What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-02-10 compared with 2022-02-03 · 250 added, 261 removed, 198 unchanged (72% of the section changed)

You should carefully review this section in addition to the other information appearing in this Form 10-K, including our consolidated financial statements and related notes, for important information regarding risks and uncertainties that affect us.

The risks and uncertainties described below are not the only ones we face.

Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that adversely affect our business.

If any of the following risks actually occur, our business, financial condition, results of operations, and future prospects could be materially and adversely affected.

You should carefully consider the risks and uncertainties described below, in addition to other information appearing in this Form 10-K, including our consolidated financial statements and related notes, for important information regarding risks and uncertainties that could affect us.

These risk factors do not identify all risks we face, and additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that adversely affect our business.

If any of the following risks actually occur, our business, financial condition, results of operations, future prospects, and the trading price of our common stock could be materially and adversely affected.

CYBERSECURITY AND TECHNOLOGY RISKS

Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition.

The techniques used to attempt to obtain unauthorized or illegal access to systems and information (including customers’ personal data), disable or degrade service, exploit vulnerabilities, or sabotage systems are constantly evolving, and in some circumstances may not be recognized or detected until after they have been launched against a target.

Unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems or facilities through various means, including, but not limited to, hacking into our systems or facilities or those of our customers, partners, or vendors, and attempting to fraudulently induce users of our systems (including employees and customers) into disclosing user names, passwords, payment card information, or other sensitive information used to gain access to such systems or facilities.

This information may in turn be used to access our customers’ personal or proprietary information and payment card data that are stored on or accessible through our information technology systems and those of third parties with whom we partner.

Numerous and evolving cybersecurity threats, including advanced and persisting cyberattacks, cyberextortion, distributed denial-of-service attacks, ransomware, spear phishing and social engineering schemes, the introduction of computer viruses or other malware, and the physical destruction of all or portions of our information technology and infrastructure and those of third parties with whom we partner could compromise the confidentiality, availability, and integrity of the data in our systems.

We have experienced from time to time, and may experience in the future, breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities, or other irregularities.

We believe that PayPal is a particularly attractive target for cybercriminals due to our name, brand recognition, types of data (including payments-related data) that customers provide to us, and the widespread adoption and use of our products and services.

In some circumstances, these attempts may not be recognized or detected until after they have been launched against a target.

Unauthorized parties will continue to attempt to gain access to our systems or facilities through various means, including through hacking into our systems or facilities or those of our customers, partners, or vendors, and attempting to fraudulently induce users of our systems (including employees, vendor and partner personnel and customers) into disclosing user names, passwords, payment card information, multi-factor authentication application access or other sensitive information used to gain access to such systems or facilities.

This information may, in turn, be used to access our customers’ confidential personal or proprietary information and financial instrument data that are stored on or accessible through our information technology systems and those of third parties with whom we partner.

This information may also be used to execute fraudulent transactions or otherwise engage in fraudulent actions.

Numerous and evolving cybersecurity threats, including advanced and persisting cyberattacks, cyberextortion, distributed denial-of-service attacks, ransomware, spear phishing and social engineering schemes, the introduction of computer viruses or other malware, and the physical destruction of all or portions of our information technology and infrastructure and those of third parties with whom we partner, are becoming increasingly sophisticated and complex, may be difficult to detect, and could compromise the confidentiality, availability, and integrity of the data in our systems, as well as the systems themselves.

We believe that cybercriminals may target PayPal due to our name, brand recognition, types of data (including sensitive payments- and identity-related data) that customers provide to us, and the widespread adoption and use of our products and services.

We have experienced from time to time, and may experience in the future, breaches of our security measures due to human error, deception, malfeasance, insider threats, system errors, defects, vulnerabilities, or other irregularities.

For example, in November 2017, we suspended the operations of TIO Networks (“TIO”) (acquired in July 2017) as part of an investigation of security vulnerabilities of the TIO platform, and in December 2017, we announced that we had identified evidence of unauthorized access to TIO’s network and the potential compromise of personally identifiable information for approximately 1.6 million TIO customers.

Any cyberattacks or data security breaches affecting the information technology or infrastructure of companies we acquire or of our customers, partners, or vendors (including data center and cloud computing providers) could have similar negative effects.

For example, in November 2017, we suspended the operations of TIO Networks (“TIO”) (acquired in July 2017) as part of an investigation of security vulnerabilities of the TIO platform.

In December 2017, we announced that we had identified evidence of unauthorized access to TIO’s network and the potential compromise of personally identifiable information for approximately 1.6 million TIO customers.

This incident resulted in governmental inquiries and civil claims against us and may lead to additional inquiries and claims in the future.

Under payment card network rules and our contracts with our payment processors, if there is a breach of payment card information that we store, or that is stored by our direct payment card processing vendors, we could be liable to the payment card issuing banks for their cost of issuing new cards and related expenses.

Cybersecurity breaches and other exploited security vulnerabilities could subject us to significant costs and liabilities, result in improper disclosure of data and violations of applicable privacy and other laws, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, damage our reputation and brands, divert the attention of management from the operation of our business, result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses to or claims by them, or expose us to regulatory penalties and fines.

While we maintain insurance policies intended to offset the financial impact we may experience from these risks, our coverage may be insufficient to compensate us for all losses caused by security breaches and other damage to or unavailability of our systems.

Under payment card network rules and our contracts with our payment processors, if there is a breach of payment card information stored by us or our direct payment card processing vendors, we could be liable to the payment card issuing banks, including for their cost of issuing new cards and related expenses.

Cybersecurity breaches and other exploited security vulnerabilities could subject us to significant costs and third-party liabilities, result in improper disclosure of data and violations of applicable privacy and other laws, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, damage our reputation and brands, divert the attention of management from the operation of our business, result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses to or claims by them, or expose us to litigation, regulatory investigations, and significant fines and penalties.

While we maintain insurance policies intended to help offset the financial impact we may experience from these risks, our coverage may be insufficient to compensate us for all losses caused by security breaches and other damage to or unavailability of our systems.

Business interruptions or systems failures may impair the availability of our websites, applications, products or services, or otherwise harm our business.

Our systems and operations and those of our service providers and partners have experienced from time to time, and may experience in the future, business interruptions or degradation because of distributed denial-of-service and other cyberattacks, insider threats, hardware and software defects or malfunctions, human error, earthquakes, hurricanes, floods, fires, and other natural disasters, public health crises (including pandemics), power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks, computer viruses or other malware, or other events.

cyberattacks, insider threats, hardware and software defects or malfunctions, human error, earthquakes, hurricanes, floods, fires, and other natural disasters, public health crises (including pandemics), power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks, computer viruses or other malware, or other events.

The frequency and intensity of weather events related to climate change are increasing, which could increase the likelihood and severity of such disasters as well as related damage and business interruption.

Our corporate headquarters are located in the San Francisco Bay Area, a seismically active region in California.

A catastrophic event that results in a disruption or failure of our systems or operations could result in significant losses and require substantial recovery time and significant expenditures to resume or maintain operations, which could have a material adverse impact on our business, financial condition, and results of operations.

Additionally, some of our systems, including those of companies we have acquired, are not fully redundant, and our disaster recovery planning may not be sufficient for all possible outcomes or events.

As a provider of payments solutions, we are subject to heightened scrutiny by regulators that may require specific business continuity, resiliency and disaster recovery plans, and rigorous testing of such plans, which may be costly and time-consuming to implement, and may divert our resources from other business priorities.

We have experienced, and expect to continue to experience, system failures, cyberattacks, unplanned outages, and other events or conditions from time to time that have and may interrupt the availability, or reduce or adversely affect the speed or functionality, of our products and services.

These events have resulted and likely will continue to result in loss of revenue.

A prolonged interruption in the availability or reduction in the availability, speed, or functionality of our products and services could materially harm our business.

A catastrophic event that could lead to a disruption or failure of our systems or operations could result in significant losses and require substantial recovery time and significant expenditures to resume or maintain operations.

Further, some of our systems, including those of companies that we have acquired, are not fully redundant and any failure of these acquired systems, including due to a catastrophic event, may lead to operational outages or delays.

While we engage in disaster recovery planning and testing intended to mitigate risks from outages or delays, our planning and testing may not be sufficient for all possible outcomes or events.

As a provider of payments solutions, we are also subject to heightened scrutiny by regulators that may require specific business continuity, resiliency and disaster recovery plans, and rigorous testing of such plans, which may be costly and time-consuming to implement, and may divert our resources from other business priorities.

Any of the foregoing risks could have a material adverse impact on our business, financial condition, and results of operations.

A prolonged interruption of, or reduction in, the availability, speed, or functionality of our products and services could materially harm our business.

Frequent or persistent interruptions in our services could permanently harm our relationship with our customers and partners and our reputation.

Moreover, if any system failure or similar event results in damage to our customers or their business partners, they could seek significant compensation or contractual penalties from us for their losses, and those claims, even if unsuccessful, would likely be time-consuming and costly for us to address, and could have other consequences described in this “Risk Factors” section under the caption “ Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition .”

We have undertaken and continue to undertake certain system upgrades and re-platforming efforts designed to improve the availability, reliability, resiliency, and speed of our platform.

These efforts are costly and time-consuming, involve significant technical risk, and may divert our resources from new features and products, and there can be no guarantee that these efforts will be effective.

If any system failure or similar event results in damage to our customers or their business partners, they could seek significant compensation or contractual penalties from us for their losses.

These claims, even if unsuccessful, would likely be time-consuming and costly for us to address.

We continue to undertake system upgrades and re-platforming efforts designed to improve the availability, reliability, resiliency, and speed of our payments platform.

These efforts are costly and time-consuming, involve significant technical complexity and risk, may divert our resources from new features and products, and may ultimately not be effective.

Frequent or persistent site interruptions could lead to regulatory scrutiny, significant fines and penalties, and mandatory and costly changes to our business practices, and ultimately could cause us to lose existing licenses that we need to operate or prevent or delay us from obtaining additional licenses that may be required for our business.

We also rely on facilities, components, applications, and services supplied by third parties, including data center facilities and cloud data storage and processing services.

We also rely on facilities, components, applications, software, and services supplied by third parties, including data center facilities and cloud data storage and processing services.

From time to time, we have experienced interruptions in the provision of such facilities and services provided by these third parties.

If these third parties experience operational interference or disruptions (including a cybersecurity incident), breach their agreements with us, or fail to perform their obligations and meet our expectations, our operations could be disrupted or otherwise negatively affected, which could result in customer dissatisfaction, regulatory scrutiny, and damage to our reputation and brands, and materially and adversely affect our business.

While we maintain insurance policies intended to offset the financial impact we may experience from these risks, our coverage may be insufficient to compensate us for all losses caused by interruptions in our service as a result of systems failures and similar events.

In addition, any failure to successfully implement new information systems and technologies, or improvements or upgrades to existing information systems and technologies in a timely manner could have an adverse impact on our business, internal controls (including internal controls over financial reporting), results of operations, and financial condition.

If these third parties experience operational interference or disruptions (including a cybersecurity incident), fail to perform their obligations, or breach their agreements with us, our operations could be disrupted or otherwise negatively affected, which could result in customer dissatisfaction, regulatory scrutiny, and damage to our reputation and brands, and materially and adversely affect our business.

While we maintain insurance policies intended to help offset the financial impact we may experience from these risks, our coverage may be insufficient to compensate us for all losses caused by interruptions in our service due to systems failures and similar events.

In addition, any failure to successfully implement new information systems and technologies, or improvements or upgrades to existing information systems and technologies in a timely manner could adversely impact our business, internal controls, results of operations, and financial condition.

If we cannot keep pace with rapid technological developments to provide new and innovative products and services, the use of our products and services and, consequently, our revenues, could decline.

Rapid, significant, and disruptive technological changes impact the industries in which we operate, for example, payment technologies (including real-time payments, payment card tokenization, virtual currencies, distributed ledger and blockchain technologies, and proximity payment technology such as Near Field Communication and other contactless payments);

Rapid, significant, and disruptive technological changes impact the industries in which we operate, including payment technologies (including real-time payments, payment card tokenization, virtual currencies, distributed ledger and blockchain technologies, and proximity payment technology such as Near Field Communication and other contactless payments);

internet browser technologies, that enable users to easily store their payment card information for use on any retail or e-commerce website;

2 unchanged sentences

and in-store, digital, and social commerce.

We expect new services and technologies to continue to emerge and evolve.

We cannot predict the effects of technological changes on our business, which technological developments or innovations will become widely adopted, and how those technologies may be regulated.

We expect that new technologies applicable to the industries in which we operate will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services.

We cannot predict the effects of technological changes on our business, which technological developments or innovations will become widely adopted, and how

those technologies may be regulated.

Developing and incorporating new technologies into new and existing products and services may require significant investment, take considerable time, and may not ultimately be successful.

We rely in part on third parties, including some of our competitors, for the development of and access to new or evolving technologies.

These third parties may restrict or prevent our access to, or utilization of, those technologies, as well as their platforms or products.

We expect that new services and technologies applicable to the industries in which we operate will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services.

Developing and incorporating new technologies into our products and services may require significant investment, take considerable time, and ultimately may not be successful.

Our ability to adopt new products and services and to develop new technologies may be limited or restricted by industry-wide standards, platform providers, payments networks, changes to laws and regulations, changing expectations of consumers or merchants, third-party intellectual property rights, and other factors.

Our success will depend on our ability to develop and incorporate new technologies and adapt to technological changes and evolving industry standards.

If we are unable to do so in a timely or cost-effective manner, our business could be harmed.

Our ability to develop, provide or incorporate new technologies and adapt our existing products and services or develop future and new products and services using new technologies may be limited or restricted by industry-wide standards, platform providers, payments networks, changes to laws and regulations, changing customer expectations, third-party intellectual property rights, and other factors.

If we are unable to develop and incorporate new technologies and adapt to technological changes and evolving industry standards in a timely or cost-effective manner, our business could be harmed.

LEGAL, REGULATORY AND COMPLIANCE RISKS

1 unchanged sentence

Our failure to comply with extensive, complex, overlapping, and frequently changing rules, regulations, and legal interpretations could materially harm our business.

Our business is subject to complex and changing laws, rules, regulations, policies, and legal interpretations in the markets in which we offer services directly or through partners, including, but not limited to, those governing:

banking, credit, deposit taking, cross-border and domestic money transmission, prepaid access, foreign currency exchange, privacy, data protection, data governance, cybersecurity, banking secrecy, digital payments, cryptocurrency, payment services (including payment processing and settlement services), fraud detection, consumer protection, antitrust and competition, economic and trade sanctions, anti-money laundering, and counter-terrorist financing.

Regulators globally have been establishing and increasing their regulatory authority, oversight, and enforcement in a manner that impacts our business.

As we introduce new products and services and expand into new markets, including through acquisitions, we expect to become subject to additional regulations, restrictions, and licensing requirements.

As we expand and localize our international activities, we expect that our obligations in the markets in which we operate will continue to increase.

Regulators globally are increasingly exercising regulatory authority, oversight, and enforcement in a manner that impacts our business.

Further, as we introduce new products and services and expand into new markets (including through acquisitions) and expand and localize our international activities, we expect to become subject to additional regulations, restrictions, and licensing requirements.

In addition, because we facilitate sales of goods and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws, which may impose different, more specific, or conflicting obligations on us, as well as broader liability.

Any failure or perceived failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to or expansion of their interpretation) may subject us to significant fines, penalties, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions;

Any failure or alleged failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to their interpretation) may subject us to significant fines and penalties, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions;

result in additional compliance and licensure requirements;

1 unchanged sentence

increase regulatory scrutiny of our business;

divert management’s time and attention from our business;

restrict our operations;

lead to increased friction for customers;

restrict or cease our operations;

force us to make changes to our business practices, products or operations;

lead to increased friction for customers;

require us to engage in remediation activities;

or delay planned transactions, product launches or improvements.

Any of the foregoing could, individually or in the aggregate, harm our reputation, damage our brands and business, and adversely affect our results of operations and financial condition.

The complexity of United States (“U.S.”) federal and state and international regulatory and enforcement regimes, coupled with the global scope of our operations and the evolving global regulatory environment, could result in a single event prompting a large number of overlapping investigations and legal and regulatory proceedings by multiple government authorities in different jurisdictions.

delay planned transactions, product launches or other activities, or divert management’s time and attention from our business.

The complexity of United States (“U.S.”) federal and state and international regulatory and enforcement regimes, coupled with the global scope of our operations and the evolving global regulatory environment, could result in one or more events prompting a large number of overlapping investigations and legal and regulatory proceedings by multiple government authorities in different jurisdictions.

While we have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, there can be no assurance that our employees, contractors, and agents will not violate such laws and regulations.

Any of the foregoing could, individually or in the aggregate, harm our reputation, damage our brands and business, and adversely affect our results of operations and financial condition.

Payments Regulation

1 unchanged sentence

(a wholly-owned subsidiary) holds licenses to operate as a money transmitter (or its equivalent) in the states where such licenses are required, as well as in the District of Columbia and certain territories.

If we violate the laws or regulations covered under our licenses, we could be subject to liability and/or additional restrictions, forced to cease doing business with residents of certain states or territories, forced to change our business practices, or required to obtain additional licenses or regulatory approvals, which could impose substantial costs and harm our business.

If we fail to comply with applicable laws or regulations required to maintain our licenses, we could be subject to liability and/or additional restrictions, forced to cease doing business with residents of certain states or territories, forced to change our business practices, or required to obtain additional licenses or regulatory approvals, which could impose substantial costs and harm our business.

While we currently allow our customers to send payments from approximately 200 markets, we allow customers in only approximately half of those markets (including the U.S.) to also receive payments, in some cases with significant restrictions on the manner in which customers can hold balances or withdraw funds.

These limitations may adversely affect our ability to grow our business.

We principally provide our services to customers in the European Economic Area (“EEA”) and the United Kingdom (“U.K.”) through PayPal (Europe), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg.

PayPal (Europe) is potentially subject to significant fines or other enforcement action if it violates applicable requirements.

These restrictions may limit our ability to grow our business.

Outside of the U.S., we principally provide our services to customers in the European Economic Area (“EEA”) and the United Kingdom (“U.K.”) through PayPal (Europe), our wholly-owned subsidiary that is licensed and subject to regulation as a credit

institution in Luxembourg.

PayPal (Europe) may be subject to enforcement actions and significant fines if it violates applicable requirements.

Additionally, compliance with applicable laws and regulations could become more costly and operationally difficult to manage due to potentially inconsistent interpretations and domestic regulations by various countries in the region.

European regulation, such as the Revised Payment Services Directive (“PSD2”) enabling payment and account information sharing by regulated payment providers, could subject us to data security and other legal and financial risks.

If the business activities of PayPal (Europe) exceed certain thresholds, or if the European Central Bank (“ECB”) determines, PayPal (Europe) may be deemed a significant supervised entity and certain activity of PayPal (Europe) would become directly supervised by the ECB, rather than by the Luxembourg Commission de Surveillance du Secteur Financier, which could subject us to additional requirements and would likely increase compliance costs.

Applicable regulation relating to payments, anti-money laundering and digital services, which are key focus areas of regulators and subject to extensive new regulation, could subject us to additional and complex obligations, risks and associated costs.

If the business activities of PayPal (Europe) exceed certain thresholds, or if the European Central Bank (“ECB”) so determines, PayPal (Europe) may be deemed a significant supervised entity and certain activities of PayPal (Europe) would become directly supervised by the ECB, rather than by the Luxembourg Commission de Surveillance du Secteur Financier, which could subject us to additional requirements and would likely increase compliance costs.

PayPal (Europe) is also subject to regulation by the ECB under the oversight framework for electronic payment instruments, schemes and arrangements (PISA), which may also lead to increased compliance obligations and costs.

In many of the other markets outside the U.S.

1 unchanged sentence

Ltd., our wholly-owned subsidiary based in Singapore.

is supervised by the Monetary Authority of Singapore (“MAS”), but does not hold a remittance license.

As a result, PayPal Pte.

is not able to offer outbound remittance payments to PayPal customers from Singapore.

In many of the markets (other than Singapore) served by PayPal Pte.

Ltd., it is unclear and uncertain whether our Singapore-based service is subject only to Singapore law or, if it is subject to the application of local laws, whether such local laws would require a payment processor like us to be licensed as a payments service, bank, financial institution, or otherwise.

is supervised by the Monetary Authority of Singapore (“MAS”).

The Payment Services Act came into effect in Singapore in January 2020.

has submitted an application for a Major Payment Institution license to the MAS to continue to provide payments services, and is operating under an exemption from holding a license within a statutory transition period while the application is pending.

Once PayPal Pte.

obtains its license, we will be required to comply with new regulatory requirements, which will result in increased operational complexity and costs for our Singapore and international operations.

In addition, in certain markets outside of the U.S., we provide our services to customers through PayPal Pte.

or, if required by local regulations, a local branch of PayPal Pte.

or a local subsidiary subject to local regulatory supervision or oversight.

From time to time, we may also acquire entities subject to local payments regulatory supervision or oversight.

There are substantial costs and potential product and operational changes involved in maintaining and renewing licenses, certifications, and approvals, and we could be subject to fines, other enforcement actions, and litigation if we are found to violate any of these requirements.

There can be no assurance that we will be able to (or decide to) continue to apply for or obtain any licenses, renewals, certifications, and approvals in any jurisdictions.

In certain markets, we may rely on local banks or other partners to process payments and conduct foreign currency exchange transactions in local currency, and local regulators may use their authority over such local partners to prohibit, restrict, or limit us from doing business.

The need to obtain or maintain licenses, certifications, or other regulatory approvals could impose substantial additional costs, delay or preclude planned transactions, product launches or improvements, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, products and services, or prevent us from providing our products or services in a given market.

Cryptocurrency Regulation

Our current and planned cryptocurrency offerings could subject us to additional regulations, licensing requirements, or other obligations.

The rapidly evolving regulatory landscape with respect to cryptocurrency may subject us to inquiries or investigations from regulators and governmental authorities, require us to make product changes, restrict or discontinue product offerings, and implement additional and potentially costly controls.

If we fail to comply with regulations, requirements,

prohibitions or other obligations applicable to us, we could face regulatory or other enforcement actions and potential fines and other consequences.

In addition, financial and third party risks related to our cryptocurrency offerings, such as inappropriate access to or theft or destruction of cryptocurrency assets held by our custodian, insufficient insurance coverage by the custodian to reimburse us for all such losses, the custodian’s failure to maintain effective controls over the custody and settlement services provided to us, the custodian’s inability to purchase or liquidate cryptocurrency holdings, and defaults on financial or performance obligations by counterparty financial institutions, could materially and adversely affect our financial performance and significantly harm our business.

Upon PayPal Pte.

obtaining this license, we will be required to comply with new regulatory requirements, which will result in increased operational complexity and costs for our Singapore and international operations.

In many of the markets outside the U.S.

(other than Singapore) served by PayPal Pte.

or by local branches or subsidiaries subject to local regulatory supervision or oversight, as the case may be, there may be uncertainty whether our Singapore-based service is subject only to Singapore law or also to other local laws, and whether such local laws might require a payment processor like us to be licensed as a payments service, bank, financial institution, or otherwise.

There are substantial costs and potential product and operational changes involved in maintaining and renewing licenses, certifications, and approvals, and we could be subject to enforcement actions, fines, and litigation if we are found to violate any of these requirements.

There can be no assurance that we will be able to (or decide to) continue to apply for or obtain any licenses, renewals, certifications, and approvals in any jurisdiction.

In certain markets, we may need to rely on local banks or other partners to process payments and conduct foreign currency exchange transactions in local currency, and local regulators may use their authority over such local partners to prohibit, restrict, or limit us from doing business.

Any of the foregoing could, individually or in the aggregate, result in substantial additional costs, delay or preclude planned transactions, product launches or improvements, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, products and services, or prevent or limit us from providing our products or services in a given market.

Cryptocurrency Regulation and Related Risks

Our current and planned customer cryptocurrency offerings could subject us to additional regulations, licensing requirements, or other obligations.

Within the U.S., we are regulated by the New York Department of Financial Services as a virtual currency business, which does not qualify us to engage in securities brokerage or dealing activities.

The regulatory status of particular cryptocurrencies is unclear under existing law.

For example, if the SEC were to assert that any of the cryptocurrencies we support are securities, the SEC could assert that our activities involving that cryptocurrency require securities broker-dealer registration or other obligations under the federal securities laws.

The rapidly evolving regulatory landscape with respect to cryptocurrency may subject us to additional licensing and regulatory obligations or to inquiries or investigations from the SEC, other regulators and governmental authorities, and require us to make product changes, restrict or discontinue product offerings, implement additional and potentially costly controls, or take other actions.

If we fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, we could face regulatory or other enforcement actions, potential fines, and other consequences.

We hold our customers’ cryptocurrency assets through a third-party custodian.

Financial and third-party risks related to our customer cryptocurrency offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodian, insufficient insurance coverage by the custodian to reimburse us for all such losses, the custodian’s failure to maintain effective controls over the custody and settlement services provided to us, the custodian’s inability to purchase or liquidate cryptocurrency holdings, and defaults on financial or performance obligations by the custodian, or counterparty financial institutions, could expose our customers and us to loss, and therefore significantly harm our business, financial performance, and reputation.

We have selected a custodian partner, and may in the future select additional custodian partners, that are subject to regulatory oversight, capital requirements, maintenance of audit and compliance industry certifications, and cybersecurity procedures and policies.

Nevertheless, operational disruptions at any such custodian, or such custodian’s failure to safeguard cryptocurrency holdings could result in losses of customer assets, expose us to customer claims, reduce consumer confidence and materially impact our operating results and our cryptocurrency product offerings.

Custodial arrangements to safeguard cryptocurrency assets involve unique risks and uncertainties in the event of the custodian’s bankruptcy.

While other types of assets and some custodied cryptocurrencies have been deemed not to be part of the custodian’s bankruptcy estate under various regulatory regimes, bankruptcy courts have not yet definitively determined the appropriate treatment of custodial holdings of digital assets in a bankruptcy proceeding.

In the event of our custodian’s bankruptcy, the lack of precedent and the highly fact-dependent nature of the determination could delay or preclude the return of custodied cryptocurrency assets to us or to our customers.

Although, we contractually require our custodian to segregate our customer assets and not commingle them with proprietary or other assets, we cannot be certain that these contractual obligations, even if duly observed by the custodian, will be effective in preventing such assets from being treated as part of the custodian’s estate under bankruptcy or other insolvency law.

In that event, our claim on behalf of such customers against the custodian’s estate for our customers’ cryptocurrency assets could be treated as a general unsecured claim against the custodian, in which case our customers could seek to hold us liable for any resulting losses.

In addition, our cryptocurrency product offerings could have the effect of heightening or exacerbating many of the risk factors described in this “Risk Factors” section.

Lending Regulation

2 unchanged sentences

consumer short-term installment loan product, which is subject to federal and state laws governing consumer credit and debt collection.

While our non-U.S.

consumer short-term installment loan products which are available in the U.K., France, Germany, Spain, Italy and Australia are generally exempt from primary consumer credit legislation, certain consumer lending laws, consumer protection or banking transparency regulations continue to apply to these products.

We could be subject to fines, other enforcement action, and litigation if we are found to violate any aspects of applicable law or regulations.

While the consumer short-term installment loan products that we offer outside the U.S.

are generally exempt from primary consumer credit legislation, certain consumer lending laws, consumer protection or banking transparency regulations continue to apply to these products.

Increased global regulatory focus on short-term installment products and consumer credit more broadly could result in laws or regulations requiring changes to our policies, procedures, operations, and product offerings, and restrict or limit our ability to offer credit products, and we could be subject to enforcement action, fines, and litigation if we are found to violate any aspects of applicable law or regulations.

Consumer Protection

1 unchanged sentence

We are subject to, and have paid amounts in settlement of, lawsuits containing allegations that our business violated the EFTA and Regulation E or otherwise advance claims for relief relating to our business practices (e.g., that we improperly held consumer funds or otherwise improperly limited consumer accounts).

In October 2021, the CFPB issued an order pursuant to its market-monitoring authority requiring us to provide extensive information on our payment products, including with respect to the collection, use of, and access to data and consumer protections, among other items.

In December 2021, the CFPB issued a separate order pursuant to its market-monitoring authority requiring us to provide information on our Buy Now, Pay Later offerings.

PayPal principally offers its services in the EEA countries through a “passport” notification process through PayPal Europe's Luxembourg regulator to regulators in other EEA member states in accordance with EU regulations, as well as in the UK through the Temporary Permissions Regime.

Regulators in these countries could notify us of and seek to enforce local consumer protection laws that apply to our business, in addition to Luxembourg consumer protection laws, and could also seek to persuade the local regulator to order PayPal to conduct its activities in the local country directly or through a branch office.

These or similar actions by these regulators could increase the cost of, or delay, our ability to expand our business in Europe.

In addition, the CFPB, pursuant to its market-monitoring authority, may require us to provide extensive information on our products and offerings from time to time.

In 2021, we received separate orders from the CFPB pursuant to such market-monitoring authority requiring us to provide, among other items, extensive information on our payment products, including with respect to the collection, use of, and access to data and consumer protections, as well as our Buy Now, Pay Later offerings.

PayPal principally offers its services in the EEA countries through a “passport” notification process through PayPal (Europe)’s Luxembourg regulator to regulators in other EEA member states in accordance with European Union (“EU”) regulations, as well as in the U.K.

through the Temporary Permissions Regime.

Regulators in these countries could notify us of and seek to enforce local consumer protection laws that apply to our business, in addition to Luxembourg consumer protection laws, or seek to persuade the local regulator to order PayPal to conduct its activities in the local country directly or through a branch office.

These or similar actions by these regulators could impose additional obligations and costs and impact our ability to expand our business in Europe and the U.K.

Anti-Money Laundering and Counter-Terrorist Financing;

Economic and Trade Sanctions

Regulators in the U.S.

and around the world continue to increase standards and expectations regarding anti-money laundering and counter-terrorist financing, and to expand the scope of existing laws and regulations to emerging products and markets, which may require us to further revise or expand our compliance program globally and/or in specific jurisdictions, including the procedures we use to verify the identity of our customers and to monitor international and domestic transactions.

Regulators globally continue to increase standards and expectations regarding anti-money laundering and counter-terrorist financing, and to expand the scope of existing laws and regulations to emerging products and markets, which may require us to further revise or expand our compliance program globally and/or in specific jurisdictions, including the procedures we use to

verify the identity of our customers and to monitor international and domestic transactions.

Such changes could have the effect of making compliance more costly and operationally difficult to manage, lead to increased friction for customers, and result in a decrease in business.

Regulators regularly re-examine the transaction volume thresholds at which we must obtain and keep applicable records or verify identities of customers and any change in such thresholds could result in greater compliance costs and impact our business.

In addition, we are required to comply with economic and trade sanctions administered by the U.S., the EU, relevant EU member states, and other jurisdictions in which we operate.

Regulators regularly re-examine the transaction volume thresholds at which we must obtain and keep applicable records or the circumstances in which we must verify identities of customers, and any change to such obligations could result in greater compliance costs and impact our business.

We are also required to comply with economic and trade sanctions administered by the U.S., the EU and its member states, the U.K., and other jurisdictions in which we operate.

Non-compliance with anti-money laundering laws and regulations or economic and trade sanctions may subject us to significant fines, penalties, lawsuits, and enforcement actions, result in regulatory sanctions and additional compliance requirements, increase regulatory scrutiny of our business, restrict our operations, and damage our reputation and brands.

See “Note 13—Commitments and Contingencies” to our consolidated financial statements for disclosure relating to possible violations arising from our sanctions compliance program.

Our compliance history may be considered by OFAC and other regulators as part of any potential future investigation of our sanctions regulation.

Privacy and Protection of Customer Data

The legal and regulatory environment relating to privacy and data protection laws continues to develop and evolve in ways we cannot predict, including with respect to technologies such as cloud computing, artificial intelligence, cryptocurrency, and blockchain technology.

Any failure, or perceived failure, by us to comply with our privacy policies as communicated to customers or with privacy and data protection laws could result in proceedings or actions against us by data protection authorities, government entities, or others.

Such proceedings or actions could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, result in reputational harm, and materially harm our business.

In addition, compliance with inconsistent privacy and data protection laws may restrict or limit our ability to provide products and services to our customers.

Any failure or alleged failure by us to comply with our privacy policies as communicated to customers or with privacy and data protection laws could result in proceedings or actions against us by data protection authorities, other government agencies, or others, which could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, result in reputational harm, and materially harm our business.

Compliance with inconsistent privacy and data protection laws may also restrict or limit our ability to provide products and services to our customers.

PayPal relies on a variety of compliance methods to transfer personal data of EEA individuals to the U.S., including Binding Corporate Rules for internal transfers of certain types of personal data and Standard Contractual Clauses (“SCCs”) as approved by the European Commission for transfers to and from third parties.

In June 2021, the European Commission imposed new SCC requirements which impose certain contract and operational requirements on PayPal, its merchants, and vendors in order to adhere to certain affirmative duties, including requirements related to government access transparency, enhanced data subject rights, and broader third party assessments to ensure safeguards necessary to protect personal data exported from PayPal’s EEA customers and/or employees to countries outside the EEA.

To the extent PayPal relies on SCCs, such engagements will require new contractual arrangements under the updated requirements to avoid limitations on PayPal’s ability to process EEA data in countries outside of the EEA.

In the wake of the California Consumer Privacy Act passed in 2018, multiple U.S.

states have adopted or proposed similar legislation to protect consumers in their states.

California passed the Consumer Privacy Rights Act of 2020, and Virginia and Colorado have passed similar privacy and data protection laws.

The continued increase in state-level privacy laws is likely to result in a disparate array of privacy rules with unaligned or conflicting provisions, accountability requirements, individual rights, and state enforcement powers and may subject us to increased regulatory scrutiny and business costs, and lead to unintended consumer confusion.

In June 2021, the European Commission imposed new SCC requirements which impose certain contract and operational requirements on PayPal, its merchants, and vendors to adhere to certain affirmative duties, including requirements related to government access transparency, enhanced data subject rights, and broader third-party assessments to ensure safeguards necessary to protect personal data exported from PayPal’s EEA customers and/or employees to countries outside the EEA.

To the extent we rely on SCCs, we will potentially need to enter into new contractual arrangements reflecting the updated SCC requirements to avoid limitations on PayPal’s ability to process EEA data in countries outside of the EEA.

Many jurisdictions in which we operate globally have enacted, or are in the process of enacting, data privacy legislation or regulations aimed at creating and enhancing individual privacy rights.

For example, numerous U.S.

states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and retention of their residents’ personal information.

The continued proliferation of privacy laws in the jurisdictions in which we operate is likely to result in a disparate array of privacy rules with unaligned or conflicting provisions, accountability requirements, individual rights, and national or local enforcement powers, which may subject us to increased regulatory scrutiny and business costs, and could lead to unintended consumer confusion.

We are subject to regulatory scrutiny and may be subject to legal proceedings under antitrust and competition laws.

2 unchanged sentences

Some jurisdictions also provide private rights of action for competitors or consumers to assert claims of anticompetitive conduct.

Other companies and government agencies have in the past and may in the future allege that our actions violate the antitrust or competition laws of the U.S., individual states, other countries, or the EU, or otherwise constitute unfair competition.

Some regulators and legislators, particularly those outside of the U.S., may perceive that our products and services are used so broadly that otherwise uncontroversial business practices could be deemed anticompetitive.

Any claims or investigations, even if without merit, may be very expensive to defend or respond to, involve negative publicity, and substantial diversion of management time and effort, and could result in reputational harm, significant judgments, fines and remedial actions against us, or require us to change our business practices, make product or operational changes, or delay or preclude planned transactions, product launches or improvements.

Companies and government agencies have in the past alleged, and may in the future allege, that our actions violate the antitrust or competition laws in the U.S.

or other jurisdictions in which we operate or otherwise constitute unfair competition, or that our products and services are used so broadly that otherwise uncontroversial business practices could be deemed anticompetitive.

Any claims or investigations, even if without merit, may be costly to defend or respond to, involve negative publicity, and cause substantial diversion of management’s time and effort, and could result in reputational harm, significant judgments, fines and other remedial actions against us, require us to change our business practices, make product or operational changes, or delay or preclude planned transactions, product launches or improvements.

We are regularly subject to general litigation, regulatory scrutiny, and government inquiries.

We are regularly subject to claims, individual and class action lawsuits, arbitration proceedings, government and regulatory investigations, inquiries, actions or requests, and other proceedings alleging violations of laws, rules, and regulations with respect to competition, antitrust, intellectual property, privacy, data protection, information security, anti-money laundering, counter-terrorist financing, sanctions, anti-bribery, anti-corruption, consumer protection, fraud, accessibility, securities, tax, labor and employment, commercial disputes, services, charitable fundraising, contract disputes, escheatment of unclaimed or abandoned property, product liability, use of our services for illegal purposes, the matters described in “Note 13—Commitments and Contingencies—Litigation and Regulatory Matters—General Matters” to our consolidated financial statements, and other matters.

The number and significance of these disputes and inquiries has increased and is expected to continue to increase as our products, services, and business expand in complexity, scale, scope, and geographic reach, including through acquisitions of businesses and technology.

Investigations and legal proceedings are inherently uncertain, expensive and disruptive to our operations, and could result in substantial payments to satisfy judgments, fines, penalties or settlements, negative publicity, substantial diversion of management time and effort, reputational harm, criminal sanctions, or orders that prevent or limit us from offering certain products or services;

respect to competition, antitrust, intellectual property, privacy, data protection, information security, anti-money laundering, counter-terrorist financing, sanctions, anti-bribery, anti-corruption, consumer protection (including unfair, deceptive, or abusive acts or practices), fraud, accessibility, securities, tax, labor and employment, commercial disputes, services, charitable fundraising, contract disputes, escheatment of unclaimed or abandoned property, product liability, use of our services for illegal purposes, the matters described in “Note 13—Commitments and Contingencies—Litigation and Regulatory Matters—General Matters” to our consolidated financial statements, and other matters.

The number and significance of these disputes and inquiries is expected to continue to increase as our products, services, and business expand in complexity, scale, scope, and geographic reach, including through acquisitions of businesses and technology.

Investigations and legal proceedings are inherently uncertain, expensive and disruptive to our operations, and could result in substantial judgments, fines, penalties or settlements, negative publicity, substantial diversion of management’s time and effort, reputational harm, criminal sanctions, or orders that prevent or limit us from offering certain products or services;

require us to change our business practices in costly ways, develop non-infringing or otherwise altered products or technologies, or pay substantial royalty or licensing fees;

or delay or preclude planned transactions, product launches or improvements.

Determining legal reserves or possible losses from such

matters involves judgment and may not reflect the full range of uncertainties and unpredictable outcomes.

or delay or preclude planned transactions or product launches or improvements.

Determining legal reserves or possible losses from such matters involves significant estimates and judgments and may not reflect the full range of uncertainties and unpredictable outcomes.

We may be exposed to losses in excess of the amount recorded, and such amounts could be material.

2 unchanged sentences

We are frequently subject to litigation based on allegations of infringement or other violations of intellectual property rights.

At any given time, we are typically a defendant in a number of patent lawsuits and subject to intellectual property infringement claims.

Intellectual property infringement claims against us may result from, among other things, our expansion into new business areas, including through acquisitions of businesses and technology, and new or expanded products and services and their convergence with technologies not previously associated with areas related to our business, products, and services.

The ultimate outcome of any allegation or claim is often uncertain and any such claim, with or without merit, may be time-consuming, result in costly litigation, divert management’s time and attention from our business, result in reputational harm, and require us to, among other things, redesign or stop providing our products or services, pay substantial amounts to settle claims or lawsuits, satisfy judgments, or pay substantial royalty or licensing fees.

We may be unable to adequately protect or enforce our intellectual property rights.

The protection of our intellectual property, including our trademarks, copyrights, domain names, trade dress, patents and trade secrets, is important to the success of our business.

Effective intellectual property protection may not be available in every jurisdiction in which we offer our products and services.

Although we have generally taken measures to protect our intellectual property rights, there can be no assurance that we will be successful in protecting or enforcing our rights in every jurisdiction, or that our contractual arrangements will prevent or deter third parties from infringing or misappropriating our intellectual property, or that third parties may independently develop equivalent or superior intellectual property rights.

We may be required to expend significant time and resources to prevent third party infringement and enforce our rights, and we may not be able to discover or determine the extent of any unauthorized use of our proprietary rights.

If we are unable to prevent third parties from using or offering technologies that infringe our patent or trade secret rights, the uniqueness and value of our products and services could be adversely affected.

If we are unable to prevent third parties from adopting, registering, or using trademarks and trade dress that infringe, dilute, or otherwise violate our trademark rights, the value of our brands could be diminished and our business could be adversely affected.

We have licensed in the past, and expect to license in the future, certain of our proprietary rights, such as trademarks or copyrighted material, to others.

Intellectual property infringement claims against us may result from, among other things, our expansion into new business areas, including through acquisitions of businesses and technology, or new or expanded products and services and their convergence with technologies not previously associated with areas related to our business, products, and services.

The ultimate outcome of any allegation or claim is often uncertain and any such claim, with or without merit, may be time-consuming to defend, result in costly litigation, divert management’s time and attention from our business, result in reputational harm, and require us to, among other things, redesign or stop providing our products or services, pay substantial amounts to settle claims or lawsuits, satisfy judgments, or pay substantial royalty or licensing fees.

We may be unable to protect or enforce our intellectual property.

The protection of our proprietary rights, including our trademarks, copyrights, domain names, trade dress, patents and trade secrets, is important to the success of our business.

Effective protection of our proprietary rights may not be available in every jurisdiction in which we offer our products and services.

Although we have generally taken measures to protect our intellectual property, there can be no assurance that we will be successful in protecting or enforcing our rights in every jurisdiction, that our contractual arrangements will prevent or deter third parties from infringing or misappropriating our intellectual property, or that third parties will not independently develop equivalent or superior intellectual property rights.

We may be required to expend significant time and resources to prevent infringement and enforce our rights, and we may be unable to discover or determine the extent of any unauthorized use of our proprietary rights.

If we are unable to prevent third parties from infringing or otherwise violating our proprietary rights, the uniqueness and value of our products and services could be adversely affected, the value of our brands could be diminished, and our business could be adversely affected.

We expect to continue to license in the future certain of our proprietary rights, such as trademarks or copyrighted material, to others.

These licensees may take actions that diminish the value of our proprietary rights or harm our reputation.

Any failure to adequately protect or enforce our intellectual property rights, or significant costs incurred in doing so, could diminish the value of our intangible assets and materially harm our business.

Any failure to adequately protect or enforce our proprietary rights, or significant costs incurred in doing so, could diminish the value of our intangible assets and materially harm our business.

BUSINESS AND OPERATIONS RISKS

The continuing effects of the novel coronavirus (“COVID-19”) pandemic could materially and adversely affect our business, financial condition, and results of operations.

The ultimate extent to which the COVID-19 pandemic impacts our business, financial condition, and results of operations will depend on future developments, which are highly uncertain, difficult to predict, and subject to change, including, but not limited to, the duration, scope, severity, proliferation of variants and increase in the transmissibility of the virus, its impact on the global economy, actions taken to contain or limit the impact of COVID-19, such as the availability of an effective vaccine or treatment, geographic variation in how countries and states are handling the pandemic, and how quickly and to what extent normal economic and operating conditions may potentially resume.

The COVID-19 pandemic has adversely impacted and is likely to further adversely impact the operations of our customers, suppliers, vendors and other business partners, and may adversely impact our results of operations in the future.

Cross-border and domestic commerce may be adversely impacted by measures taken by government authorities and businesses globally to contain and limit the spread of COVID-19, including travel restrictions, border closures, quarantines, shelter in place and lock down orders, mask and social distancing requirements, and business limitations and shutdowns.

To the extent that such mitigation measures remain in place or are reinstated for significant periods of time, they may adversely affect our business, financial condition, and results of operations.

Actions that we have taken or may take in the future intended to assist customers impacted by COVID-19 may negatively impact our results of operations.

In particular, we have experienced and may continue to experience adverse financial impacts from a number of operational factors, including, but not limited to:

increased liability under our buyer protection program or chargebacks on payment cards resulting from merchants’ selling goods or services in advance of the delivery date or experiencing bankruptcy, insolvency or other business interruption;

customer defaults on

payment obligations under PayPal branded credit products;

increased cybersecurity and payment fraud risk;

challenges to the availability and reliability of our products and services;

and supply chain disruptions impacting our business.

While our business has benefited from the shift from in-store shopping and traditional payment methods towards e-commerce and digital payments, to the extent that customer preferences revert to pre-COVID-19 behaviors as the pandemic-related restrictions lessen, our business, financial condition, and results of operations would be adversely impacted.

The significant increase in the number of our employees who are working remotely as a result of the pandemic, and an extended period of remote work arrangements and subsequent reintroduction into the workplace could introduce operational risk, increase cybersecurity risk, strain our business continuity plans, negatively impact productivity, and give rise to claims by employees or otherwise adversely affect our business.

Additionally, COVID-19 could require new or modified processes, procedures, and controls to respond to changes in our business environment.

We may take further actions as may be required by government authorities or that we determine are in the best interests of our employees, customers, and business partners.

There is no certainty that such measures will be sufficient to mitigate the risks posed by COVID-19 or will otherwise be satisfactory to government authorities.

The impacts of COVID-19, individually or collectively, could have a material adverse impact on our business, financial condition, and results of operations and have the effect of heightening or exacerbating many of the other risks described in this “Risk Factors” section.

We face substantial and increasingly intense competition worldwide in the global payments industry.

The global payments industry is highly competitive, continuously changing, highly innovative, and increasingly subject to regulatory scrutiny and oversight.

The global payments industry is highly competitive, dynamic, highly innovative, and increasingly subject to regulatory scrutiny and oversight.

Many of the areas in which we compete evolve rapidly with innovative and disruptive technologies, shifting user preferences and needs, price sensitivity of merchants and consumers, and frequent introductions of new products and services.

1 unchanged sentence

We compete with a wide range of businesses in every aspect of our business.

Some of our current and potential competitors are larger than we are, have larger customer bases, greater brand recognition, longer operating histories, a dominant or more secure position, broader geographic scope, volume, scale, resources, and market share than we do, or offer products and services that we do not offer.

Other competitors are smaller or younger companies that may be more agile in responding quickly to regulatory and technological changes.

Some of our current and potential competitors are or may be larger than we are, have larger customer bases, greater brand recognition, longer operating histories, a dominant or more secure position, broader geographic scope, volume, scale, resources, and market share than we do, or offer products and

services that we do not offer.

Other competitors are or may be smaller or younger companies that may be more agile in responding to regulatory and technological changes and customer preferences.

Our competitors may devote greater resources to the development, promotion, and sale of products and services, and/or offer lower prices or more effectively offer their own innovative programs, products, and services.

We often partner with many of these businesses and we consider the ability to continue establishing these partnerships to be important to our business.

We often partner with other businesses, and the ability to continue establishing these partnerships is important to our business.

Competition for relationships with these partners is intense, and there can be no assurance that we will be able to continue to establish, grow, or maintain these partner relationships.

If we are not able to differentiate our products and services from those of our competitors, drive value for our customers, or effectively and efficiently align our resources with our goals and objectives, we may not be able to compete effectively.

If we are unable to differentiate our products and services from those of our competitors, drive value for our customers, or effectively and efficiently align our resources with our goals and objectives, we may not be able to compete effectively.

Business—Competition” of this Form 10-K for further discussion of the competitive environment in the markets where we operate.

4 unchanged sentences

Certain networks have also imposed special fees or assessments for transactions that are executed through a digital wallet such as the one that PayPal offers.

Our payment processors may have the right to pass any increases in fees and assessments on to us as well as increase their own fees for processing.

Our payment processors may have the right to pass any increases in fees and assessments on to us and to increase their own fees for processing.

Any increase in interchange fees, special fees, or assessments for transactions that we pay to the networks or our payment processors could make our pricing less competitive, increase our operating costs, and reduce our operating income, which could materially harm our business, financial condition, and results of operations.

In some jurisdictions, government regulations have required the payment card networks to reduce or cap interchange fees.

In some jurisdictions, government regulations have required payment card networks to reduce or cap interchange fees.

Any changes in interchange fee rates or limitations, or their applicability to PayPal, could adversely affect our competitive position against payment card service providers and the revenue we earn from our branded card programs, require us to change our business practices, and harm our business.

We may also be subject to fines assessed by the networks resulting from any rule violations by us or our merchants.

The networks set and interpret their rules and have alleged from time to time that various aspects of our business model violate these operating rules.

Such allegations may result in significant fines and penalties or require changes in our business practices that may be costly and adversely affect our business.

The network rules may also increase the cost of, impose restrictions on, or otherwise impact the development of, our products which may negatively affect their deployment and adoption.

The networks could adopt new operating rules or interpret or re-interpret existing rules that we or our payment processors might find difficult or even impossible to follow, or costly to implement, which could require us to make significant changes to our products.

If we become unable or limited in our ability to accept certain payment types such as debit or credit cards, our business would be adversely affected.

We may also be subject to fines and other penalties assessed by networks resulting from any rule violations by us or our merchants.

The networks set and interpret their rules and have alleged from time to time that various aspects of our business model violate these rules.

Such allegations may result in significant fines, penalties, damages, or other liabilities or require changes in our business practices that may be costly and adversely affect our business, results of operations and financial condition.

The network rules may also increase the cost of, impose restrictions on, or otherwise impact the development of, our products which may negatively affect product deployment and adoption.

The networks could adopt new operating rules or interpret or re-interpret existing rules that we or our payment processors might find difficult or impractical to follow, or costly to implement, which could require us to make significant changes to our products, increase our operational costs, and negatively impact our business.

If we become unable or limited in our ability to accept certain payment types such as debit or credit cards, our business would be materially and adversely affected.

Changes in how consumers fund their PayPal transactions could harm our business.

2 unchanged sentences

Although we provide consumers in certain markets with the opportunity to use their existing PayPal account balance or Venmo account balance to fund payment transactions, some of our consumers may prefer to use payment cards, which may offer features and benefits not provided as part of their PayPal accounts.

An increase in the portion of our payment volume funded using payment cards or in fees associated with our funding mix, or other events or developments that make it more difficult or costly for us to fund transactions with lower-cost funding options, could materially and adversely affect our financial performance and significantly harm our business.

Any increase in the portion of our payment volume funded using payment cards or in fees associated with our funding mix, or other events or developments that make it more difficult or costly for us to fund transactions with lower-cost funding options, could materially and adversely affect our financial performance and significantly harm our business.

Our ability to receive the benefit of U.S.

merchant financing offerings may be subject to challenge.

merchant financing offerings and certain U.S.

installment loan products may be subject to challenge.

Merchant loans under our U.S.

PayPal Working Capital (“PPWC”) and PayPal Business Loan (“PPBL”) products are provided by a state chartered industrial bank under a program agreement with us, and we acquire the receivables generated by those loans after origination.

In June 2020, largely in response to the Madden v.

Midland Funding, LLC case decided in the U.S.

Court of Appeals for the Second Circuit, the Federal Deposit Insurance Corporation (“FDIC”) approved a final rule clarifying that loans originated by state-chartered non-member banks remain valid throughout the lifetime of the loan, reflecting a similar rule finalized by the Office of the Comptroller of Currency (“OCC”) in May 2020.

The final rule reaffirms and codifies in regulation the so-called “valid-when-made doctrine,” which provides that the interest rate for a loan is determined when the loan is made and will not be affected by subsequent events such as sale, assignment, or other transfer.

A number of state attorneys general have challenged these FDIC and OCC rules, and there remains some uncertainty whether non-bank entities purchasing loan receivables originated by FDIC-insured, state chartered industrial banks may rely on federal preemption of state usury laws and other state laws.

PayPal Working Capital (“PPWC”) and PayPal Business Loan (“PPBL”) products and certain U.S.

installment loan products are provided by a state-chartered industrial bank under a program agreement with us, and we acquire the receivables generated by those loans from the state-chartered bank after origination.

In June 2020, the Federal Deposit Insurance Corporation (“FDIC”) approved a final rule clarifying that loans validly originated by state-chartered banks or insured branches of foreign banks remain valid throughout the lifetime of the loan, reflecting a similar rule finalized by the Office of the Comptroller of Currency (“OCC”) in May 2020 for nationally chartered banks.

The final rule reaffirms and

codifies the so-called “valid-when-made doctrine,” which provides that the permissibility of an interest rate for a loan is determined when the loan is made and will not be affected by subsequent events such as sale, assignment, or other transfer.

While a number of state attorneys general have unsuccessfully challenged these FDIC and OCC rules, there remains some uncertainty whether non-bank entities purchasing loan receivables originated by FDIC-insured, state-chartered banks may rely on federal preemption of state usury laws and other state laws.

An adverse outcome of these or similar challenges, or changes to applicable laws and regulations or regulatory policy, could materially impact our U.S.

PPWC and PPBL products and our business.

PPWC, PPBL, certain installment products, and our business.

Our credit products expose us to additional risks.

1 unchanged sentence

and various international markets.

The financial success of these products depends on the effective management of related risk.

The financial success of these products depends largely on the effective management of related risk.

The credit decision-making process for our consumer credit products uses proprietary methodologies and credit algorithms and other analytical techniques designed to analyze the credit risk of specific consumers based on, among other factors, their past purchase and transaction history with PayPal or Venmo and their credit scores.

2 unchanged sentences

The accuracy of these risk models and the ability to manage credit risk related to our credit products may also be affected by legal or regulatory requirements, changes in consumer behavior, changes in the economic environment, issuing bank policies, and other factors.

We generally rely on third-party chartered financial institutions to provide PayPal and Venmo branded consumer credit and merchant financing offerings to our U.S.

As a service provider to these third-party chartered financial institutions, which are federally supervised U.S.

We generally rely on the activities and charters of unaffiliated financial institutions to provide PayPal and Venmo branded consumer credit and merchant financing offerings to our U.S.

As a service provider to these unaffiliated financial institutions, which are federally supervised U.S.

financial institutions, we are subject from time to time to examination by their federal banking regulators.

In the event of any termination or interruption in a partner bank’s ability or willingness to lend, our ability to offer consumer credit and merchant financing products could be interrupted or limited, which could materially and adversely affect our business.

We may be unable to reach a similar arrangement with another chartered financial institution on favorable terms or at all.

Obtaining licenses to originate such loans would be a costly, time-consuming and uncertain process, and would subject us to additional laws and regulatory requirements, which could significantly increase our costs and compliance

obligations and require us to change our business practices.

We are subject to the risk that account holders who use our credit products will default on their payment obligations, creating the risk of potential charge-offs or negative impact to revenue share arrangement with Synchrony Bank with respect to our U.S.

We may be unable to reach a similar arrangement with another unaffiliated financial institution on favorable terms or at all.

Obtaining and maintaining the lending licenses required for us to originate such loans ourselves would be a costly, time-consuming and uncertain process, and would subject us to additional laws and regulatory requirements, which could significantly increase our costs and compliance obligations and require us to change our business practices.

We are subject to the risk that account holders who use our credit products will default on their payment obligations, creating the risk of potential charge-offs or negatively impacting the revenue share arrangement with an independent chartered financial institution with respect to our U.S.

consumer credit product.

1 unchanged sentence

Account holders who miss payments often fail to repay their loans, and account holders who file for protection under the bankruptcy laws generally do not repay their loans.

We currently purchase receivables related to our PayPal branded merchant financing offerings in the U.S.

and extend credit for our consumer and merchants products outside the U.S.

We currently purchase receivables related to our U.S.

PayPal-branded merchant financing offerings and certain U.S.

consumer installment loan products and extend credit for our consumer and merchant products outside the U.S.

through our international subsidiaries.

If we are unable to fund our credit products, or the purchase of the receivables related to our merchant financing offerings in the U.S.

adequately or in a cost-effective manner, or if we are unable to efficiently manage the cash resources utilized for these purposes, the growth of our credit products could be negatively impacted.

For information on lending regulations that impact our business, see “ Our business is subject to extensive government regulation and oversight.

Our failure to comply with extensive, complex, overlapping, and frequently changing rules, regulations, and legal interpretations could materially harm our business — Lending Regulation ” in this risk factor section.

If we are unable to fund our credit products or the purchase of the receivables related to our credit products and offerings adequately or in a cost-effective manner, the growth of our credit products could be negatively impacted.

We rely on third parties in many aspects of our business, which creates additional risk.

We rely on third parties in many aspects of our business, including, but not limited to:

networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions;

We rely on third parties in many aspects of our business, including networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions;

unaffiliated third-party lenders to originate our U.S.

1 unchanged sentence

merchant financing, and branded credit card products;

PayPal-branded debit card products issued by an unaffiliated bank;

branded debit card and savings products issued by unaffiliated banks;

cryptocurrency custodial service providers;

1 unchanged sentence

information technology, data center facilities and cloud computing).

These risks include legal, regulatory, information security, reputational, operational, or any other risks inherent in engaging and relying upon a third-party.

If we are unable to effectively manage our third-party relationships, these third parties are unable to meet their obligations to us, or we experience substantial disruptions in these relationships, our operations, results of operations, and financial results could be adversely impacted.

Additionally, while we have policies and procedures for managing these relationships, they inherently involve a lesser degree of control over business operations, governance, and compliance, thereby potentially increasing our financial, legal, reputational, and operational risk.

We are subject to additional risks inherent in engaging and relying upon third-party providers, including legal, regulatory, information security, reputational and operational risks.

We are undertaking efforts to diversify our reliance on a small number of third-party payment processors in various markets.

We are working with our primary payment processor in the U.S.

to facilitate the migration of our arrangements to other payment processors over a transition period in connection with the wind-down of our agreement;

however, if we are unable to timely and efficiently migrate our business to other payment processors or experience disruptions in connection with this transition, our business could be harmed.

If we are unable to effectively manage our third-party relationships, these third parties are unable to

meet their obligations to us, or we experience substantial disruptions in these relationships, our operations, results of operations, and financial results could be adversely impacted.

Additionally, our relationships with third parties inherently involve a lesser degree of control over business operations, governance, and compliance, which potentially increases our financial, legal, reputational, and operational risk.

Any factors that reduce cross-border trade or make such trade more difficult could harm our business.

2 unchanged sentences

In certain markets, cross-border trade represents our primary (and in some instances our only) presence.

Cross-border trade may be negatively impacted by various factors including, but not limited to, foreign currency exchange rate fluctuations and the interpretation and application of laws of multiple jurisdictions in the context of cross-border trade and foreign exchange.

Any factors that increase the costs of cross-border trade for us or our customers or that restrict, delay, or make cross-border trade more difficult or impractical, such as trade policy, higher tariffs, or localization requirements, could reduce our cross-border transactions and volume, negatively impact our revenues and profits, and harm our business.

Failure to deal effectively with fraud, abusive behaviors, bad transactions, and negative customer experiences would increase our loss rate and could negatively impact our business and severely diminish merchant and consumer confidence in and use of our services.

Third parties have attempted, and we expect that they will likely continue to attempt, to abuse access to and misuse our payment services to commit fraud by, among other things, creating fictitious PayPal accounts using stolen or synthetic identities or personal information, making transactions with stolen financial instruments, abusing or misusing our services for financial gain, or fraudulently inducing users of our systems into engaging in bad transactions.

Cross-border trade may be negatively impacted by various factors including foreign currency exchange rate fluctuations, tariffs, trade barriers or restrictions, sanctions, import or export controls, and the interpretation and application of laws of multiple jurisdictions in the context of cross-border trade and foreign exchange.

Any factors that increase the costs of cross-border trade for us or our customers or that restrict, delay, or make cross-border trade more difficult or impractical could reduce our cross-border transactions and volume, negatively impact our revenues and profits, and harm our business.

Failure to deal effectively with fraud, abusive behaviors, bad transactions, and negative customer experiences may increase our loss rate and could negatively impact our business and severely diminish merchant and consumer confidence in and use of our services.

We expect that third parties will continue to attempt to abuse access to and misuse our payments services to commit fraud by, among other things, creating fictitious PayPal accounts using stolen or synthetic identities or personal information, making transactions with stolen financial instruments, abusing or misusing our services for financial gain, or fraudulently inducing users of our systems into engaging in fraudulent transactions.

Due to the nature of PayPal’s digital payments services, third parties may seek to engage in abusive schemes or fraud attacks that are often difficult to detect and may be deployed at a scale that would otherwise not be possible in physical transactions.

Measures to detect and reduce the risk of fraud and abusive behavior are complex, require continuous improvement, and may not be effective in detecting and preventing

fraud, particularly new and continually evolving forms of fraud or in connection with new or expanded product offerings.

If these measures do not succeed, our business could be negatively impacted.

We also incur substantial losses from erroneous transactions and situations where funding instruments used for legitimate transactions are closed or have insufficient funds to satisfy payments, or the payment is made to an unintended recipient in error.

Numerous and evolving fraud schemes and misuse of our payments service could subject us to significant costs and liabilities, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, damage our reputation and brands, divert the attention of management from the operation of our business, and result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses to or claims by them.

Our buyer and seller protection programs are intended to reduce the likelihood of losses for consumers and merchants from fraudulent transactions.

The buyer protection program also, protects consumers if they do not receive the item ordered or if the item received is significantly different from its description.

We incur substantial losses from our buyer and seller protection programs as a result of disputes filed by our customers.

We seek to recover losses from our buyer and seller protection programs from the merchant, but may not be able to fully recover them if the merchant is unwilling or unable to pay, the transaction involves a fraudulent merchant, or the merchant provides sufficient evidence that the item was delivered.

Measures to detect and reduce the risk of fraud and abusive behavior are complex, require continuous improvement, and may not be effective in detecting and preventing fraud, particularly new and continually evolving forms of fraud or in connection with new or expanded product offerings.

If these measures are not effective, our business could be negatively impacted.

Numerous and evolving fraud schemes and misuse of our payments services could subject us to significant costs and liabilities, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, damage our reputation and brands, divert the attention of management from the operation of our business, and result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses or claims.

Our Purchase and Seller Protection Programs (“protection programs”) are intended to reduce the likelihood of losses for consumers and merchants from unauthorized and fraudulent transactions.

The Purchase Protection Program also protects consumers who do not receive the item ordered or who receive an item that is significantly different from its description.

We incur substantial losses from our protection programs as a result of disputes filed by our customers.

We seek to recover losses from our protection programs from the merchant, but may not be able to fully recover our losses (for example, if the merchant is unwilling or unable to pay, the transaction involves a fraudulent merchant, or the merchant provides sufficient evidence that the item was delivered).

In addition, consumers who pay through PayPal or Venmo may have reimbursement rights from their payment card issuer, which in turn will seek recovery from us.

If losses incurred by us related to payment card transactions become excessive, we could lose the ability to accept payment cards for payment, which would negatively impact our business.

Regulators and card networks may also adapt error resolution and chargeback requirements to account for evolving forms of fraud, which could increase PayPal’s exposure to fraud losses and impact the scope of coverage of our buyer and seller protection programs.

Increases in our loss rate, including as a result of changes to the scope of transactions covered by our buyer and seller protection programs, could negatively impact our business.

Increases in our loss rate, including as a result of changes to the scope of transactions covered by our protection programs, could negatively impact our business.

See “Note 13—Commitments and Contingencies—Protection Programs” to our consolidated financial statements.

Failure to effectively monitor and evaluate the financial condition of our merchants may also expose PayPal to losses.

In the event of the bankruptcy, insolvency, business failure, or other business interruption of a merchant that sells goods or services in advance of the date of their delivery or use (e.g., airline, cruise, or concert tickets, custom-made goods, and subscriptions), we could be liable to the buyers of such goods or services, including through our buyer protection program or through chargebacks on payment cards used by customers to fund their payments.

Failure to effectively monitor and evaluate the financial condition of our merchants may expose PayPal to losses.

In the event of the bankruptcy, insolvency, business failure, or other business interruption of a merchant that sells goods or services in advance of the date of their delivery or use (e.g., airline, cruise, or concert tickets, custom-made goods, and subscriptions), we could be liable to the buyers of such goods or services, including through our Purchase Protection Program or through chargebacks on

payment cards used by customers to fund their purchase.

Allowances for transaction losses that we have established may be insufficient to cover incurred losses.

Use of our payments services for illegal activities or improper purposes could harm our business.

Users have attempted, and may attempt in the future, to use our payments platform for illegal activities or improper uses, such as money laundering, terrorist financing, sanctions evasion, illegal online gambling, fraudulent sales of goods or services, illegal telemarketing activities, illegal sales of prescription medications or controlled substances, piracy of software, movies, music, and other copyrighted or trademarked goods (in particular, digital goods), bank fraud, child pornography, human trafficking, prohibited sales of alcoholic beverages or tobacco products, securities fraud, pyramid or ponzi schemes, or the facilitation of other illegal or improper activity.

We expect that users will continue to attempt to use our payments platform for illegal activities or improper uses, including money laundering, terrorist financing, sanctions evasion, illegal online gambling, fraudulent sales of goods or services, illegal telemarketing activities, illegal sales of prescription medications or controlled substances, piracy of software, movies, music, and other copyrighted, trademarked or digital goods, bank fraud, child pornography, human trafficking, prohibited sales of alcoholic beverages or tobacco products, securities fraud, pyramid or Ponzi schemes, or the facilitation of other illegal or improper activity.

Moreover, certain activity that may be legal in one jurisdiction may be illegal in another jurisdiction, and a merchant may be found responsible for intentionally or inadvertently importing or exporting illegal goods, resulting in liability for us.

Owners of intellectual property rights or government authorities may seek to bring legal action against providers of payments solutions, including PayPal, that are peripherally involved in the sale of infringing or allegedly infringing items.

While we invest in measures intended to prevent and detect illegal activities that may occur within our payments platform, these measures require continuous improvement and may not be effective in detecting and preventing illegal activity or improper uses.

Any illegal or improper uses of our payments platform by our users may subject us to claims, individual and class action lawsuits, and government and regulatory requests, inquiries, or investigations that could result in liability, restrict our operations, require us to change our business practices, harm our reputation, increase our costs, and negatively impact our business.

For example, government enforcement or regulatory authorities could seek to impose additional restrictions or liability on us arising from the use of our payments platform for illegal or improper activity, and our failure to detect or prevent such use.

While we invest in measures intended to prevent and detect illegal activities that may occur on our payments platform, these measures require continuous improvement and may not be effective in detecting and preventing illegal activity or improper uses.

Any illegal or improper uses of our payments platform or failure by us to detect or prevent illegal or improper activity by our users may subject us to claims, individual and class action lawsuits, and government and regulatory requests, inquiries, or investigations that could result in liability, restrict our operations, impose additional restrictions or limitations on our business or require us to change our business practices, harm our reputation, increase our costs, and negatively impact our business.

Acquisitions, strategic investments, and other strategic transactions could result in operating difficulties and could harm our business.

We expect to continue to consider and evaluate a wide array of potential strategic transactions as part of our overall business strategy, including, but not limited to, business combinations, acquisitions, and dispositions of certain businesses, technologies, services, products, and other assets;

We expect to continue to consider and evaluate a wide array of potential strategic transactions as part of our overall business strategy, including business combinations, acquisitions, and dispositions of certain businesses, technologies, services, products, and other assets;

strategic investments;

2 unchanged sentences

There can be no assurance that we will be successful in identifying, negotiating, consummating and integrating favorable transaction opportunities.

Strategic transactions may involve additional significant challenges, uncertainties, and risks, including, but not limited to, challenges of integrating new employees, products, systems, technologies, operations, and business cultures;

challenges associated with operating acquired businesses in markets in which we may have limited or no experience;

failure to develop the acquired business adequately;

Strategic transactions may involve additional significant challenges, uncertainties, and risks, including challenges of integrating new employees, products, systems, technologies, operations, and business cultures;

challenges associated with operating acquired businesses in markets or business areas in which we may have limited or no experience;

disruption of our ongoing operations and diversion of our management’s attention;

inadequate data security, cybersecurity and operational and information technology resilience;

inadequate data security, cybersecurity, or operational and information technology resilience;

failure to identify, or our underestimation of, commitments, liabilities, deficiencies and other risks associated with acquired businesses or assets;

potential exposure to new risks associated with acquired businesses and entities, including potential new or increased regulatory oversight and uncertain or evolving legal, regulatory, and compliance requirements;

potential reputational risks that could arise from transactions with, or investments in, companies, particularly those involved in new or developing businesses or industries, which may be subject to uncertain or evolving legal, regulatory, and compliance requirements;

failure of the transaction to advance our business strategy and of its anticipated benefits to materialize;

potential exposure to new or incremental risks associated with acquired businesses and entities, strategic investments and other strategic transactions, including potential new or increased regulatory oversight and uncertain or evolving legal, regulatory, and compliance requirements, particularly with respect to companies in new or developing businesses or industries;

failure of the transaction to advance our business strategy or for its anticipated benefits to materialize;

potential impairment of goodwill or other acquisition-related intangible assets;

and the potential for our acquisitions to result in dilutive issuances of our equity securities or significant additional debt.

Strategic transactions may also heighten many of the risks described in this “Risk Factors” section.

These transactions are inherently risky, may not be successful, and may harm our business, results of operations, and financial condition.

and the potential for our acquisitions to result in dilutive issuances of our equity securities or the incurrence of significant additional debt.

Strategic transactions are inherently risky, may not be successful, and may harm our business, results of operations, and financial condition.

Strategic investments in which we have a minority ownership stake inherently involve a lesser degree of influence over business operations.

We may be dependent on controlling shareholders, management, or other persons or entities who control them and who may have business interests, strategies, or goals that are inconsistent with ours.

Business decisions or other actions or omissions of the controlling shareholders, management, or other persons or entities who control companies in which we invest may adversely affect the value of our investment, result in litigation or regulatory action against us, and damage our reputation and brand.

The success of our strategic investments may be dependent on controlling shareholders, management, or other persons or entities that may have business interests, strategies, or goals that are inconsistent with ours.

Our international operations subject us to increased risks, which could harm our business.

Our international operations generate approximately one-half of our net revenues.

Our international operations, including any expansion in international markets, subject us to significant challenges, uncertainties, and risks, including, but not limited to:

local regulatory, licensing, reporting, and legal obligations;

Our international operations generate roughly one-half of our net revenues.

Our international operations subject us to significant challenges, uncertainties, and risks, including local regulatory, licensing, reporting, and legal obligations;

costs and challenges associated with operating in markets in which we may have limited or no experience, including effectively localizing our products and services and adapting them to local preferences;

difficulties in developing, staffing, and simultaneously managing a large number of varying foreign operations as a result of distance, language, and cultural differences and in light of varying laws, regulations, and customs;

difficulties in developing, staffing, and simultaneously managing

a large number of varying foreign operations as a result of distance, language, and cultural differences and in light of varying laws, regulations, and customs;

differing employment practices and the existence of works councils;

11 unchanged sentences

Any violations of the complex foreign and U.S.

laws, rules and regulations that may apply to our international operations may result in fines, criminal actions, or sanctions against us and, our directors, officers, and employees;

laws, rules and regulations that may apply to our international operations may result in lawsuits, enforcement actions, criminal actions, or sanctions against us and, our directors, officers, and employees;

prohibit or require us to change our business practices;

2 unchanged sentences

These risks are inherent in our international operations, may increase our costs of doing business internationally, and could materially and adversely affect our business.

Global and regional economic conditions could harm our business.

Adverse global and regional economic conditions such as turmoil affecting the banking system or financial markets, including, but not limited to, tightening in the credit markets, extreme volatility or distress in the financial markets (including the fixed income, credit, currency, equity, and commodity markets), higher unemployment, high consumer debt levels, recessionary or inflationary pressures, supply chain issues, reduced consumer confidence or economic activity, government fiscal and tax policies, U.S.

and international trade relationships, agreements, treaties, tariffs and restrictive actions, the inability of a government to enact a budget in a fiscal year, government shutdowns, government austerity programs, and other negative financial news or macroeconomic developments could have a material adverse impact on the demand for our products and services, including a reduction in the volume and size of transactions on our payments platform.

Additionally, any inability to access the capital markets when needed due to volatility or illiquidity in the markets or increased regulatory liquidity and capital requirements may strain our liquidity position.

Such conditions may also expose us to fluctuations in foreign currency exchange rates or interest rates that could materially and adversely affect our financial results.

If our reputation or our brands are damaged, our business and operating results may be harmed.

Our reputation and brands are globally recognized, important to our business, and affect our ability to attract and retain our customers.

There are numerous ways our reputation or brands could be damaged.

We may experience scrutiny or backlash from customers, partners, employees, government entities, media, advocacy groups, and other influencers or stakeholders that disagree with, among other things, our product offering decisions or public policy positions.

Damage to our reputation or our brands may result from, among other things, new features, products, services, operational efforts, or terms of service (or changes to the same), or our decisions regarding user privacy, data practices, or information security.

The proliferation of social media may increase and compound the likelihood, speed, magnitude, and unpredictability of negative brand events.

If our brands or reputation are damaged, our business and operating results may be adversely impacted.

The U.K.’s departure from the EU could harm our business, financial condition, and results of operations.

Following the departure of the U.K.

from the EU and the EEA on January 31, 2020 (commonly referred to as “Brexit”) and the expiration of the transition period on December 31, 2020, there continues to be uncertainty over the practical consequences of Brexit including the potential for Brexit to contribute to long-term instability in financial, stock and currency exchange markets, greater restrictions on the supply and availability of goods and services between the U.K.

and EEA region, and a general deterioration in consumer sentiment and credit conditions leading to overall negative economic growth and increased risk of

merchant default.

from the EU and the EEA on January 31, 2020 (commonly referred to as “Brexit”) and the expiration of the transition period on December 31, 2020, there continues to be uncertainty over the practical consequences of Brexit, including the potential for greater restrictions on the supply and availability of goods and services between the U.K.

and EEA region, and a general deterioration in consumer sentiment and credit conditions leading to overall negative economic growth and increased risk of merchant default.

The consequences of Brexit have brought legal uncertainty and increased complexity for financial services firms, which could continue as national laws and regulations in the U.K.

differ from EU laws and regulations and additional authorization requirements come into effect.

These developments have led and could lead in the future to additional regulatory costs and challenges for us, including, but not limited to, the following:

• PayPal (Europe) operates in the U.K.

within the scope of its passport permissions (as they existed at the end of the transition period) pursuant to the Temporary Permissions Regime pending the grant of new U.K.

authorizations by the U.K.

These developments have led and could lead in the future to additional regulatory costs and challenges for us.

Specifically, PayPal (Europe) currently operates in the U.K.

within the scope of its passport permissions (as they existed at the end of the transition period) pursuant to the Temporary Permissions Regime pending the grant of new authorizations by the U.K.

financial regulators.

If we are unable to obtain the required authorizations before the expiry of the longstop dates set by the U.K.

regulators under the Temporary Permissions Regime, our European operations could lose their ability to offer services into the U.K.

regulators under the Temporary Permissions Regime, our European operations could lose their ability to offer services within the U.K.

market, or into the U.K.

market on a cross-border basis.

• our European operations being required to comply with new legal and regulatory requirements in the U.K.

Our European operations may

also be required to comply with legal and regulatory requirements in the U.K.

that may be in addition to, or inconsistent with, those of the EEA, in each case, leading to increased complexity and costs.

Global and regional economic conditions could harm our business.

Additionally, any inability to access the capital markets when needed due to volatility or illiquidity in the markets and increased regulatory liquidity and capital requirements may strain our liquidity position.

Such conditions may also expose us to fluctuations in foreign currency exchange rates or interest rates that could materially and adversely affect our financial results.

Management's Discussion and Analysis of Financial Condition and Results of Operations – Impact of Foreign Currency Exchange Rates and Liquidity and Capital Resources” and “Item 7A.

Quantitative and Qualitative Disclosures About Market Risk” for additional information on our financial risks.

Real or perceived inaccuracies in our metrics may harm our reputation and negatively affect our business.

Our key metrics are calculated using internal company data based on the activity we measure on our platform and may be compiled from multiple systems, including systems that are organically developed or acquired through business combinations.

Real or perceived inaccuracies in our key metrics may harm our reputation and negatively affect our business.

Our key metrics are calculated using internal company data based on the activity we measure on our payments platform and compiled from multiple systems, including systems that are internally developed or acquired through business combinations.

While the measurement of our key metrics is based on what we believe to be reasonable methodologies and estimates, there are inherent challenges and limitations in measuring our key metrics globally at scale.

The methodologies used to calculate our key metrics require judgment.

We regularly review our processes for calculating these key metrics, and from time to time we may make adjustments to improve their accuracy or relevance.

We regularly review our processes for calculating these key metrics, and from time to time we may make adjustments to improve the accuracy or relevance of our metrics.

For example, we continuously apply models, processes and practices designed to detect and prevent fraudulent account creation on our platforms, and work to improve and enhance those capabilities.

4 unchanged sentences

Environmental, social and governance (“ESG”) issues may have an adverse effect on our business, financial condition and results of operations and damage our reputation.

Customers, investors, employees and other stakeholders are increasingly focused on ESG practices, including our efforts with respect to global talent, cybersecurity, data privacy and protection and climate change.

If we do not adapt to and comply with new laws and regulations or changes to legal or regulatory requirements concerning ESG matters, or fail to meet rapidly evolving investor, industry or stakeholder expectations and standards, or if the Company is perceived to have not responded appropriately to growing concerns with respect to ESG issues, our reputation may be harmed, customers may choose to refrain from using our products and services, and our business or financial condition may be adversely affected.

Customers, investors, employees and other stakeholders are increasingly focused on ESG practices, including with respect to global talent, cybersecurity, data privacy and protection and climate change.

If we do not adapt to and comply with new laws and regulations or changes to legal or regulatory requirements concerning ESG matters, or fail to meet rapidly evolving investor, industry or stakeholder expectations and standards, our reputation may be harmed, customers may choose to refrain from using our products and services, and our business or financial condition may be adversely affected.

Further, we may experience additional scrutiny or backlash from customers, partners, media, government entities, and other stakeholders that disagree if they perceive PayPal to not have responded appropriately with respect to ESG matters.

We specifically recognize the inherent physical climate-related risks wherever business is conducted.

Our primary locations may be vulnerable to the adverse effects of climate change.

For example, California, where our headquarters is located, has historically experienced, and is projected to continue to experience, climate-related events more frequently, including drought, water scarcity, heat waves, wildfires and resultant air quality impacts, and power shutoffs associated with wildfire prevention.

For example, California, where our headquarters are located, has historically experienced, and is projected to continue to experience, climate-related events more frequently, including drought, water scarcity, flooding, heat waves, wildfires and resultant air quality impacts, and power shutoffs associated with wildfire prevention.

These extreme weather conditions may disrupt our business and may cause us to experience additional costs to maintain or resume operations and higher attrition.

3 unchanged sentences

and international jurisdictions.

As part of our currency hedging activities, we enter into transactions involving derivative financial instruments with various financial institutions.

Certain banks and financial institutions are also lenders under our credit facilities.

As part of our foreign currency hedging activities, we regularly enter into transactions involving derivative financial instruments with various financial institutions.

Certain banks and other financial institutions are also lenders under our credit facilities.

We regularly monitor our exposure to counterparty credit risk, and actively manage this exposure to mitigate the associated risk.

Despite these efforts, we may be exposed to the risk of default by, or deteriorating operating results or financial condition or failure of, these counterparty financial institutions.

If one of our counterparties were to become insolvent or file for bankruptcy, our ability to recover losses incurred as a result of default or to access or recover our assets that are deposited, held in accounts with, or otherwise due from, such counterparty may be limited by the counterparty’s liquidity or the applicable laws governing the insolvency or bankruptcy proceedings.

In the event of default or failure of one or more of our counterparties, we could incur significant losses, which could negatively impact our results of operations and financial condition.

Despite these efforts, we may be exposed to the risk of default on obligations by, or deteriorating operating results or financial condition or failure of, these counterparty financial institutions.

If one of our counterparty financial institutions were to become insolvent, placed into receivership, or file for bankruptcy, our ability to recover losses incurred as a result of default or to access or recover our assets that are deposited, held in accounts with, or otherwise due from, such counterparty may be limited due to the insufficiency of the failed institutions’ estate to satisfy all claims in full or the applicable laws or regulations governing the insolvency, bankruptcy, or resolution proceedings.

In the event of default on obligations by, or the failure of, one or more of these counterparties, we could incur significant losses, which could negatively impact our results of operations and financial condition.

There are risks associated with our indebtedness.

1 unchanged sentence

Our ability to pay interest and repay the principal for our indebtedness is dependent upon our ability to manage our business operations and generate sufficient cash flows to service such debt.

Our outstanding indebtedness and any additional indebtedness we incur may have significant consequences, including, without limitation:

requiring us to use a significant portion of our cash flow from operations and other available cash to service our indebtedness, thereby reducing the funds available for other purposes, including capital expenditures, acquisitions, strategic investments, and share repurchases;

reducing our flexibility in planning for or reacting to changes in our business, competition pressures and market conditions;

and limiting our ability to obtain additional financing for working capital, capital expenditures, acquisitions, strategic investments, share repurchases, or other general corporate and other purposes.

Our outstanding indebtedness and any additional indebtedness we incur may have significant consequences, including the need to use a significant portion of our cash flow from operations and other available cash to service our indebtedness, thereby reducing the funds available for other purposes, including capital expenditures, acquisitions, strategic investments, and share repurchases;

the reduction of our flexibility in planning for or reacting to changes in our business, competitive pressures and market conditions;

and limits on our ability to obtain additional financing for working capital, capital expenditures, acquisitions, strategic investments, share repurchases, or other general corporate purposes.

Our revolving credit facilities and the indentures for our senior unsecured notes pursuant to which certain of our outstanding debt securities were issued contain financial and other covenants that restrict or could restrict, among other things, our business and operations.

If we fail to pay amounts due under a debt instrument or breach any of its covenants, the lenders would typically have the right to demand immediate repayment of all borrowings thereunder (subject in certain cases to a grace or cure period).

If we fail to pay amounts due under a debt instrument or breach any of its covenants, the lenders or noteholders would typically have the right to demand immediate repayment of all borrowings thereunder (subject in certain cases to a grace or cure period).

Moreover, any such acceleration and required repayment of, or default in respect of, our indebtedness could, in turn, constitute an event of default under other debt instruments, thereby resulting in the acceleration and required repayment of our indebtedness.

2 unchanged sentences

If our credit ratings are downgraded or other negative action is taken, the interest rates payable by us under our indebtedness may increase, and our ability to obtain additional financing in the future on favorable terms or at all could be adversely affected.

Changes in tax laws, exposure to unanticipated additional tax liabilities, or implementation of record-keeping obligations could have a material adverse effect on our business.

Changes in tax laws, exposure to unanticipated additional tax liabilities, or implementation of reporting or record-keeping obligations could have a material adverse effect on our business.

An increasing number of U.S.

states, the U.S.

federal government, and foreign jurisdictions, as well as international organizations, such as the Organization for Economic Co-operation and Development and the EU Commission, are focused on tax reform and other legislative or regulatory action to increase tax revenue.

Various countries have proposed or enacted digital services taxes.

federal government, and governments of foreign jurisdictions, such as the EU Commission, as well as international organizations, such as the Organization for Economic Co-operation and Development, are focused on tax reform and other legislative or regulatory action to increase tax revenue.

For example, various countries have proposed or enacted digital services taxes.

These actions may materially affect our effective tax rate.

The determination of our worldwide provision for income taxes and other tax liabilities requires estimation and significant judgment, and there are many transactions and calculations where the ultimate tax determination is uncertain.

We are currently undergoing a number of investigations, audits, and reviews by tax authorities in multiple U.S.

15 unchanged sentences

We may be limited in our ability to recruit or hire internationally, including due to restrictive laws or policies on immigration, travel, or availability of visas for skilled workers.

The loss of the services of any of our key personnel, or our inability to attract, hire, develop, motivate and retain key and other highly qualified and diverse talent, whether in a remote or in-office environment, or address the safety, health and productivity of our workforce could harm our overall business and results of operations.

The loss of the services of any of our key personnel, or our inability to attract, hire, develop, motivate and retain key and other highly qualified and diverse talent, whether in a remote or in-office environment, or protect the safety, health and productivity of our workforce could harm our overall business and results of operations.

We are subject to risks associated with information disseminated through our products and services.

We may be subject to claims relating to information disseminated through our online services, including claims alleging defamation, libel, harassment, hate speech, breach of contract, invasion of privacy, negligence, copyright or trademark infringement, or other theories based on the nature and content of the materials disseminated through the services, among other things.

We invest in measures intended to detect and block activities that may occur within our payments platform in violation of our policies.

These measures require continuous improvement and may not be effective in detecting and preventing the exchange of information in violation of our policies.

If these measures are not effective, our business could be negatively impacted.

We invest in measures intended to detect and block activities that may occur on our payments platform in violation of our policies and applicable laws.

These measures require continuous improvement and may not be sufficiently effective in detecting and preventing the exchange of information in violation of our policies and applicable laws.

If these measures are not sufficiently effective, our business could be negatively impacted.

If the laws or regulations that provide protections for online dissemination of information are invalidated or are modified to reduce protections available to us and we become liable for information provided by our customers and carried on our products and services, we could be directly harmed and we may be forced to implement new measures to reduce our exposure, including expending substantial resources or discontinuing certain product or service offerings, which could harm our business.

1 unchanged sentence

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors