adversely affect our business.

Additionally, COVID-19 could negatively affect our internal controls over financial reporting as a portion of our workforce is required to work from home and therefore new or modified processes, procedures, and controls could be required to respond to changes in our business environment.

The spread of COVID-19 has caused us to make significant modifications to our business practices, including enabling most of our workforce to work from home, establishing strict health and safety protocols for our offices, restricting physical participation in meetings, events, and conferences and imposing restrictions on employee travel.

The significant increase in the number of our employees who are working remotely as a result of the outbreak, and an extended period of remote work arrangements and subsequent reintroduction into the workplace could introduce operational risk, increase cybersecurity risk, strain our business continuity plans, negatively impact productivity, give rise to claims by employees, and impair our ability to manage our business or otherwise adversely affect our business.

Additionally, COVID-19 could negatively affect our internal controls over financial reporting as a significant portion of our workforce is required to work from home and therefore new or modified processes, procedures, and controls could be required to respond to changes in our business environment.

We may take further actions as may be required by government authorities or that we determine are in the best interests of our employees, customers, and business partners.

There is no certainty that such measures will be sufficient to mitigate the risks posed by COVID-19 or will otherwise be satisfactory to government authorities.

The extent to which the COVID-19 pandemic impacts our business, financial condition, and results of operations will depend on future developments, which are highly uncertain, difficult to predict and subject to change, including, but not limited to, the duration, scope and severity of the outbreak, the actions to contain COVID-19 or treat its impact, and how quickly and to what extent normal economic and operating conditions could potentially resume.

The spread of COVID-19 has led to disruption and volatility in the global capital markets, which may increase our cost of capital and may adversely affect our ability to access the capital markets.

1 unchanged sentence

In addition, we cannot predict the impact that COVID-19 will have on our customers, suppliers, vendors, and other business partners, and their respective financial condition, and any significant negative impact on these parties could materially and adversely impact us.

Additionally, government regulations or legislation adopted directly or indirectly in response to the COVID-19 outbreak may directly or indirectly negatively impact our business.

There are no comparable recent events that provide guidance as to the effect the spread of COVID-19 as a global pandemic may have, and as a result, the ultimate impact of the outbreak is highly uncertain and subject to change.

The extent to which the COVID-19 pandemic impacts our business, financial condition, and results of operations will depend on future developments, which are highly uncertain, difficult to predict and subject to change, including, but not limited to, the duration, scope and severity of the outbreak, actions taken to contain COVID-19 or treat its impact, and how quickly and to what extent normal economic and operating conditions could potentially resume.

While we do not yet know the full extent of the impacts on our business, financial condition, and results of operations, or the global economy as a whole, these impacts, individually or collectively, could have a material adverse impact on our business, financial condition and results of operations.

In addition, the impact of COVID-19 may heighten or exacerbate many of the other risks discussed in “Item 1A—Risk Factors” in 2019 Form 10-K, any of which could have a material impact on us.

The United Kingdom’s departure from the EU could adversely affect us.

The United Kingdom (“U.K.”) held a referendum in June 2016 in which a majority of voters approved an exit from the European Union (“EU”) (commonly referred to as “Brexit”).

formally exited the EU (and the European Economic Area (“EEA”)) on January 31, 2020 and a transition period is in place until December 31, 2020 during which time the U.K.

will remain in both the EU customs union and single market and follow EU rules, including those extending to EEA states.

There is a significant lack of clarity over the terms of the U.K.'s future relationship with the EU, and the international bodies that are linked to it, after this date.

Brexit could therefore adversely affect U.K., regional (including European), and worldwide economic and market conditions and could contribute to instability in global financial and foreign currency exchange markets, including volatility in the value of the British Pound and Euro, which in turn could adversely affect us or our customers and companies with which we do business, particularly in the U.K.

Brexit could lead to greater restrictions on the supply and availability of goods and services between the U.K.

and the EEA region, with the potential inability of U.K.

companies to fulfill orders which could lead to a risk of increased merchant defaults and buyer protection claims.

Brexit could also trigger a general deterioration in credit conditions, a downturn in consumer sentiment, and overall negative economic growth.

Any of these scenarios could have an adverse effect on our business or our customers.

In addition, Brexit could lead to legal uncertainty and increased complexity for financial services firms as national laws and regulations in the U.K.

start to diverge from EU laws and regulations.

In particular, depending on the terms of Brexit and the nature of the U.K.’s future trading relationships with European countries after December 31, 2020, we expect to face new regulatory costs and challenges, including the following:

• if we are unable to utilize appropriate authorizations and regulatory permissions, our European operations could lose their ability to offer services into the U.K.

market on a cross-border basis and our U.K.-based operations could lose their ability to offer services on a cross-border basis in the European markets.

For example, our ability to work primarily with the Luxembourg regulator as the lead authority for various aspects of the U.K.

operations of PayPal (Europe) S.à.r.l.

et Cie., SCA (“PayPal (Europe)”) and with the Swedish regulator for various aspects of the U.K.

operations of iZettle AB (“iZettle”) may be impacted;

• we could be required to obtain additional regulatory permissions to operate in the U.K.

market, adding costs and potential inconsistency to our business.

Depending on the capacity of the U.K.

authorities, the criteria for obtaining permission, and any possible transitional arrangements, our business in the U.K.

could be materially affected or disrupted;

• we could be required to comply with legal and regulatory requirements in the U.K.

that are in addition to, or inconsistent with, those of the EU, leading to increased complexity and costs for our European and U.K.

• our ability to attract and retain the necessary human resources in appropriate locations to support our U.K.

and European business could be adversely impacted.

These and other factors related to Brexit could, individually or in the aggregate, have a material adverse impact on our business, financial condition, and results of operations.

Our business is subject to extensive government regulation and oversight.

Our failure to comply with extensive, complex, overlapping, and frequently changing rules, regulations, and legal interpretations could materially harm our business.

Our business is subject to laws, rules, regulations, policies, and legal interpretations in the markets in which we operate, including, but not limited to, those governing:

• deposit taking,

• cross-border and domestic money transmission,

• prepaid access,

• foreign currency exchange,

• data governance,

• data protection,

• cybersecurity,

• banking secrecy,

• fraud detection,

• payment services (including payment processing and settlement services),

• consumer protection,

• antitrust and competition,

• economic and trade sanctions,

• anti-money laundering, and

• counter-terrorist financing.

Our success and increased visibility may result in increased regulatory oversight and enforcement and more restrictive rules and regulations that apply to our business.

As we introduce new products and services, or expand our product and service offerings, in U.S.

and international markets, we may become subject to additional regulations, restrictions, and licensing requirements.

In particular, as we expand and localize our international activities, we have become increasingly obligated to comply with the laws of the markets in which we operate.

In addition, because our services are accessible worldwide and we facilitate sales of goods and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws.

Laws regulating the internet, mobile, and related technologies outside of the U.S.

often impose different, more specific, or even conflicting obligations on us, as well as broader liability.

For example, certain transactions that may be permissible in a local jurisdiction may be prohibited by regulations of U.S.

Department of Treasury’s Office of Foreign Assets Control (“OFAC”) or U.S.

anti-money laundering or counter-terrorist financing regulations.

Any failure or perceived failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to or expansion of the interpretation of those laws, regulations, or orders), including those discussed in this risk factor, may subject us to significant fines, penalties, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions;

result in additional compliance and licensure requirements;

cause us to lose existing licenses or prevent or delay us from obtaining additional licenses that may be required for our business;

increase regulatory scrutiny of our business;

restrict our operations;

and force us to change our business practices, make product or operational changes, or delay planned transactions, product launches or improvements.

Any of the foregoing could, individually or in the aggregate, harm our reputation, damage our brands and business, and adversely affect our results of operations and financial condition.

The complexity of U.S.

federal and state and international regulatory and enforcement regimes, coupled with the global scope of our operations and the evolving global regulatory environment, could result in a single event prompting a large number of overlapping investigations and legal and regulatory proceedings by multiple government authorities in different jurisdictions.

We have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, but there can be no assurance that our employees, contractors, and agents will not violate such laws and regulations.

Payments Regulation

2 unchanged sentences

Virgin Islands, and Puerto Rico.

These licenses include not only the PayPal branded products and services in these states, but also our Braintree, Venmo, and Xoom products and services.

We may also maintain such licenses for certain companies that we have acquired, such as Hyperwallet.

These licenses include not only the PayPal branded products and services in these states, but also our Venmo, Hyperwallet and Xoom products and services.

As a licensed money transmitter, PayPal is subject to, among other requirements, restrictions with respect to the investment of customer funds, reporting requirements, bonding requirements, and inspection by state regulatory agencies.

2 unchanged sentences

These limitations may adversely affect our ability to grow our business in these markets.

We principally provide our services to customers in the EU through PayPal (Europe), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg.

We principally provide our services to customers in the EU and the UK through PayPal (Europe), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg.

Accordingly, PayPal (Europe) is potentially subject to significant fines or other enforcement action if it violates the disclosure, reporting, anti-money laundering, capitalization, corporate governance, privacy, data protection, data governance, information security, banking secrecy, taxation, cross-border payment, risk management, sanctions, or other requirements imposed on Luxembourg credit institutions.

4 unchanged sentences

Such access could subject us to data security and other legal and financial risks and could create new competitive forces and new types of competitors in the European payments market.

PSD2 also imposes new standards for payment security and strong customer authentication (“SCA”) that may make it more difficult and time consuming to carry out a PayPal transaction, which may adversely impact PayPal’s European customer value proposition.

SCA was implemented in 2019.

PSD2 also imposes new standards for payment security and strong customer authentication (“SCA”) that may make it more difficult and time consuming to carry out transactions on our Payments Platform, which may adversely impact PayPal’s European customer value proposition.

In line with an opinion issued by the European Banking Authority (“EBA”), national competent authorities (including Luxembourg) have announced enforcement deferral periods for migration to SCA requirements for e-commerce card-based transactions.

1 unchanged sentence

amending or accelerating these plans may adversely impact PayPal’s European customer value proposition.

If the business activities of PayPal (Europe) exceed certain thresholds, or if the European Central Bank (“ECB”) so determines, PayPal (Europe) may be deemed a significant supervised entity such that some activity of PayPal (Europe) could become directly regulated by the ECB rather than the CSSF, the Luxembourg regulator, as its national supervisor, which could subject us to additional requirements and would likely increase compliance costs.

If the business activities of PayPal (Europe) exceed certain thresholds, or if the European Central Bank (“ECB”) so determines, PayPal (Europe) may be deemed a significant supervised entity such that some activity of PayPal (Europe) could become directly regulated by the ECB, rather than by the CSSF, the Luxembourg regulator, as its national supervisor, which could subject us to additional requirements and would likely increase compliance costs.

In many of the other markets outside the U.S.

13 unchanged sentences

In such markets, we may be subject to significant fines or other enforcement action if we violate applicable reporting, anti-money laundering, capital requirements, privacy, corporate governance, risk management, or any other applicable requirements.

PayPal Australia Pty Limited (“PPAU”) self-reported a potential violation to the Australian Transaction Reports and Analysis Centre (“AUSTRAC”) on May 22, 2019 with respect to the reporting of international funds transfer instructions under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (“AML/CTF Act”).

Please see “Note 13—Commitments and Contingencies—Litigation and Regulatory Matters” for additional disclosure regarding this matter.

3 unchanged sentences

(“GoPay”), a provider of online payment services in China.

GoPay holds a number of payment business licenses in China and is subject to regulatory supervision by the People’s Bank of China and other regulatory bodies.

GoPay holds certain licenses associated with its payments business in China and is subject to regulatory supervision by the People’s Bank of China and other regulatory bodies.

We have been, and expect to continue to be, required to apply for various licenses, certifications, and regulatory approvals in a number of the jurisdictions where we provide our services, including due to changes in applicable laws and regulations or the interpretation of such laws and regulations.

5 unchanged sentences

Local regulators may use their authority to slow or halt payments to local merchants conducted through local banks or otherwise prohibit or impede us from doing business in a jurisdiction.

Such regulatory actions or the need to obtain licenses, certifications, or other regulatory approvals could impose substantial costs, involve considerable delay to the provision or development of our services, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, or prevent us from providing any products or services in a given market.

Such regulatory actions or the need to obtain licenses, certifications, or other regulatory approvals could impose substantial costs, involve considerable delay to the provision or development of our services, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business and products, or prevent us from providing any products or services in a given market.

Consumer Protection

We are subject to consumer protection, antitrust, and competition-related laws and regulations in the countries in which we operate.

In the U.S., we are subject to federal and state consumer protection laws and regulations applicable to our activities, including the Electronic Fund Transfer Act (“EFTA”) and Regulation E as implemented by the Consumer Financial Protection Bureau (“CFPB”).

These regulations require us to provide advance disclosure of changes to our services, follow specified error resolution procedures, and reimburse consumers for losses from certain transactions not authorized by the consumer.

Additionally, technical violations of consumer protection laws could result in the assessment of actual damages or statutory damages or penalties of up to $1,000 in individual cases or up to $500,000 per violation in any class action and treble damages in some instances;

we could also be liable for plaintiffs’ attorneys’ fees in such cases.

We are subject to, and have paid amounts in settlement of, lawsuits containing allegations that our business violated the EFTA and Regulation E or otherwise advance claims for relief relating to our business practices (e.g., that we improperly held consumer funds or otherwise improperly limited consumer accounts).

The CFPB issued a final rule on prepaid accounts that came into effect on April 1, 2019.

The rule’s definition of prepaid account includes certain accounts that are capable of being loaded with funds and whose primary function is to conduct transactions with multiple, unaffiliated merchants, at ATMs and/or for P2P transfers.

That definition includes certain digital wallets.

The rule’s requirements include, among other things, the disclosure of fees and other information to the consumer prior to the creation of a prepaid account;

the extension of Regulation E liability limits and error-resolution requirements to all prepaid accounts;

the application of Regulation Z credit card requirements to prepaid accounts with overdraft and credit features;

and the submission of prepaid account agreements to the CFPB and their publication to the general public.

We have implemented certain changes to comply with the final rule and made substantial changes to the design of certain U.S.

consumer accounts and their operability, which could lead to unintended customer confusion and dissatisfaction, discourage customers from opening new accounts, require us to reallocate resources, and increase our costs, which could negatively affect our business.

In December 2019, we filed a lawsuit in the U.S.

District Court for the District of Columbia against the CFPB challenging the validity of the prepaid account rule as applied to PayPal, Inc.

The court has issued a briefing schedule requiring the filing of all written submissions by September 25, 2020.

The assigned judge can resolve the matter without a trial at any time after briefing is completed.

As with any litigation, there is no guarantee that our claims will succeed.

In May 2015, we entered into a Stipulated Final Judgment and Consent Order (“Consent Order”) with the CFPB in which we settled regulatory claims arising from PayPal Credit practices between 2011 and 2015.

The Consent Order included obligations of PayPal to pay $15 million in redress to consumers and a $10 million civil monetary penalty, and required PayPal to make various changes to PayPal Credit disclosures and related business practices.

We continue to cooperate and engage with the CFPB and work to ensure compliance with the Consent Order, which may result in our incurring additional costs.

PayPal principally offers its services in EEA countries through a “passport” notification process through the Luxembourg regulator (in the case of PayPal (Europe)) or the Swedish regulator (in the case of iZettle AB) to regulators in other EEA member states in accordance with EU regulations.

Regulators in these countries could notify us of local consumer protection laws that apply to our business, in addition to Luxembourg or Swedish consumer protection laws, and could also seek to persuade the local regulator to order PayPal to conduct its activities in the local country directly or through a branch office.

Similarly, as a result of Brexit, the U.K.

regulators may impose new or different legal requirements on our U.K.

business, or require our activities to be conducted locally in the U.K.

through a branch office or directly.

These or similar actions by these regulators could increase the cost of, or delay, our plans to expand our business in Europe and the U.K.

Privacy and Protection of Customer Data

We are subject to a number of laws, rules, directives, and regulations (which we refer to as “privacy and data protection laws”) relating to the collection, use, retention, security, processing, and transfer (which we collectively refer to as “processing”) of personally identifiable information about our customers, our merchants’ customers, and employees (which we refer to as “personal data”) in the countries where we operate.

Our business relies on the processing of personal data in many jurisdictions and the movement of data across national borders.

As a result, much of the personal data that we process, which may include certain financial information associated with individuals, is regulated by multiple privacy and data protection laws and, in some cases, the privacy and data protection laws of multiple jurisdictions.

In many cases, these laws apply not only to third-party transactions, but also to transfers of information between or among us, our subsidiaries, and other parties with which we have commercial relationships.

Regulatory scrutiny of privacy, data protection, cybersecurity practices, and the processing of personal data is increasing around the world.

There is uncertainty associated with the legal and regulatory environment relating to privacy and data protection laws, which continue to develop in ways we cannot predict, including with respect to evolving technologies such as cloud computing, artificial intelligence, and blockchain technology.

Any failure or perceived failure to comply with existing or new laws of any government authority (including changes to or expansion of the interpretation of those laws), including those discussed in this risk factor, may subject us to significant fines, penalties, civil lawsuits, and enforcement actions in one or more jurisdictions, result in additional compliance requirements, increase regulatory scrutiny of our business, restrict our operations, and force us to change our business practices, make product or operational changes, or delay planned product launches or improvements.

Any failure, or perceived failure, by us to comply with our privacy policies as communicated to users in one or more jurisdictions could result in proceedings or actions against us by data protection authorities, government entities or others, including class action privacy litigation in certain jurisdictions.

Such proceedings or actions could subject us to significant fines, penalties, judgments, and negative publicity which may materially harm our business.

The foregoing may require us to change our business practices and would likely increase the costs and complexity of compliance.

In addition, compliance with inconsistent privacy and data protection laws may restrict our ability to provide products and services to our customers.

PayPal relies on a variety of compliance methods to transfer personal data of EEA individuals to the U.S., including reliance on Binding Corporate Rules (“BCRs”) for internal transfers of certain types of personal data and Standard Contractual Clauses (“SCCs”) as approved by the European Commission for transfers to and from third parties.

PayPal must also ensure that third parties processing personal data of PayPal’s EEA customers and/or employees outside of the EEA have compliant transfer mechanisms.

In October 2015, the European Court of Justice invalidated U.S.-EU Safe Harbor framework clauses that were previously relied upon by some PayPal vendors to lawfully transfer personal data of EU citizens to U.S.

companies, and PayPal entered into SCCs with those third parties which had previously relied on the U.S.-EU Safe Harbor framework.

In July 2016, the U.S.

and EU authorities agreed on a replacement for the Safe Harbor framework known as “Privacy Shield.” PayPal did not certify under the Privacy Shield regime and continues to use SCCs and BCRs as the primary cross border data transfer mechanisms.

Both the Privacy Shield framework and SCCs continued to face legal challenges and in July 2020, the European Court of Justice invalidated the Privacy Shield.

To the extent that an entity acquired by PayPal or third party relies on the Privacy Shield, PayPal’s ability to process EEA personal data with third parties outside of the EEA and intra-group with its U.S.

affiliates could be jeopardized.

PayPal is not a bank or licensed lender in the U.S.

and relies upon third parties to make loans and provide other products critical to our business, which raises additional risks.

As PayPal is neither a chartered financial institution, nor licensed to make loans in any state in the U.S., we rely on third-party chartered financial institutions to provide PayPal branded credit products to our customers in the U.S., including consumer credit products such as PayPal Credit, PayPal branded credit cards, and merchant credit products such as PayPal Working Capital and PayPal Business Loan products.

Any termination or interruption in a partner bank’s ability or willingness to lend could interrupt or limit our ability to offer consumer credit and merchant credit products, which could materially and adversely affect our business.

In the event of a partner bank’s inability or unwillingness to lend, we may be unable to reach a similar agreement with another chartered financial institution on favorable terms or at all.

Obtaining a bank charter or lending licenses would be a costly, time-consuming and uncertain process, and would subject us to additional laws and regulatory requirements, which could significantly increase our costs and compliance obligations and require us to change our business practices, which could materially and adversely affect our business.

In addition, as a service provider to these bank partners, which are federally supervised U.S.

financial institutions, we are subject from time to time to examination by their federal banking regulators.

In July 2018, we completed the sale of our U.S.

consumer credit receivables portfolio to Synchrony Bank, and do not hold an ownership interest in newly generated consumer credit receivables.

As a part of a separate agreement, PayPal earns a revenue share on the portfolio of consumer receivables owned by Synchrony Bank, which includes both the sold and newly generated receivables.

In the event the overall return on the PayPal branded credit programs funded by Synchrony does not meet a minimum rate of return (“minimum return threshold”) in a particular quarter, our revenue share for that period would be zero.

Further, in the event the overall return on the PayPal branded credit programs managed by Synchrony does not meet the minimum return threshold as measured over four consecutive quarters and in the following quarter, we would be required to make a payment to Synchrony, subject to certain limitations.

It may take us longer than expected to realize the anticipated benefits of the transaction, and those benefits may ultimately be smaller than anticipated or may not be realized at all, which could adversely affect our business and operating results.

In addition, our increased reliance on, and credit exposure to, Synchrony Bank, including in connection with this agreement, subjects us to risks in the nature of those discussed in the “Risk Factors” section of our 2019 Form 10-K under the captions “ We rely on third parties in many aspects of our business, which creates additional risk ” and “ If one or more of our counterparty financial institutions default on their financial or performance obligations to us or fail, we may incur significant losses.

In April 2020, PayPal was approved to participate in the U.S.

Government’s Paycheck Protection Program, which is designed to provide a direct incentive for small businesses to keep their workers on payroll during the COVID-19 outbreak.

Loans made under this program are funded by an independent chartered financial institution that we partner with, and the related receivables are not purchased by PayPal.

We receive a fee for providing origination services and loan servicing for these loans and retain operational risk related to those activities.

We have agreed to indemnify the chartered financial institution in connection with the services provided for loans made under this program under certain circumstances, including in the event the U.S.

Small Business Administration denies a claim for payment on a loan guaranty or a loan forgiveness payment.

Our point of sale solutions expose us to additional risks.

We have several point of sale solutions, which enable merchants to accept card and contactless payments using a payments card reader attached to, or otherwise communicating with, a mobile device or to scan payment cards and codes to enable consumers to use their mobile devices to pay at the point of sale.

We have entered into strategic partnerships with major payment card networks to further expand our relationship in a way that will make it easier for merchants to accept and consumers to choose to pay for transactions utilizing credit cards, debit cards, and contactless payments via PayPal at the point of sale.

Those agreements provide us with access to each of these partner's tokenization services in the U.S.

for in-store point of sale PayPal transactions, which we expect will increase the number of point of sale transactions that we process.

We believe that our iZettle branded and PayPal contactless point of sale solutions will enable us to further expand our in-store presence.

As we continue to expand our product and service offerings at the point of sale, we will face additional risks, including:

• increased expectations from merchants regarding the reliability and availability of our systems and services and correspondingly lower amounts of downtime, which we may not be able to meet;

• increased expectations from merchants that our systems and services will help them to comply with laws and regulations relating to tax, accounting, and bookkeeping, such as cash register systems, which we may not be able to meet;

• significant competition at the point of sale, particularly from established payment card providers, many of which have substantially greater resources than we do, and from other competing sale channels (such as e-commerce);

• increased targeting by fraudsters;

given that our fraud models are less developed in this area, we may experience increases in fraud and associated transaction losses as we adjust to potential fraudulent activity at the point of sale;

• exposure to product liability claims to the extent that hardware devices (e.g., card readers) that we produce for use at the point of sale malfunction or are not in compliance with laws, which could result in substantial liability and require product recalls or other actions;

• constraints in key resources to develop and maintain point of sale software and ancillary hardware;

• exposure to additional laws, rules, and regulations;

• application of payment card network rules or other agreements with payment card networks with respect to in-store transactions via PayPal;

• increased reliance on third parties involved with processing in-store payments, including independent software providers, electronic point of sale providers, hardware providers (such as card reader, cash drawer, and pin-pad providers), payment processors, and banks that enable in-store transactions;

• lower operating income than our other payment solutions.

Unless we are able to successfully manage these risks, including driving adoption of, and significant volume through, our point of sale solutions over time, our business may be harmed.

There are risks associated with our relationship with eBay.

In connection with our separation from eBay, we entered into a separation and distribution agreement with eBay, as well as various other agreements, including an operating agreement, a tax matters agreement, an employee matters agreement, an intellectual property matters agreement, a data sharing addendum, and a product development agreement.

The separation agreement, the tax matters agreement, the employee matters agreement, and the intellectual property matters agreement determined the allocation of assets and liabilities (including by means of licensing) between the companies following the separation for those respective areas and include associated indemnification obligations.

The operating agreement, the data sharing addendum, and the product development agreement established certain commercial relationships between eBay and us related to payment processing, credit, and data sharing.

If either we or eBay are unable to satisfy our performance, payment, or indemnification obligations under these agreements, we could incur operational difficulties or losses or be required to make substantial indemnification or other payments to eBay.

Disputes between eBay and us have arisen and others may arise in the future.

An adverse outcome in any such matters could materially and adversely affect our business, results of operations, and financial condition.

Our operating agreement with eBay entered into at separation had a term of five years that expired in July 2020, and provides for a one-year tail period under that agreement and certain related agreements.

The operating agreement defines a number of important elements of our commercial relationship with eBay, as well as certain obligations and restrictions related to PayPal’s provision of services to certain competitive platform operators of eBay (as specified in the operating agreement).

While eBay remains a significant source of our revenues and operating income, we expect the portion of our revenue and operating income attributable to eBay will continue to decline due to various factors (many of which are beyond our control), including the speed and extent to which eBay intermediates payments on its platform (including by acting as a merchant of record and migrating eBay merchants to eBay's managed payments platform), limits the availability of PayPal as a payment option or offers (or promotes) alternative payment options, directs transactions on its platforms to different providers of payment services, or eliminates or modifies its risk management or customer protection programs on its platforms, which could result in customer dissatisfaction, reduction in eBay volume, and other consequences adverse to our business.

If we are unable to generate sufficient business from our non-eBay customers to offset the expected reduction in the portion of our business attributable to eBay, it could materially impact the growth in our business and our ability to meet our long-term financial targets.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors