Item 1A. Risk Factors
Item 1A: Risk Factors
We are subject to various risks and uncertainties, which could materially affect our business, results of operations, financial condition, future results, and the trading price of our common stock. You should read carefully the following information together with the information appearing in Part I, Item 1A, Risk Factors in our Annual Report on Form 10-K for the year ended December 31, 2019 as filed with the SEC on February 6, 2020 (“2019 Form 10-K”). The following information supplements and, to the extent inconsistent, supersedes some of the information appearing in the Risk Factors section of our 2019 Form 10-K. These risk factors, as well as our condensed consolidated financial statements and notes thereto and the other information appearing in this report, should be reviewed carefully for important information regarding risks that affect us.
The novel coronavirus (“COVID-19”) outbreak could materially and adversely affect our business, financial condition, and results of operations.
The novel strain of the coronavirus identified in late 2019 has spread globally, and the World Health Organization characterized the outbreak as a pandemic in March 2020. The outbreak has resulted in government authorities and businesses throughout the world implementing numerous measures intended to contain and limit the spread of COVID-19, including travel bans and restrictions, quarantines, shelter-in-place and lock-down orders, and business limitations and shutdowns. These measures have negatively impacted consumer and business spending and payments activity generally, and have significantly contributed to deteriorating macroeconomic conditions and higher unemployment in some countries, including those in which we have significant operations. While governments around the world have taken steps to attempt to mitigate some of the more severe anticipated economic effects of COVID-19, there can be no assurance that such steps will be effective or achieve their desired results in a timely fashion.
The COVID-19 outbreak has adversely impacted and is likely to further adversely impact the operations of our customers, suppliers, vendors and other business partners, and may adversely impact our results of operations in the future. Cross-border activity and domestic commerce may be adversely impacted by the measures described above, which are intended to contain and limit the outbreak’s spread. While many of these mitigation measures are gradually being lifted, to the extent they may remain in place or are reinstated for significant periods of time, they may adversely affect our business, financial condition, and results of operations. Actions that we have taken or may take in the future intended to assist customers impacted by COVID-19 (e.g., waiving certain fees and payment holidays provided as a part of our COVID-19 payment relief initiatives) may negatively impact our results of operations. In particular, we have experienced and may continue to experience adverse financial impacts from a number of operational factors, including, but not limited to, the following:
• Merchants selling goods or services in advance of the date of their delivery (e.g., travel and events verticals) or experiencing bankruptcy, insolvency, business failure, or other business interruption, which could result in our becoming liable to the buyers of such goods or services, either through our buyer protection program or through chargebacks on payment cards used by customers to fund their payments;
• Merchants who utilize our merchant credit products such as PayPal Working Capital and PayPal Business Loan products defaulting on their payment obligations;
• Consumers who utilize our PayPal Credit products defaulting on their payment obligations, including U.S. consumers, which may adversely impact our revenue share on the portfolio of U.S. consumer receivables owned by Synchrony Bank ;
• Increased cybersecurity and payment fraud risk related to COVID-19, as cybercriminals attempt to profit from the disruption in light of increased online banking, e-commerce, and other online activity;
• Challenges to the availability and reliability of our products and services resulting from changes to our normal operations, including due to one or more clusters of COVID-19 cases occurring at our (or our service providers') corporate offices or customer service and operations centers or the temporary closure of these sites due to mandatory local lock-down requirements, which may impact our employees, our level of customer service, and/or the systems or employees of our customers and business partners; and
• An increased volume of unanticipated customer requests for support (resulting in increased volume to our customer support and operations centers) and regulatory requests for information and support or additional regulatory requirements, which could require additional resources and costs to address.
66
Table of Contents
A sustained or prolonged COVID-19 outbreak or a resurgence could exacerbate the factors described above and intensify the impact on our business, and the resumption of economic activity and business operations to pre-pandemic levels may be delayed or constrained by lingering effects on our merchants and consumers. Accordingly, these factors may adversely affect our business, financial condition, and results of operations, even after the COVID-19 outbreak has subsided.
While the current macroeconomic environment as a result of the COVID-19 outbreak has adversely impacted general consumer and merchant spending with a more pronounced impact on travel and events verticals, the spread of COVID-19 has also accelerated the shift from in-store shopping and traditional in-store payment methods (e.g., credit cards, debit cards, cash) towards e-commerce and digital payments and resulted in increased customer demand for safer payment and delivery solutions (e.g. contactless payment methods, buy online and pick up in store) and a significant increase in online spending in certain verticals that have historically had a strong in-store presence. On balance, our business has benefited from these behavioral shifts, including a significant increase in net new active accounts and payments volume. To the extent that consumer preferences revert to pre-COVID-19 behaviors as mitigation measures to limit the spread of COVID-19 are lifted or relaxed, our business, financial condition, and results of operations could be adversely impacted.
The COVID-19 outbreak has required and is likely to continue to require significant management attention, substantial investments of time and resources across our enterprise, and increased costs to effectively manage our operations. The spread of COVID-19 has caused us to make significant modifications to our business practices, including enabling most of our workforce to work from home, establishing strict health and safety protocols for our offices, restricting physical participation in meetings, events, and conferences and imposing restrictions on employee travel. The significant increase in the number of our employees who are working remotely as a result of the outbreak, and an extended period of remote work arrangements and subsequent reintroduction into the workplace could introduce operational risk, increase cybersecurity risk, strain our business continuity plans, negatively impact productivity, give rise to claims by employees, and impair our ability to manage our business or otherwise adversely affect our business. Additionally, COVID-19 could negatively affect our internal controls over financial reporting as a significant portion of our workforce is required to work from home and therefore new or modified processes, procedures, and controls could be required to respond to changes in our business environment. We may take further actions as may be required by government authorities or that we determine are in the best interests of our employees, customers, and business partners. There is no certainty that such measures will be sufficient to mitigate the risks posed by COVID-19 or will otherwise be satisfactory to government authorities.
The spread of COVID-19 has led to disruption and volatility in the global capital markets, which may increase our cost of capital and may adversely affect our ability to access the capital markets. Even after the COVID-19 outbreak has subsided, we may continue to experience adverse impacts to our business as a result of the global economic impact, including the availability of credit, adverse impacts on our liquidity and any recession that has occurred or may occur in the future. In addition, we cannot predict the impact that COVID-19 will have on our customers, suppliers, vendors, and other business partners, and their respective financial condition, and any significant negative impact on these parties could materially and adversely impact us. Additionally, government regulations or legislation adopted directly or indirectly in response to the COVID-19 outbreak may negatively impact our business.
There are no comparable recent events that provide guidance as to the effect the spread of COVID-19 as a global pandemic may have, and as a result, the ultimate impact of the outbreak is highly uncertain and subject to change. The extent to which the COVID-19 pandemic impacts our business, financial condition, and results of operations will depend on future developments, which are highly uncertain, difficult to predict and subject to change, including, but not limited to, the duration, scope, severity, and geographic spread of the outbreak, actions taken to contain COVID-19 or treat its impact, measures taken by various governmental authorities in response to the outbreak (such as continued and/or new quarantines, mask and social distancing requirements, and travel restrictions), geographic variation in how countries and states are handling the outbreak, and how quickly and to what extent normal economic and operating conditions could potentially resume. While we do not yet know the full extent of the impacts on our business, financial condition, and results of operations, or the global economy as a whole, these impacts, individually or collectively, could have a material adverse impact on our business, financial condition and results of operations. In addition, the impact of COVID-19 may heighten or exacerbate many of the other risks discussed in Item 1A—Risk Factors in our 2019 Form 10-K, any of which could have a material impact on us.
67
Table of Contents
We face substantial and increasingly intense competition worldwide in the global payments industry.
The global payments industry is highly competitive, rapidly changing, highly innovative, and increasingly subject to regulatory scrutiny and oversight. We compete against a wide range of businesses, including those that are larger than we are, have greater name recognition, longer operating histories, or a dominant or more secure position, or offer other products and services to consumers and merchants that we do not offer, as well as smaller or younger companies that may be more agile in responding quickly to regulatory and technological changes. Many of the areas in which we compete evolve rapidly with changing and disruptive technologies, shifting user needs, and frequent introductions of new products and services. Competition also may intensify as businesses enter into business combinations and partnerships, and established companies in other segments expand to become competitive with different aspects of our business.
We compete primarily on the basis of the following:
• ability to attract, retain, and engage both merchants and consumers on our Payments Platform;
• ability to demonstrate to merchants that they may achieve incremental sales by using and offering our services to consumers;
• consumer confidence in the safety and security of transactions on our Payments Platform, including the ability for consumers to use our products and services without sharing their financial information with the merchant or any other party they are paying;
• simplicity and transparency of our fee structure;
• ability to develop products and services across multiple commerce channels, including e-commerce, mobile, and payments at the point of sale;
• trust in our dispute resolution and buyer and seller protection programs;
• customer service experience;
• brand recognition and preference;
• website, mobile platform, and application onboarding, ease-of-use, speed, availability, and dependability;
• ability of our Payments Platform to provide support across technologies and payment methods;
• system reliability and data security;
• ability to assist merchants in complying with payments-related laws and regulations;
• ease and quality of integration into third-party mobile applications and operating systems; and
• quality of developer tools, such as our application programming interfaces and software development kits.
We compete against a wide range of businesses with varying roles in all forms of payments, including:
• paper-based transactions (principally cash and checks);
• banks and financial institutions providing traditional payment methods, particularly credit and debit cards (collectively, “payment cards”) and electronic bank transfers;
• payment networks which facilitate payments for credit card users;
• providers of “digital wallets” which offer customers the ability to (i) pay online and/or in-store through a variety of payment methods, including with mobile applications, through contactless payments, with a variety of payment cards, and using direct debit, credit, installments, or other buy now pay later methods and (ii) buy, sell, and hold virtual currencies, such as cryptocurrencies;
• providers of mobile payments solutions that use tokenized card data approaches and contactless payments (e.g., near field communication (“NFC”) or host card emulation functionality) to eliminate the need to swipe or insert a card or enter a personal identification number or password;
• payment-card processors that offer their services to merchants, including for “card on file” payments where the merchant invites the consumer to select a payment method for their first transaction and to use the same payment method for subsequent transactions;
• providers of person-to-person (“P2P”) payments that facilitate individuals sending money using an email address or mobile phone number;
• merchants and merchant associations that may provide proprietary payment networks to facilitate payments within their own retail network;
• providers of money remittance services for transferring money abroad, including those that may provide proprietary payment networks;
• providers of card readers for mobile devices and of other point of sale and multi-channel technologies; and
• providers of virtual currencies and distributed ledger technologies.
68
Table of Contents
We often partner with many of these businesses and we consider the ability to continue establishing these partnerships as important to our business. Competition for relationships with these partners is intense, and there can be no assurance that we will be able to continue to establish, grow, or maintain these partner relationships.
We also face competition and potential competition from:
• services that provide online merchants the option of paying for purchases from their bank account or paying on credit;
• issuers of stored value products targeted at online payments;
• other online and mobile payment-services providers globally;
• services targeting users of social networks and online gaming, including those offering social commerce and P2P payments;
• payment services enabling banking customers to send and receive payments through their bank account, including through immediate or real-time payments systems;
• e-commerce services that provide special offers linked to a specific payment provider;
• services that help merchants and consumers use, accept, buy, sell, and manage virtual currencies; and
• electronic funds transfer services as a method of payment for both online and offline transactions.
Some of our current and potential competitors have larger customer bases, broader geographic scope, volume, scale, resources, and market share than we do, which may provide them significant competitive advantages. Some competitors may also be subject to less burdensome licensing, anti-money laundering, counter-terrorist financing, and other regulatory requirements. They may devote greater resources to the development, promotion, and sale of products and services, and offer lower prices or more effectively offer their own innovative programs, products, and services.
If we are not able to differentiate our products and services from those of our competitors, drive value for our customers, or effectively and efficiently align our resources with our goals and objectives, we may not be able to compete effectively in the market.
Brexit: The United Kingdom’s departure from the EU could adversely affect us.
The United Kingdom (“U.K.”) formally exited the European Union (“EU”) and the European Economic Area (“EEA”) on January 31, 2020 and a transition period is expected to be in place until December 31, 2020 during which time the U.K. will remain in both the EU customs union and single market and follow EU rules, including those extending to EEA states. There is a significant lack of clarity over the terms of the U.K.'s future relationship with the EU, and the international bodies that are linked to it, after this date.
Brexit could therefore contribute to instability in financial, stock, and currency exchange markets, including volatility in the value of the British Pound and Euro, greater restrictions on the supply and availability of goods and services between the U.K. and EEA region, and a general deterioration in consumer sentiment and credit conditions leading to overall negative economic growth and increased risk of merchant default .
In addition, Brexit could lead to legal uncertainty and increased complexity for financial services firms as national laws and regulations in the U.K. start to diverge from EU laws and regulations and new licensing requirements are introduced. In particular, depending on the nature of the U.K.’s future trading relationships with European countries after December 31, 2020, we expect to face new regulatory costs and challenges, including the following:
• if we are unable to utilize certain licenses and authorizations, our European operations could lose their ability to offer services into the U.K. market on a cross-border basis and our U.K.-based operations could lose their ability to offer services on a cross-border basis in the European markets;
• we could be required to obtain additional regulatory permissions to operate in the U.K. market;
• or be required to comply with legal and regulatory requirements in the U.K. that are in addition to, or inconsistent with, those of the EEA, in each case, leading to increased complexity and costs for our European and U.K. operations; and
• our ability to attract and retain the necessary human resources in appropriate locations to support our U.K. and European business could be adversely impacted.
These and other factors related to Brexit could, individually or in the aggregate, have a material adverse impact on our business, financial condition, and results of operations.
69
Table of Contents
Our business is subject to extensive government regulation and oversight. Our failure to comply with extensive, complex, overlapping, and frequently changing rules, regulations, and legal interpretations could materially harm our business.
Our business is subject to laws, rules, regulations, policies, and legal interpretations in the markets in which we operate, including, but not limited to, those governing:
• banking,
• credit,
• deposit taking,
• cross-border and domestic money transmission,
• prepaid access,
• foreign currency exchange,
• privacy,
• data governance,
• data protection,
• cybersecurity,
• banking secrecy,
• fraud detection,
• payment services (including payment processing and settlement services),
• consumer protection,
• antitrust and competition,
• economic and trade sanctions,
• anti-money laundering, and
• counter-terrorist financing.
Our success and increased visibility may result in increased regulatory oversight and enforcement and more restrictive rules and regulations that apply to our business. As we introduce new products and services, or expand our product and service offerings, in U.S. and international markets, we may become subject to additional regulations, restrictions, and licensing requirements. In particular, as we expand and localize our international activities, we have become increasingly obligated to comply with the laws of the markets in which we operate. In addition, because our services are accessible worldwide and we facilitate sales of goods and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws. Laws regulating the internet, mobile, and related technologies outside of the U.S. often impose different, more specific, or even conflicting obligations on us, as well as broader liability. For example, certain transactions that may be permissible in a local jurisdiction may be prohibited by regulations of U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”) or U.S. anti-money laundering or counter-terrorist financing regulations.
Any failure or perceived failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to or expansion of the interpretation of those laws, regulations, or orders), including those discussed in this risk factor, may subject us to significant fines, penalties, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions; result in additional compliance and licensure requirements; cause us to lose existing licenses or prevent or delay us from obtaining additional licenses that may be required for our business; increase regulatory scrutiny of our business; restrict our operations; and force us to change our business practices, make product or operational changes, or delay planned transactions, product launches or improvements. Any of the foregoing could, individually or in the aggregate, harm our reputation, damage our brands and business, and adversely affect our results of operations and financial condition. The complexity of U.S. federal and state and international regulatory and enforcement regimes, coupled with the global scope of our operations and the evolving global regulatory environment, could result in a single event prompting a large number of overlapping investigations and legal and regulatory proceedings by multiple government authorities in different jurisdictions. We have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, but there can be no assurance that our employees, contractors, and agents will not violate such laws and regulations.
70
Table of Contents
Payments Regulation
In the U.S., PayPal, Inc. has obtained licenses to operate as a money transmitter (or its equivalent) in the states where such licenses are required, as well as in the District of Columbia, the U.S. Virgin Islands, and Puerto Rico. These licenses include not only the PayPal branded products and services in these states, but also our Venmo, Hyperwallet and Xoom products and services. As a licensed money transmitter, PayPal is subject to, among other requirements, restrictions with respect to the investment of customer funds, reporting requirements, bonding requirements, and inspection by state regulatory agencies. To the extent they are required, these state licenses also cover PayPal’s service offering enabling customers to buy, hold and sell cryptocurrency directly from their PayPal account, except in the State of New York. PayPal has obtained a conditional Virtual Currency License from the New York Department of Financial Services to launch cryptocurrency services in the state in partnership with Paxos Trust Company. If we violate the laws or regulations covered under these licenses, we could be subject to liability and/or additional restrictions, forced to cease doing business with residents of certain states, forced to change our business practices, or required to obtain additional licenses or regulatory approvals, which could impose substantial costs.
While we currently allow our customers to send payments from approximately 200 markets, we allow customers in only approximately half of those markets (including the U.S.) to also receive payments, in some cases with significant restrictions on the manner in which customers can hold balances or withdraw funds. These limitations may adversely affect our ability to grow our business in these markets.
We principally provide our services to customers in the EU and the U.K. through PayPal (Europe) S.à r.l. et Cie, S.C.A ("PayPal (Europe)"), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg. Accordingly, PayPal (Europe) is potentially subject to significant fines or other enforcement action if it violates the disclosure, reporting, anti-money laundering, capitalization, corporate governance, privacy, data protection, data governance, information security, banking secrecy, taxation, cross-border payment, risk management, sanctions, or other requirements imposed on Luxembourg credit institutions. In addition, EU laws and regulations are subject to potentially inconsistent interpretations by the countries that are members of the EU, which can make compliance more costly and operationally difficult to manage. Moreover, the countries that are EU members may each have different and potentially inconsistent domestic regulations implementing European Directives, which could make compliance more costly and operationally difficult to manage. The Revised Payment Services Directive (“PSD2”) took effect in Europe in 2018, with certain requirements becoming applicable from 2019 or later. PSD2 enables new payment and information sharing models whereby regulated payment providers are able to access bank and payment accounts (including PayPal accounts) for the purposes of accessing account information or initiating a payment on behalf of a customer. Such access could subject us to data security and other legal and financial risks and could create new competitive forces and new types of competitors in the European payments market. PSD2 also imposes new standards for payment security and strong customer authentication (“SCA”) that may make it more difficult and time consuming to carry out transactions on our Payments Platform, which may adversely impact PayPal’s European customer value proposition. In line with an opinion issued by the European Banking Authority (“EBA”), national competent authorities (including Luxembourg) have announced enforcement deferral periods for migration to SCA requirements for e-commerce card-based transactions. PayPal (Europe) has implemented SCA customer processes covering the majority of payment transactions initiated within the EU and has plans to finalize full compliance with SCA; amending or accelerating these plans may adversely impact PayPal’s European customer value proposition.
If the business activities of PayPal (Europe) exceed certain thresholds, or if the European Central Bank (“ECB”) so determines, PayPal (Europe) may be deemed a significant supervised entity such that some activity of PayPal (Europe) could become directly regulated by the ECB, rather than by the CSSF, the Luxembourg regulator, as its national supervisor, which could subject us to additional requirements and would likely increase compliance costs.
In many of the other markets outside the U.S. in which we do business, we serve our customers through PayPal Pte. Ltd., our wholly-owned subsidiary based in Singapore. PayPal Pte. Ltd. is supervised by the Monetary Authority of Singapore (“MAS”), but does not hold a remittance license. As a result, PayPal Pte. Ltd. is not able to offer outbound remittance payments from Singapore, and can only offer payments for the purchase of goods and services in Singapore. In many of the markets (other than Singapore) served by PayPal Pte. Ltd., it is unclear and uncertain whether our Singapore-based service is subject only to Singapore law or, if it is subject to the application of local laws, whether such local laws would require a payment processor like us to be licensed as a payments service, bank, financial institution, or otherwise. The Payment Services Act came into effect in Singapore in January 2020. PayPal Pte. Ltd. is currently operating within a statutory transitional period, and will be required to apply for a license with MAS before January 27, 2021 in order to continue to provide payments services in Singapore. Once PayPal Pte. Ltd. obtains its license, we will be required to comply with new regulatory requirements that will result in increased operational complexity and costs for our Singapore and international operations.
71
Table of Contents
In certain markets outside the U.S. (e.g., Australia), we provide our services to customers through a local subsidiary subject to local regulatory supervision or oversight, which may be the holder of a local payment license, certification, or other authorization. In such markets, we may be subject to significant fines or other enforcement action if we violate applicable reporting, anti-money laundering, capital requirements, privacy, corporate governance, risk management, or any other applicable requirements.
PayPal Australia Pty Limited (“PPAU”) self-reported a potential violation to the Australian Transaction Reports and Analysis Centre (“AUSTRAC”) on May 22, 2019. This self-reported matter relates to PPAU incorrectly filing required international funds transfer instructions over a period of time under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. Please see “Note 13—Commitments and Contingencies—Litigation and Regulatory Matters” for additional disclosure regarding this matter.
From time to time, we may acquire entities subject to local regulatory supervision or oversight. For example, in December 2019, we completed our acquisition of a 70% equity stake in Guofubao Information Technology Co. (GoPay), Ltd. (“GoPay”), a provider of online payment services in China. GoPay holds certain licenses associated with its payments business in China and is subject to regulatory supervision by the People’s Bank of China and other regulatory bodies.
We have been, and expect to continue to be, required to apply for and renew various licenses, certifications, and regulatory approvals in a number of the jurisdictions where we provide our services, including due to changes in applicable laws and regulations or the interpretation of such laws and regulations. There can be no assurance that we will be able to (or decide to) obtain any such licenses, renewals, certifications, and approvals. In addition, there are substantial costs and potential product changes involved in maintaining and renewing such licenses, certifications, and approvals, and we could be subject to fines, other enforcement action, and litigation if we are found to violate disclosure, reporting, anti-money laundering, capitalization, corporate governance, or other requirements of such licenses. These factors could impose substantial additional costs, involve considerable delay to the development or provision of our products or services, require significant and costly operational changes, or prevent us from providing our products or services in a given market.
In many countries, it may not be clear whether we are required to be licensed as a payment services provider, bank, financial institution, or otherwise. In such markets, we may rely on local banks to process payments and conduct foreign currency exchange transactions in local currency. Local regulators may use their authority to slow or halt payments to local merchants conducted through local banks or otherwise prohibit or impede us from doing business in a jurisdiction. Such regulatory actions or the need to obtain licenses, certifications, or other regulatory approvals could impose substantial costs, involve considerable delay to the provision or development of our services, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business and products, or prevent us from providing any products or services in a given market.
State Installment Lending Laws
PayPal’s U.S. consumer short-term installment loan product, launched in October 2020, is subject to state lending laws, some of which require licensure and/or state regulator notification, as well as Regulation B, state collection laws, and other applicable regulations. Changes to state laws and regulatory interpretation may require us to undergo product changes, incur substantial additional costs or cease lending in a particular state. We could be subject to fines, other enforcement action, and litigation if we are found to violate disclosure, reporting, advertising requirements, late fee caps, collections laws or other aspects of installment loan regulations.
Consumer Protection
We are subject to consumer protection, antitrust, and competition-related laws and regulations in the countries in which we operate. In the U.S., we are subject to federal and state consumer protection laws and regulations applicable to our activities, including the Electronic Fund Transfer Act (“EFTA”) and Regulation E as implemented by the Consumer Financial Protection Bureau (“CFPB”). These regulations require us to provide advance disclosure of changes to our services, follow specified error resolution procedures, and reimburse consumers for losses from certain transactions not authorized by the consumer. Additionally, technical violations of consumer protection laws could result in the assessment of actual damages or statutory damages or penalties of up to $1,000 in individual cases or up to $500,000 per violation in any class action and treble damages in some instances; we could also be liable for plaintiffs’ attorneys’ fees in such cases. We are subject to, and have paid amounts in settlement of, lawsuits containing allegations that our business violated the EFTA and Regulation E or otherwise advance claims for relief relating to our business practices (e.g., that we improperly held consumer funds or otherwise improperly limited consumer accounts).
72
Table of Contents
The CFPB issued a final rule on prepaid accounts that came into effect on April 1, 2019. The rule’s definition of prepaid account includes certain accounts that are capable of being loaded with funds and whose primary function is to conduct transactions with multiple, unaffiliated merchants, at ATMs and/or for P2P transfers. That definition includes certain digital wallets. The rule’s requirements include, among other things, the disclosure of fees and other information to the consumer prior to the creation of a prepaid account; the extension of Regulation E liability limits and error-resolution requirements to all prepaid accounts; the application of Regulation Z credit card requirements to prepaid accounts with overdraft and credit features; and the submission of prepaid account agreements to the CFPB and their publication to the general public. We have implemented certain changes to comply with the final rule and made substantial changes to the design of certain U.S. consumer accounts and their operability, which could lead to unintended customer confusion and dissatisfaction, discourage customers from opening new accounts, require us to reallocate resources, and increase our costs, which could negatively affect our business. In December 2019, we filed a lawsuit in the U.S. District Court for the District of Columbia against the CFPB challenging the validity of the prepaid account rule as applied to PayPal, Inc. All written submissions were filed with the court by the September 25, 2020 deadline, and the assigned judge can resolve the matter without a trial at any time. As with any litigation, there is no guarantee that our claims will succeed.
In May 2015, we entered into a Stipulated Final Judgment and Consent Order (“Consent Order”) with the CFPB in which we settled regulatory claims arising from PayPal Credit practices between 2011 and 2015. The Consent Order included obligations of PayPal to pay $15 million in redress to consumers and a $10 million civil monetary penalty, and required PayPal to make various changes to PayPal Credit disclosures and related business practices. We continue to cooperate and engage with the CFPB and work to ensure compliance with the Consent Order, which may result in our incurring additional costs.
PayPal principally offers its services in EEA countries through a “passport” notification process through the Luxembourg regulator (in the case of PayPal (Europe)) to regulators in other EEA member states in accordance with EU regulations. Regulators in these countries could notify us of local consumer protection laws that apply to our business, in addition to Luxembourg consumer protection laws, and could also seek to persuade the local regulator to order PayPal to conduct its activities in the local country directly or through a branch office. Similarly, as a result of Brexit, the U.K. regulators may impose new or different legal requirements on our U.K. business, or require our activities to be conducted locally in the U.K. through a branch office or directly. These or similar actions by these regulators could increase the cost of, or delay, our plans to expand our business in Europe and the U.K.
Privacy and Protection of Customer Data
We are subject to a number of laws, rules, directives, and regulations (which we refer to as “privacy and data protection laws”) relating to the collection, use, retention, security, processing, and transfer (which we collectively refer to as “processing”) of personally identifiable information about our customers, our merchants’ customers, and employees (which we refer to as “personal data”) in the countries where we operate. Our business relies on the processing of personal data in many jurisdictions and the movement of data across national borders. As a result, much of the personal data that we process, which may include certain financial information associated with individuals, is regulated by multiple privacy and data protection laws and, in some cases, the privacy and data protection laws of multiple jurisdictions. In many cases, these laws apply not only to third-party transactions, but also to transfers of information between or among us, our subsidiaries, and other parties with which we have commercial relationships.
Regulatory scrutiny of privacy, data protection, cybersecurity practices, and the processing of personal data is increasing around the world. There is uncertainty associated with the legal and regulatory environment relating to privacy and data protection laws, which continue to develop in ways we cannot predict, including with respect to evolving technologies such as cloud computing, artificial intelligence, and blockchain technology. Any failure or perceived failure to comply with existing or new laws of any government authority (including changes to or expansion of the interpretation of those laws), including those discussed in this risk factor, may subject us to significant fines, penalties, civil lawsuits, and enforcement actions in one or more jurisdictions, result in additional compliance requirements, increase regulatory scrutiny of our business, restrict our operations, and force us to change our business practices, make product or operational changes, or delay planned product launches or improvements.
Any failure, or perceived failure, by us to comply with our privacy policies as communicated to users in one or more jurisdictions could result in proceedings or actions against us by data protection authorities, government entities or others, including class action privacy litigation in certain jurisdictions. Such proceedings or actions could subject us to significant fines, penalties, judgments, and negative publicity which may materially harm our business. The foregoing may require us to change our business practices and would likely increase the costs and complexity of compliance. In addition, compliance with inconsistent privacy and data protection laws may restrict our ability to provide products and services to our customers.
73
Table of Contents
PayPal relies on a variety of compliance methods to transfer personal data of EEA individuals to the U.S., including reliance on Binding Corporate Rules (“BCRs”) for internal transfers of certain types of personal data and Standard Contractual Clauses (“SCCs”) as approved by the European Commission for transfers to and from third parties. PayPal must also ensure that third parties processing personal data of PayPal’s EEA customers and/or employees outside of the EEA have compliant transfer mechanisms. In October 2015, the European Court of Justice (“ECJ”) invalidated U.S.-EU Safe Harbor framework clauses that were previously relied upon by some PayPal vendors to lawfully transfer personal data of EU citizens to U.S. companies, and PayPal entered into SCCs with those third parties which had previously relied on the U.S.-EU Safe Harbor framework. In July 2016, the U.S. and EU authorities agreed on a replacement for the Safe Harbor framework known as “Privacy Shield.” PayPal did not certify under the Privacy Shield regime and continues to use SCCs and BCRs as the primary cross border data transfer mechanisms. In July 2020, the ECJ invalidated the Privacy Shield regime and in September 2020, the Swiss Federal Data Protection and Information Commission invalidated the Swiss-U.S. Privacy Shield framework. In its July 2020 ruling, the ECJ raised several questions regarding the efficacy of SCCs focusing on whether data transfers under SCCs are consistent with EU privacy principles. To the extent PayPal relies on SCCs, or any third party relies on the Privacy Shield regime for the transfer of personal data, PayPal’s ability to process EEA personal data to such parties could be jeopardized.
PayPal is not a bank in the U.S. and relies largely upon third parties to offer loan and other credit products critical to our business, which raises additional risks.
As PayPal is not a chartered financial institution in any state in the U.S., we rely on third-party chartered financial institutions to provide credit products to our customers in the U.S., including consumer credit products such as our PayPal Credit products and PayPal and Venmo branded credit cards, and merchant credit products such as our PayPal Working Capital and PayPal Business Loan products. Any termination or interruption in a partner bank’s ability or willingness to lend could interrupt or limit our ability to offer consumer credit and merchant credit products, which could materially and adversely affect our business. In the event of a partner bank’s inability or unwillingness to lend, we may be unable to reach a similar agreement with another chartered financial institution on favorable terms or at all. Obtaining a bank charter would be a costly, time-consuming and uncertain process, and would subject us to additional laws and regulatory requirements, which could significantly increase our costs and compliance obligations and require us to change our business practices, which could materially and adversely affect our business. In addition, as a service provider to our partner banks, which are federally supervised U.S. financial institutions, we are subject from time to time to examination by their federal banking regulators. PayPal also offers a consumer, short-term installment loan product in the U.S. which exposes us to additional risks, including those discussed in the risk factor captioned " Our business is subject to extensive government regulation and oversight. Our failure to comply with extensive, complex, overlapping, and frequently changing rules, regulations, and legal interpretations could materially harm our business - State Installment Lending Laws" .
In July 2018, we completed the sale of our U.S. consumer credit receivables portfolio to Synchrony Bank, and do not hold an ownership interest in newly generated consumer credit receivables. As a part of a separate agreement, PayPal earns a revenue share on the portfolio of consumer receivables owned by Synchrony Bank, which includes both the sold and newly generated receivables for the PayPal and Venmo branded credit accounts. In the event the overall return on the PayPal branded credit programs funded by Synchrony does not meet a minimum rate of return (“minimum return threshold”) in a particular quarter, our revenue share for that period would be zero. Further, in the event the overall return on the PayPal branded credit programs managed by Synchrony does not meet the minimum return threshold as measured over four consecutive quarters and in the following quarter, we would be required to make a payment to Synchrony, subject to certain limitations. It may take us longer than expected to realize the anticipated benefits of the transaction, and those benefits may ultimately be smaller than anticipated or may not be realized at all, which could adversely affect our business and operating results. In addition, our increased reliance on, and credit exposure to, Synchrony Bank, including in connection with this agreement, subjects us to risks in the nature of those discussed in the “Risk Factors” section of our 2019 Form 10-K under the captions “ We rely on third parties in many aspects of our business, which creates additional risk ” and “ If one or more of our counterparty financial institutions default on their financial or performance obligations to us or fail, we may incur significant losses. ”
74
Table of Contents
In April 2020, PayPal was approved to participate in the U.S. Government’s Paycheck Protection Program (“PPP"”) administered by the U.S. Small Business Administration (“SBA”) and enacted in March 2020 under the Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”). The program is designed to provide a direct incentive for small businesses to keep their workers on payroll during the COVID-19 outbreak and includes initial loan repayment deferrals and debt forgiveness provisions for eligible borrowers. The PPP expired on August 8, 2020, but may be subject to further extension by the U.S. government. Loans made under this program are funded by an independent chartered financial institution that we partner with, and the related receivables are not purchased by PayPal. We receive a fee for providing origination services and loan servicing for these loans and retain operational risk related to those activities. We have agreed to indemnify the chartered financial institution in connection with the services provided for loans made under this program under certain circumstances, including in the event the SBA denies a claim for payment on a loan guaranty or a loan forgiveness payment.
Our credit products expose us to additional risks.
We offer credit products to a wide range of consumers and merchants in various U.S. and international markets. The financial success of these products depends on the effective management of related risk. The credit decision-making process for our consumer credit products uses proprietary segmentation and credit algorithms and other analytical techniques designed to analyze the credit risk of specific consumers based on, among other factors, their past purchase and transaction history with PayPal or Venmo, as well as their credit scores. Similarly, proprietary risk models and other indicators are applied to assess merchants who desire to use our business finance offerings to help predict their ability to repay. These risk models may not accurately predict the creditworthiness of a consumer or merchant due to inaccurate assumptions, including assumptions related to the particular consumer or merchant, market conditions, economic environment, or limited transaction history or other data, among other factors. The accuracy of these risk models and the ability to manage credit risk related to our credit products may also be affected by legal or regulatory requirements, competitors’ actions, changes in consumer behavior, changes in the economic environment, issuing bank policies, and other factors. The international expansion of our credit product offerings expose us to additional risks, including those discussed in the Risk Factors section of our 2019 Form 10-K under the caption “ Our international operations subject us to increased risks, which could harm our business. ”
Like other businesses with significant exposure to losses from consumer and merchant credit, we face the risk that account holders will default on their payment obligations, creating the risk of potential charge-offs. We face similar risks with respect to U.S. consumer credit losses through our profit-sharing arrangement with Synchrony Bank. The non-payment rate among account holders may increase due to, among other factors, changes to underwriting standards, risk models not accurately predicting the creditworthiness of a consumer, worsening economic conditions, such as a recession or government austerity programs, increases in prevailing interest rates, and high unemployment rates. Account holders who miss payments often fail to repay their loans, and account holders who file for protection under the bankruptcy laws generally do not repay their loans.
We currently purchase receivables related to the PayPal branded merchant credit products in the U.S. If we are unable to fund our purchase of these receivables adequately or in a cost-effective manner, or if we are unable to efficiently manage the cash resources utilized for these purposes, our business could be harmed.
Our point of sale solutions expose us to additional risks.
We have several point of sale solutions, which enable merchants to accept payments at a physical point of sale, including solutions with a payments card reader combined with point of sale software and solutions leveraging QR codes and other mobile contactless technology to initiate payments using a mobile device. We have entered into strategic partnerships with major payment card networks to further expand our relationship in a way that will make it easier for merchants to accept and consumers to choose to pay for transactions utilizing credit cards, debit cards, and contactless payments via PayPal at the point of sale. Those partnerships provide us with access to each of these partner's tokenization services for in-store point of sale PayPal transactions, which we expect will increase the number of point of sale transactions that we process. We believe that our iZettle branded and PayPal contactless point of sale solutions will enable us to further expand our in-store presence. As we continue to expand our product and service offerings, including making available additional payment methods at the point of sale, we will face additional risks, including:
• increased expectations from merchants regarding the reliability and availability of our systems and services and correspondingly lower amounts of downtime, which we may not be able to meet;
• increased expectations from merchants that our systems and services will help them to comply with laws and regulations relating to tax, accounting, and bookkeeping, such as cash register systems, which we may not be able to meet;
• significant competition at the point of sale, particularly from established payment card providers, many of which have substantially greater resources than we do, and from other competing sale channels (such as e-commerce);
75
Table of Contents
• increased targeting by fraudsters for a period of time as our fraud models adapt to potential fraudulent activity at the point of sale;
• exposure to product liability claims to the extent that hardware devices (e.g., card readers) that we produce for use at the point of sale malfunction or are not in compliance with laws, which could result in substantial liability and require product recalls or other actions;
• constraints in key resources to develop and maintain point of sale software and ancillary hardware;
• exposure to additional laws, rules, and regulations;
• application of payment card network rules or other agreements with payment card networks with respect to in-store transactions via PayPal;
• increased reliance on third parties involved with processing in-store payments, including independent software providers, electronic point of sale providers, hardware providers (such as card reader, cash drawer, and pin-pad providers), payment processors, and banks that enable in-store transactions; and
• lower operating income than our other payment solutions.
Unless we are able to successfully manage these risks, including driving adoption of, and significant volume through, our point of sale solutions over time, our business may be harmed.
There are risks associated with our relationship with eBay.
In connection with our separation from eBay, we entered into a separation and distribution agreement with eBay, as well as various other agreements, including an operating agreement, a tax matters agreement, an employee matters agreement, an intellectual property matters agreement, a data sharing addendum, and a product development agreement. The separation agreement, the tax matters agreement, the employee matters agreement, and the intellectual property matters agreement determined the allocation of assets and liabilities (including by means of licensing) between the companies following the separation for those respective areas and include associated indemnification obligations. The operating agreement, the data sharing addendum, and the product development agreement established certain commercial relationships between eBay and us related to payment processing, credit, and data sharing. If either we or eBay are unable to satisfy our performance, payment, or indemnification obligations under these agreements, we could incur operational difficulties or losses or be required to make substantial indemnification or other payments to eBay. Disputes between eBay and us have arisen and others may arise in the future. An adverse outcome in any such matters could materially and adversely affect our business, results of operations, and financial condition.
Our operating agreement with eBay entered into at separation had a term of five years that expired in July 2020, and provides for a one-year tail period under that agreement and certain related agreements. The operating agreement defines a number of important elements of our commercial relationship with eBay, as well as certain obligations and restrictions related to PayPal’s provision of services to certain competitive platform operators of eBay (as specified in the operating agreement). While eBay remains a significant source of our revenues and operating income, we expect the portion of our revenue and operating income attributable to eBay will continue to decline due to various factors (many of which are beyond our control), including the speed and extent to which eBay intermediates payments on its platform (including by acting as a merchant of record and migrating eBay merchants to eBay's managed payments platform), limits the availability of PayPal as a payment option or offers (or promotes) alternative payment options, directs transactions on its platforms to different providers of payment services, or eliminates or modifies its risk management or customer protection programs on its platforms, which could result in customer dissatisfaction, reduction in eBay volume, and other consequences adverse to our business. If we are unable to generate sufficient business from our non-eBay customers to offset the expected reduction in the portion of our business attributable to eBay, it could materially impact the growth in our business and our ability to meet our long-term financial targets.
76
Table of Contents
Text extracted from the filing as submitted to EDGAR. Formatting, tables and exhibits are simplified for reading; the original document is authoritative for anything you rely on.