Item 1A. Risk Factors
ITEM 1A: RISK FACTORS
We are subject to various risks and uncertainties, which could materially affect our business, results of operations, financial condition, future results, and the trading price of our common stock. You should read carefully the following information together with the information appearing in Part I, Item 1A, Risk Factors in our Annual Report on Form 10-K for the year ended December 31, 2021 as filed with the United States (“U.S.”) Securities and Exchange Commission (“SEC”) on February 3, 2022 (“2021 Form 10-K”). The following information supplements and, to the extent inconsistent, supersedes some of the information appearing in the Risk Factors section of our 2021 Form 10‑K. These risk factors, as well as our condensed consolidated financial statements and notes thereto and the other information appearing in this report, should be reviewed carefully for important information regarding risks that affect us.
LEGAL, REGULATORY AND COMPLIANCE RISKS
Our business is subject to extensive government regulation and oversight. Our failure to comply with extensive, complex, overlapping, and frequently changing rules, regulations, and legal interpretations could materially harm our business.
Our business is subject to complex and changing laws, rules, regulations, policies, and legal interpretations in the markets in which we offer services directly or through partners, including, but not limited to, those governing: banking, credit, deposit taking, cross-border and domestic money transmission, prepaid access, foreign currency exchange, privacy, data protection, data governance, cybersecurity, banking secrecy, digital payments, cryptocurrency, payment services (including payment processing and settlement services), fraud detection, consumer protection, antitrust and competition, economic and trade sanctions, anti-money laundering, and counter-terrorist financing.
Regulators globally have been establishing and increasing their regulatory authority, oversight, and enforcement in a manner that impacts our business. As we introduce new products and services and expand into new markets, including through acquisitions, we expect to become subject to additional regulations, restrictions, and licensing requirements. As we expand and localize our international activities, we expect that our obligations in the markets in which we operate will continue to increase. In addition, because we facilitate sales of goods and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws, which may impose different, more specific, or conflicting obligations on us, as well as broader liability.
Any failure or perceived failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to or expansion of their interpretation) may subject us to significant fines, penalties, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions; result in additional compliance and licensure requirements; cause us to lose existing licenses or prevent or delay us from obtaining additional licenses that may be required for our business; increase regulatory scrutiny of our business; divert management’s time and attention from our business; restrict our operations; lead to increased friction for customers; force us to make changes to our business practices, products, or operations; require us to engage in remediation activities; or delay planned transactions, product launches, or improvements. Any of the foregoing could, individually or in the aggregate, harm our reputation, damage our brands and business, and adversely affect our results of operations and financial condition. The complexity of U.S. federal and state and international regulatory and enforcement regimes, coupled with the global scope of our operations and the evolving global regulatory environment, could result in a single event prompting a large number of overlapping investigations and legal and regulatory proceedings by multiple government authorities in different jurisdictions. While we have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, there can be no assurance that our employees, contractors, and agents will not violate such laws and regulations.
70
Table of Contents
Payments Regulation
In the U.S., PayPal, Inc. (a wholly-owned subsidiary) holds licenses to operate as a money transmitter (or its equivalent) in the states where such licenses are required, as well as in the District of Columbia and certain territories. If we violate the laws or regulations covered under our licenses, we could be subject to liability and/or additional restrictions, forced to cease doing business with residents of certain states or territories, forced to change our business practices, or required to obtain additional licenses or regulatory approvals, which could impose substantial costs and harm our business.
While we currently allow our customers to send payments from approximately 200 markets, we allow customers in only approximately half of those markets (including the U.S.) to also receive payments, in some cases with significant restrictions on the manner in which customers can hold balances or withdraw funds. These limitations may adversely affect our ability to grow our business.
We principally provide our services to customers in the European Economic Area (“EEA”) and the United Kingdom (“U.K.”) through PayPal (Europe), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg. PayPal (Europe) is potentially subject to significant fines or other enforcement action if it violates applicable requirements. Additionally, compliance with applicable laws and regulations could become more costly and operationally difficult to manage due to potentially inconsistent interpretations and domestic regulations by various countries in the region. Applicable regulation relating to payments, anti-money laundering and digital services, all of which are key focus areas of regulators and subject to extensive new regulation, could subject us to additional and complex obligations, risks and associated costs. If the business activities of PayPal (Europe) exceed certain thresholds, or if the European Central Bank (“ECB”) determines, PayPal (Europe) may be deemed a significant supervised entity and certain activity of PayPal (Europe) would become directly supervised by the ECB, rather than by the Luxembourg Commission de Surveillance du Secteur Financier, which could subject us to additional requirements and would likely increase compliance costs. Beginning in 2023, PayPal (Europe) will be overseen jointly by the ECB and Banque Centrale du Luxembourg under the framework for electronic payment instruments, schemes and arrangements (PISA), which may also lead to increased compliance obligations and costs.
Cryptocurrency Regulation and Related Risks
Our current and planned cryptocurrency product offerings could subject us to additional regulations, licensing requirements, and other obligations. We are regulated by the New York Department of Financial Service as a virtual currency business. The rapidly evolving regulatory landscape with respect to cryptocurrency and digital assets may subject us to additional licensing and regulatory obligations, inquiries or investigations from regulators and governmental authorities, require us to make product changes, restrict or discontinue product offerings, and implement additional and potentially costly controls. If we fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, we could face regulatory or other enforcement actions, litigation, potential fines, reputational harm and other consequences.
Financial and third-party risks related to our cryptocurrency product offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodian, insufficient insurance coverage by the custodian to reimburse us for all such losses, the custodian’s failure to maintain effective controls over the custody and settlement services provided to us, the custodian’s inability to purchase or liquidate cryptocurrency holdings, and defaults on financial or performance obligations by the custodian, or other counterparty financial institutions, could significantly harm our business, financial performance, and reputation. While we select custodian partners that are subject to regulatory oversight, capital requirements, maintenance of audit and compliance industry certifications, and cybersecurity procedures and policies, operational disruptions at the custodian, system issues or failure to safeguard cryptocurrency holdings, and any resulting financial losses could reduce consumer confidence and materially impact our operating results and our cryptocurrency product offerings.
The obligations associated with these custodial and other arrangements to safeguard cryptocurrency assets involve unique risks and uncertainties. While other types of assets held in a similar manner have been deemed not to be part of the asset custodian’s bankruptcy estate under various regulatory regimes, bankruptcy courts have not yet considered the appropriate treatment of custodial holdings of digital assets and any such determination may be highly fact-specific. PayPal holds its customers’ cryptocurrency assets through a third-party cryptocurrency asset custodian. Despite PayPal’s efforts to structure our customers’ cryptocurrency asset accounts in a manner that reinforces customer ownership of the cryptocurrency assets, it remains possible that a court would consider such assets as part of the custodian’s bankruptcy estate. In that event, cryptocurrency assets that our custodian holds on behalf of our customers may become subject to bankruptcy proceedings, our claim on behalf of such customers could be treated as a general unsecured claim against the custodian. Moreover, the lack of precedent and the fact-dependent nature of the determination could delay or preclude the return of such cryptocurrency assets to our customers. These and other risks, could adversely impact our cryptocurrency product offerings.
71
Table of Contents
In addition, our cryptocurrency product offerings could have the effect of heightening or exacerbating many of the risk factors described in Item 1A, Risk Factors, in our Annual Report on Form 10-K for the fiscal year ended December 31, 2021, and may adversely affect our business, financial condition, and results of operations.
Privacy and Protection of Customer Data
The legal and regulatory environment relating to privacy and data protection laws continues to evolve in ways we cannot predict, including with respect to technologies such as cloud computing, artificial intelligence, cryptocurrency, and blockchain technology. Any failure, or perceived failure, by us to comply with our privacy policies as communicated to customers or with privacy and data protection laws could result in proceedings or actions against us by data protection authorities, government entities, or others. Such proceedings or actions could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, result in reputational harm, and materially harm our business. In addition, compliance with inconsistent privacy and data protection laws may restrict or limit our ability to provide products and services to our customers.
PayPal relies on a variety of compliance methods to transfer personal data of EEA individuals to the U.S., including Binding Corporate Rules for internal transfers of certain types of personal data and Standard Contractual Clauses (“SCCs”) as approved by the European Commission for transfers to and from third parties. In June 2021, the European Commission imposed new SCC requirements which impose certain contract and operational requirements on PayPal, its merchants, and vendors in order to adhere to certain affirmative duties, including requirements related to government access transparency, enhanced data subject rights, and broader third-party assessments to ensure safeguards necessary to protect personal data exported from PayPal’s EEA customers and/or employees to countries outside the EEA. To the extent PayPal relies on SCCs, we may be required to incur additional costs and take additional steps to legitimize certain cross-border data transfers from the EEA, including new contractual arrangements under the updated requirements to avoid limitations on PayPal’s ability to process EEA data in countries outside of the EEA.
Many jurisdictions in which we operate have adopted, or are in the process of adopting or amending data privacy legislation or regulations aimed at creating and enhancing individual privacy rights. In the U.S., numerous states have enacted, or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and retention of state residents’ personal information, and internationally, many of the markets in which we operate have similarly enacted, or are in the process of enacting or amending similar privacy laws and regulations. The continued proliferation of privacy laws in the jurisdictions in which we operate is likely to result in a disparate array of privacy rules with unaligned or conflicting provisions, accountability requirements, individual rights, and enforcement powers, and may subject us to increased regulatory scrutiny and business costs, and lead to unintended consumer confusion.
BUSINESS AND OPERATIONS RISKS
The continuing effects of the novel coronavirus (“COVID-19”) pandemic could materially and adversely affect our business, financial condition, and results of operations.
The ultimate extent to which the COVID-19 pandemic impacts our business, financial condition, and results of operations will depend on future developments, which are highly uncertain, difficult to predict, and subject to change, including, but not limited to, the duration, scope, severity, proliferation of variants and increase in the transmissibility of the virus, its impact on the global economy, actions taken to contain or limit the impact of COVID-19, such as the availability of an effective vaccine or treatment, geographic variation in how countries and states are handling the pandemic, and how quickly and to what extent normal economic and operating conditions may potentially resume.
72
Table of Contents
The COVID-19 pandemic has adversely impacted the operations of our customers, suppliers, vendors and other business partners, and may adversely impact our results of operations in the future. Cross-border and domestic commerce may be adversely impacted by measures taken by government authorities and businesses globally to contain and limit the spread of COVID-19, including travel restrictions, border closures, quarantines, shelter-in-place and lock-down orders, mask and social distancing requirements, and business limitations and shutdowns. To the extent that such mitigation measures remain in place or are reinstated for significant periods of time, they may adversely affect our business, financial condition, and results of operations. Actions that we have taken or may take in the future intended to assist customers impacted by COVID-19 may negatively impact our results of operations. In particular, we have experienced and may continue to experience adverse financial impacts from a number of operational factors, including, but not limited to: increased liability under our Purchase Protection Program or chargebacks on payment cards resulting from merchants’ selling goods or services in advance of the delivery date or experiencing bankruptcy, insolvency or other business interruption; customer defaults on payment obligations under PayPal branded credit products; increased cybersecurity and payment fraud risk; challenges to the availability and reliability of our products and services; and supply chain disruptions impacting our business.
The significant increase in the number of our employees who are working remotely as a result of the pandemic, and an extended period of remote work arrangements and subsequent reintroduction into the workplace could introduce operational risk, increase cybersecurity risk, strain our business continuity plans, negatively impact productivity, and give rise to claims by employees or otherwise adversely affect our business. Additionally, COVID-19 could require new or modified processes, procedures, and controls to respond to changes in our business environment. We may take further actions as may be required by government authorities or that we determine are in the best interests of our employees, customers, and business partners. There is no certainty that such measures will be sufficient to mitigate the risks posed by COVID-19 or will otherwise be satisfactory to government authorities.
The impacts of COVID-19, individually or collectively, could have a material adverse impact on our business, financial condition, and results of operations and have the effect of heightening or exacerbating many of the other risks described in this “Risk Factors” section.
The conflict between Russia and Ukraine and its related implications could materially and adversely affect our business, financial condition, and results of operations.
In February 2022, Russia commenced military hostilities against Ukraine. In March 2022, we suspended our transactional services in Russia. We have also expanded our services for Ukrainian customers. The potential effects of the conflict between Russia and Ukraine, individually or in the aggregate, could have the effect of heightening or exacerbating many of the risk factors described in Item 1A, Risk Factors, in our Annual Report on Form 10-K for the fiscal year ended December 31, 2021, may adversely affect our business, financial condition and results of operations, and restrict or limit our ability to operate in Russia. These effects could include, but are not limited to, geopolitical instability and uncertainty; adverse impacts on global and regional economic conditions and financial markets, including significant volatility in credit, capital, and currency markets; reduced economic activity; changes in laws and regulations affecting our business, including sanctions targeting Russia and other countries imposed by the U.S. and other countries, counter-sanctions imposed by Russia, and additional sanctions or counter-sanctions which may be enacted; and increased cybersecurity threats and concerns. The ultimate extent to which the conflict between Russia and Ukraine may negatively impact our business, financial condition, and results of operations will depend on future developments, which are highly uncertain, difficult to predict, and subject to change.
73
Table of Contents
Our ability to receive the benefit of U.S. merchant financing and certain U.S. installment loan offerings may be subject to challenge.
Merchant loans under our U.S. PayPal Working Capital (“PPWC”) and PayPal Business Loan (“PPBL”) products and certain U.S. installment loan products are provided by a state-chartered industrial bank under a program agreement with us, and we acquire the receivables generated by those loans after origination. In June 2020, largely in response to the Madden v. Midland Funding, LLC case decided in the U.S. Court of Appeals for the Second Circuit, the Federal Deposit Insurance Corporation (“FDIC”) approved a final rule clarifying that loans originated by state-chartered non-member banks remain valid throughout the lifetime of the loan, reflecting a similar rule finalized by the Office of the Comptroller of Currency (“OCC”) in May 2020. The final rule reaffirms and codifies in regulation the so-called “valid-when-made doctrine,” which provides that the interest rate for a loan is determined when the loan is made and will not be affected by subsequent events such as sale, assignment, or other transfer. A number of state attorneys general have challenged these FDIC and OCC rules, and there remains some uncertainty whether non-bank entities purchasing loan receivables originated by FDIC-insured, state-chartered industrial banks may rely on federal preemption of state usury laws and other state laws. An adverse outcome of these or similar challenges, or changes to applicable laws and regulations or regulatory policy, could materially impact our U.S. PPWC, PPBL, and certain installment products and our business.
Our credit products expose us to additional risks.
We offer credit products to a wide range of consumers and merchants in the U.S. and various international markets. The financial success of these products depends on the effective management of related risk. The credit decision-making process for our consumer credit products uses proprietary methodologies and credit algorithms and other analytical techniques designed to analyze the credit risk of specific consumers based on, among other factors, their past purchase and transaction history with PayPal or Venmo and their credit scores. Similarly, proprietary risk models and other indicators are applied to assess merchants who desire to use our merchant financing offerings to help predict their ability to repay. These risk models may not accurately predict the creditworthiness of a consumer or merchant due to inaccurate assumptions, including those related to the particular consumer or merchant, market conditions, economic environment, or limited transaction history or other data. The accuracy of these risk models and the ability to manage credit risk related to our credit products may also be affected by legal or regulatory requirements, changes in consumer behavior, changes in the economic environment, issuing bank policies, and other factors.
We generally rely on third-party chartered financial institutions to provide PayPal and Venmo branded consumer credit and merchant financing offerings to our U.S. customers. As a service provider to these third-party chartered financial institutions, which are federally supervised U.S. financial institutions, we are subject from time to time to examination by their federal banking regulators. In the event of any termination or interruption in a partner bank’s ability or willingness to lend, our ability to offer consumer credit and merchant financing products could be interrupted or limited, which could materially and adversely affect our business. We may be unable to reach a similar arrangement with another chartered financial institution on favorable terms or at all. Obtaining licenses to originate such loans would be a costly, time-consuming, and uncertain process, and would subject us to additional laws and regulatory requirements, which could significantly increase our costs and compliance obligations and require us to change our business practices.
We are subject to the risk that account holders who use our credit products will default on their payment obligations, creating the risk of potential charge-offs or negative impact to the revenue share arrangement with Synchrony Bank with respect to our U.S. consumer credit product. The non-payment rate among account holders may increase due to, among other factors, changes to underwriting standards, risk models not accurately predicting the creditworthiness of a user, worsening economic conditions, such as a recession or government austerity programs, increases in prevailing interest rates, and high unemployment rates. Account holders who miss payments often fail to repay their loans, and account holders who file for protection under the bankruptcy laws generally do not repay their loans.
We currently purchase receivables related to our PayPal branded merchant financing offerings in the U.S. and certain consumer installment loan products in the U.S., and extend credit for our consumer and merchant products outside the U.S. through our international subsidiaries. If we are unable to fund our credit products, or the purchase of the receivables related to our merchant financing offerings in the U.S. and certain consumer installment loan products in the U.S. adequately or in a cost-effective manner, or if we are unable to efficiently manage the cash resources utilized for these purposes, the growth of our credit products could be negatively impacted.
74
Table of Contents
For information on lending regulations that impact our business, see “ Our business is subject to extensive government regulation and oversight. Our failure to comply with extensive, complex, overlapping, and frequently changing rules, regulations, and legal interpretations could materially harm our business — Lending Regulation ” in the risk factor section of our 2021 Form 10‑K.
We rely on third parties in many aspects of our business, which creates additional risk.
We rely on third parties in many aspects of our business, including, but not limited to: networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions; unaffiliated third-party lenders to originate our U.S. credit products to consumers, U.S. merchant financing, and branded credit card products; PayPal-branded debit card products issued by an unaffiliated bank; cryptocurrency custodial service providers; and external business partners and contractors who provide key functions (e.g., outsourced customer support and product development functions; facilities; information technology, data center facilities and cloud computing). These risks include legal, regulatory, information security, reputational, operational, or any other risks inherent in engaging and relying upon a third party. We are undertaking efforts to diversify our reliance on a small number of third-party payment processors in various markets. We are in ongoing discussions with our primary payment processor in the U.S. concerning a transitional period to facilitate the migration of our arrangements to other payment processors in connection with the wind-down of our agreement. If we are unable to effectively manage our third-party relationships, these third parties are unable to meet their obligations to us, or we experience substantial disruptions in these relationships, our operations, results of operations, and financial results could be adversely impacted. Additionally, while we have policies and procedures for managing these relationships, they inherently involve a lesser degree of control over business operations, governance, and compliance, thereby potentially increasing our financial, legal, reputational, and operational risk.
Text extracted from the filing as submitted to EDGAR. Formatting, tables and exhibits are simplified for reading; the original document is authoritative for anything you rely on.