What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-05-09 compared with 2022-11-04 · 53 added, 123 removed, 27 unchanged (87% of the section changed)

7 unchanged sentences

Our business is subject to complex and changing laws, rules, regulations, policies, and legal interpretations in the markets in which we offer services directly or through partners, including, but not limited to, those governing:

banking, credit, deposit taking, cross-border and domestic money transmission, prepaid access, foreign currency exchange, privacy, data protection, data governance, cybersecurity, banking secrecy, digital payments, cryptocurrency, payment services (including payment processing and settlement services), fraud detection, consumer protection, antitrust and competition, economic and trade sanctions, anti-money laundering, and counter-terrorist financing.

banking, credit, deposit taking, cross-border and domestic money transmission, prepaid access, foreign currency exchange, privacy, data protection, data governance, cybersecurity, banking secrecy, digital payments, cryptocurrency, payment services (including payment processing and settlement services), lending, fraud detection, consumer protection, antitrust and competition, economic and trade sanctions, anti-money laundering, and counter-terrorist financing.

Regulators globally have been establishing and increasing their regulatory authority, oversight, and enforcement in a manner that impacts our business.

16 unchanged sentences

While we have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, there can be no assurance that our employees, contractors, and agents will not violate such laws and regulations.

Payments Regulation

In the U.S., PayPal, Inc.

(a wholly-owned subsidiary) holds licenses to operate as a money transmitter (or its equivalent) in the states where such licenses are required, as well as in the District of Columbia and certain territories.

If we violate the laws or regulations covered under our licenses, we could be subject to liability and/or additional restrictions, forced to cease doing business with residents of certain states or territories, forced to change our business practices, or required to obtain additional licenses or regulatory approvals, which could impose substantial costs and harm our business.

While we currently allow our customers to send payments from approximately 200 markets, we allow customers in only approximately half of those markets (including the U.S.) to also receive payments, in some cases with significant restrictions on the manner in which customers can hold balances or withdraw funds.

These limitations may adversely affect our ability to grow our business.

We principally provide our services to customers in the European Economic Area (“EEA”) and the United Kingdom (“U.K.”) through PayPal (Europe), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg.

PayPal (Europe) is potentially subject to significant fines or other enforcement action if it violates applicable requirements.

Additionally, compliance with applicable laws and regulations could become more costly and operationally difficult to manage due to potentially inconsistent interpretations and domestic regulations by various countries in the region.

Applicable regulation relating to payments, anti-money laundering and digital services, all of which are key focus areas of regulators and subject to extensive new regulation, could subject us to additional and complex obligations, risks and associated costs.

If the business activities of PayPal (Europe) exceed certain thresholds, or if the European Central Bank (“ECB”) determines, PayPal (Europe) may be deemed a significant supervised entity and certain activity of PayPal (Europe) would become directly supervised by the ECB, rather than by the Luxembourg Commission de Surveillance du Secteur Financier, which could subject us to additional requirements and would likely increase compliance costs.

Beginning in 2023, PayPal (Europe) will be overseen jointly by the ECB and Banque Centrale du Luxembourg under the framework for electronic payment instruments, schemes and arrangements (PISA), which may also lead to increased compliance obligations and costs.

Cryptocurrency Regulation and Related Risks

Our current and planned cryptocurrency product offerings could subject us to additional regulations, licensing requirements, and other obligations.

We are regulated by the New York Department of Financial Service as a virtual currency business.

The rapidly evolving regulatory landscape with respect to cryptocurrency and digital assets may subject us to additional licensing and regulatory obligations, inquiries or investigations from regulators and governmental authorities, require us to make product changes, restrict or discontinue product offerings, and implement additional and potentially costly controls.

If we fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, we could face regulatory or other enforcement actions, litigation, potential fines, reputational harm and other consequences.

Financial and third-party risks related to our cryptocurrency product offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodian, insufficient insurance coverage by the custodian to reimburse us for all such losses, the custodian’s failure to maintain effective controls over the custody and settlement services provided to us, the custodian’s inability to purchase or liquidate cryptocurrency holdings, and defaults on financial or performance obligations by the custodian, or other counterparty financial institutions, could significantly harm our business, financial performance, and reputation.

While we select custodian partners that are subject to regulatory oversight, capital requirements, maintenance of audit and compliance industry certifications, and cybersecurity procedures and policies, operational disruptions at the custodian, system issues or failure to safeguard cryptocurrency holdings, and any resulting financial losses could reduce consumer confidence and materially impact our operating results and our cryptocurrency product offerings.

The obligations associated with these custodial and other arrangements to safeguard cryptocurrency assets involve unique risks and uncertainties.

While other types of assets held in a similar manner have been deemed not to be part of the asset custodian’s bankruptcy estate under various regulatory regimes, bankruptcy courts have not yet considered the appropriate treatment of custodial holdings of digital assets and any such determination may be highly fact-specific.

PayPal holds its customers’ cryptocurrency assets through a third-party cryptocurrency asset custodian.

Despite PayPal’s efforts to structure our customers’ cryptocurrency asset accounts in a manner that reinforces customer ownership of the cryptocurrency assets, it remains possible that a court would consider such assets as part of the custodian’s bankruptcy estate.

In that event, cryptocurrency assets that our custodian holds on behalf of our customers may become subject to bankruptcy proceedings, our claim on behalf of such customers could be treated as a general unsecured claim against the custodian.

Moreover, the lack of precedent and the fact-dependent nature of the determination could delay or preclude the return of such cryptocurrency assets to our customers.

These and other risks, could adversely impact our cryptocurrency product offerings.

In addition, our cryptocurrency product offerings could have the effect of heightening or exacerbating many of the risk factors described in Item 1A, Risk Factors, in our Annual Report on Form 10-K for the fiscal year ended December 31, 2021, and may adversely affect our business, financial condition, and results of operations.

Privacy and Protection of Customer Data

The legal and regulatory environment relating to privacy and data protection laws continues to evolve in ways we cannot predict, including with respect to technologies such as cloud computing, artificial intelligence, cryptocurrency, and blockchain technology.

Any failure, or perceived failure, by us to comply with our privacy policies as communicated to customers or with privacy and data protection laws could result in proceedings or actions against us by data protection authorities, government entities, or others.

Such proceedings or actions could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, result in reputational harm, and materially harm our business.

In addition, compliance with inconsistent privacy and data protection laws may restrict or limit our ability to provide products and services to our customers.

PayPal relies on a variety of compliance methods to transfer personal data of EEA individuals to the U.S., including Binding Corporate Rules for internal transfers of certain types of personal data and Standard Contractual Clauses (“SCCs”) as approved by the European Commission for transfers to and from third parties.

In June 2021, the European Commission imposed new SCC requirements which impose certain contract and operational requirements on PayPal, its merchants, and vendors in order to adhere to certain affirmative duties, including requirements related to government access transparency, enhanced data subject rights, and broader third-party assessments to ensure safeguards necessary to protect personal data exported from PayPal’s EEA customers and/or employees to countries outside the EEA.

To the extent PayPal relies on SCCs, we may be required to incur additional costs and take additional steps to legitimize certain cross-border data transfers from the EEA, including new contractual arrangements under the updated requirements to avoid limitations on PayPal’s ability to process EEA data in countries outside of the EEA.

Many jurisdictions in which we operate have adopted, or are in the process of adopting or amending data privacy legislation or regulations aimed at creating and enhancing individual privacy rights.

In the U.S., numerous states have enacted, or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and retention of state residents’ personal information, and internationally, many of the markets in which we operate have similarly enacted, or are in the process of enacting or amending similar privacy laws and regulations.

The continued proliferation of privacy laws in the jurisdictions in which we operate is likely to result in a disparate array of privacy rules with unaligned or conflicting provisions, accountability requirements, individual rights, and enforcement powers, and may subject us to increased regulatory scrutiny and business costs, and lead to unintended consumer confusion.

Lending Regulation

We hold a number of U.S.

state lending licenses for our U.S.

consumer short-term installment loan product, which is subject to federal and state laws governing consumer credit and debt collection.

While the consumer short-term installment loan products that we offer outside the U.S.

are generally exempt from primary consumer credit legislation, certain consumer lending laws, consumer protection or banking transparency regulations continue to apply to these products.

Increased global regulatory focus on short-term installment products and consumer credit more broadly could result in laws or regulations requiring changes to our policies, procedures, operations, and product offerings, and restrict or limit our ability to offer credit products, and we could be subject to additional compliance and licensure requirements, enforcement action, fines, and litigation if we are found to violate any aspects of applicable law or regulations.

BUSINESS AND OPERATIONS RISKS

The continuing effects of the novel coronavirus (“COVID-19”) pandemic could materially and adversely affect our business, financial condition, and results of operations.

The ultimate extent to which the COVID-19 pandemic impacts our business, financial condition, and results of operations will depend on future developments, which are highly uncertain, difficult to predict, and subject to change, including, but not limited to, the duration, scope, severity, proliferation of variants and increase in the transmissibility of the virus, its impact on the global economy, actions taken to contain or limit the impact of COVID-19, such as the availability of an effective vaccine or treatment, geographic variation in how countries and states are handling the pandemic, and how quickly and to what extent normal economic and operating conditions may potentially resume.

The COVID-19 pandemic has adversely impacted the operations of our customers, suppliers, vendors and other business partners, and may adversely impact our results of operations in the future.

Cross-border and domestic commerce may be adversely impacted by measures taken by government authorities and businesses globally to contain and limit the spread of COVID-19, including travel restrictions, border closures, quarantines, shelter-in-place and lock-down orders, mask and social distancing requirements, and business limitations and shutdowns.

To the extent that such mitigation measures remain in place or are reinstated for significant periods of time, they may adversely affect our business, financial condition, and results of operations.

Actions that we have taken or may take in the future intended to assist customers impacted by COVID-19 may negatively impact our results of operations.

In particular, we have experienced and may continue to experience adverse financial impacts from a number of operational factors, including, but not limited to:

increased liability under our Purchase Protection Program or chargebacks on payment cards resulting from merchants’ selling goods or services in advance of the delivery date or experiencing bankruptcy, insolvency or other business interruption;

customer defaults on payment obligations under PayPal branded credit products;

increased cybersecurity and payment fraud risk;

challenges to the availability and reliability of our products and services;

and supply chain disruptions impacting our business.

The significant increase in the number of our employees who are working remotely as a result of the pandemic, and an extended period of remote work arrangements and subsequent reintroduction into the workplace could introduce operational risk, increase cybersecurity risk, strain our business continuity plans, negatively impact productivity, and give rise to claims by employees or otherwise adversely affect our business.

Additionally, COVID-19 could require new or modified processes, procedures, and controls to respond to changes in our business environment.

We may take further actions as may be required by government authorities or that we determine are in the best interests of our employees, customers, and business partners.

There is no certainty that such measures will be sufficient to mitigate the risks posed by COVID-19 or will otherwise be satisfactory to government authorities.

The impacts of COVID-19, individually or collectively, could have a material adverse impact on our business, financial condition, and results of operations and have the effect of heightening or exacerbating many of the other risks described in this “Risk Factors” section.

The conflict between Russia and Ukraine and its related implications could materially and adversely affect our business, financial condition, and results of operations.

In February 2022, Russia commenced military hostilities against Ukraine.

In March 2022, we suspended our transactional services in Russia.

We have also expanded our services for Ukrainian customers.

The potential effects of the conflict between Russia and Ukraine, individually or in the aggregate, could have the effect of heightening or exacerbating many of the risk factors described in Item 1A, Risk Factors, in our Annual Report on Form 10-K for the fiscal year ended December 31, 2021, may adversely affect our business, financial condition and results of operations, and restrict or limit our ability to operate in Russia.

These effects could include, but are not limited to, geopolitical instability and uncertainty;

adverse impacts on global and regional economic conditions and financial markets, including significant volatility in credit, capital, and currency markets;

reduced economic activity;

changes in laws and regulations affecting our business, including sanctions targeting Russia and other countries imposed by the U.S.

and other countries, counter-sanctions imposed by Russia, and additional sanctions or counter-sanctions which may be enacted;

and increased cybersecurity threats and concerns.

The ultimate extent to which the conflict between Russia and Ukraine may negatively impact our business, financial condition, and results of operations will depend on future developments, which are highly uncertain, difficult to predict, and subject to change.

Our ability to receive the benefit of U.S.

merchant financing and certain U.S.

installment loan offerings may be subject to challenge.

Merchant loans under our U.S.

PayPal Working Capital (“PPWC”) and PayPal Business Loan (“PPBL”) products and certain U.S.

installment loan products are provided by a state-chartered industrial bank under a program agreement with us, and we acquire the receivables generated by those loans after origination.

In June 2020, largely in response to the Madden v.

Midland Funding, LLC case decided in the U.S.

Court of Appeals for the Second Circuit, the Federal Deposit Insurance Corporation (“FDIC”) approved a final rule clarifying that loans originated by state-chartered non-member banks remain valid throughout the lifetime of the loan, reflecting a similar rule finalized by the Office of the Comptroller of Currency (“OCC”) in May 2020.

The final rule reaffirms and codifies in regulation the so-called “valid-when-made doctrine,” which provides that the interest rate for a loan is determined when the loan is made and will not be affected by subsequent events such as sale, assignment, or other transfer.

A number of state attorneys general have challenged these FDIC and OCC rules, and there remains some uncertainty whether non-bank entities purchasing loan receivables originated by FDIC-insured, state-chartered industrial banks may rely on federal preemption of state usury laws and other state laws.

An adverse outcome of these or similar challenges, or changes to applicable laws and regulations or regulatory policy, could materially impact our U.S.

PPWC, PPBL, and certain installment products and our business.

Our credit products expose us to additional risks.

We offer credit products to a wide range of consumers and merchants in the U.S.

and various international markets.

The financial success of these products depends on the effective management of related risk.

The credit decision-making process for our consumer credit products uses proprietary methodologies and credit algorithms and other analytical techniques designed to analyze the credit risk of specific consumers based on, among other factors, their past purchase and transaction history with PayPal or Venmo and their credit scores.

Similarly, proprietary risk models and other indicators are applied to assess merchants who desire to use our merchant financing offerings to help predict their ability to repay.

These risk models may not accurately predict the creditworthiness of a consumer or merchant due to inaccurate assumptions, including those related to the particular consumer or merchant, market conditions, economic environment, or limited transaction history or other data.

The accuracy of these risk models and the ability to manage credit risk related to our credit products may also be affected by legal or regulatory requirements, changes in consumer behavior, changes in the economic environment, issuing bank policies, and other factors.

We generally rely on third-party chartered financial institutions to provide PayPal and Venmo branded consumer credit and merchant financing offerings to our U.S.

As a service provider to these third-party chartered financial institutions, which are federally supervised U.S.

financial institutions, we are subject from time to time to examination by their federal banking regulators.

In the event of any termination or interruption in a partner bank’s ability or willingness to lend, our ability to offer consumer credit and merchant financing products could be interrupted or limited, which could materially and adversely affect our business.

We may be unable to reach a similar arrangement with another chartered financial institution on favorable terms or at all.

Obtaining licenses to originate such loans would be a costly, time-consuming, and uncertain process, and would subject us to additional laws and regulatory requirements, which could significantly increase our costs and compliance obligations and require us to change our business practices.

We are subject to the risk that account holders who use our credit products will default on their payment obligations, creating the risk of potential charge-offs or negative impact to the revenue share arrangement with Synchrony Bank with respect to our U.S.

consumer credit product.

The non-payment rate among account holders may increase due to, among other factors, changes to underwriting standards, risk models not accurately predicting the creditworthiness of a user, worsening economic conditions, such as a recession or government austerity programs, increases in prevailing interest rates, and high unemployment rates.

Account holders who miss payments often fail to repay their loans, and account holders who file for protection under the bankruptcy laws generally do not repay their loans.

We currently purchase receivables related to our PayPal branded merchant financing offerings in the U.S.

and certain consumer installment loan products in the U.S., and extend credit for our consumer and merchant products outside the U.S.

through our international subsidiaries.

If we are unable to fund our credit products, or the purchase of the receivables related to our merchant financing offerings in the U.S.

and certain consumer installment loan products in the U.S.

adequately or in a cost-effective manner, or if we are unable to efficiently manage the cash resources utilized for these purposes, the growth of our credit products could be negatively impacted.

For information on lending regulations that impact our business, see “ Our business is subject to extensive government regulation and oversight.

Our failure to comply with extensive, complex, overlapping, and frequently changing rules, regulations, and legal interpretations could materially harm our business — Lending Regulation ” in the risk factor section of our 2021 Form 10‑K.

We rely on third parties in many aspects of our business, which creates additional risk.

We rely on third parties in many aspects of our business, including, but not limited to:

networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions;

unaffiliated third-party lenders to originate our U.S.

credit products to consumers, U.S.

merchant financing, and branded credit card products;

PayPal-branded debit card products issued by an unaffiliated bank;

cryptocurrency custodial service providers;

and external business partners and contractors who provide key functions (e.g., outsourced customer support and product development functions;

information technology, data center facilities and cloud computing).

These risks include legal, regulatory, information security, reputational, operational, or any other risks inherent in engaging and relying upon a third party.

We are undertaking efforts to diversify our reliance on a small number of third-party payment processors in various markets.

We are in ongoing discussions with our primary payment processor in the U.S.

concerning a transitional period to facilitate the migration of our arrangements to other payment processors in connection with the wind-down of our agreement.

If we are unable to effectively manage our third-party relationships, these third parties are unable to meet their obligations to us, or we experience substantial disruptions in these relationships, our operations, results of operations, and financial results could be adversely impacted.

Additionally, while we have policies and procedures for managing these relationships, they inherently involve a lesser degree of control over business operations, governance, and compliance, thereby potentially increasing our financial, legal, reputational, and operational risk.

Changes to payment card networks or bank fees, rules, or practices could harm our business.

To process certain transactions, we must comply with applicable payment card, bank or other network (collectively, “network”) rules.

The rules govern all aspects of a transaction on the networks, including fees and other practices.

From time to time, the networks have increased the fees and assessments that they charge for transactions that access their networks.

Certain networks have also imposed special fees or assessments for transactions that are executed through a digital wallet such as the one that PayPal offers.

Our payment processors may have the right to pass any increases in fees and assessments on to us and to increase their own fees for processing.

Any increase in interchange fees, special fees, or assessments for transactions that we pay to the networks or our payment processors could make our pricing less competitive, increase our operating costs, and reduce our operating income, which could materially harm our business, financial condition, and results of operations.

In some jurisdictions, government regulations have required payment card networks to reduce or cap interchange fees.

Any changes in interchange fee rates or limitations, or their applicability to PayPal, could adversely affect our competitive position against payment card service providers and the revenue we earn from our branded card programs, require us to change our business practices, and harm our business.

We may also be subject to fines and other penalties assessed by networks resulting from any rule violations by us or our merchants.

The networks set and interpret their rules and have alleged from time to time that various aspects of our business model violate these rules or our agreements with the networks.

Such allegations may result in significant fines, penalties, damages, or other liabilities, adversely impact benefits to us under the agreements, or require changes in our business practices that may be costly and adversely affect our business, results of operations and financial condition.

The network rules may also increase the cost of, impose restrictions on, or otherwise impact the development of, our products which may negatively affect product deployment and adoption.

The networks could adopt new operating rules or interpret or re-interpret existing rules that we or our payment processors might find difficult or impractical to follow, or costly to implement, which could require us to make significant changes to our products, increase our operational costs, and negatively impact our business.

If we become unable or limited in our ability to accept certain payment types such as debit or credit cards, our business would be materially and adversely affected.

The U.K.’s departure from the EU could harm our business, financial condition, and results of operations.

Following the departure of the U.K.

from the EU and the EEA on January 31, 2020 (commonly referred to as “Brexit”) and the expiration of the transition period on December 31, 2020, there continues to be uncertainty over the practical consequences of Brexit, including the potential for greater restrictions on the supply and availability of goods and services between the U.K.

and EEA region, and a general deterioration in consumer sentiment and credit conditions leading to overall negative economic growth and increased risk of merchant default.

The consequences of Brexit have brought legal uncertainty and increased complexity for financial services firms, which could continue as national laws and regulations in the U.K.

differ from EU laws and regulations and additional authorization requirements come into effect.

These developments have led and could lead in the future to additional regulatory costs and challenges for us.

Specifically, PayPal currently operates in the U.K.

within the scope of its passport permissions (as they existed at the end of the transition period) pursuant to the Temporary Permissions Regime pending the grant of new authorizations by the U.K.

financial regulators.

If we are unable to obtain the required authorizations before the expiry of the longstop dates set by the U.K.

regulators under the Temporary Permissions Regime, our European operations could lose their ability to offer services within the U.K.

market, or into the U.K.

market on a cross-border basis.

Our European operations may also be required to comply with legal and regulatory requirements in the U.K.

that may be in addition to, or inconsistent with, those of the EEA, in each case, leading to increased complexity and costs.

If one or more of our counterparty financial institutions default on their financial or performance obligations to us or fail, we may incur significant losses.

We have significant amounts of cash, cash equivalents, receivables outstanding, and other investments on deposit or in accounts with banks or other financial institutions in the U.S.

and international jurisdictions.

As part of our foreign currency hedging activities, we regularly enter into transactions involving derivative financial instruments with various financial institutions.

Certain banks and other financial institutions are also lenders under our credit facilities.

We regularly monitor our concentration of, and exposure to, counterparty risk, and actively manage this exposure to mitigate the associated risk.

Despite these efforts, we may be exposed to the risk of default on obligations by, or deteriorating operating results or financial condition or failure of, these counterparty financial institutions.

If one of our counterparty financial institutions were to become insolvent, placed into receivership, or file for bankruptcy, our ability to recover losses incurred as a result of default or to access or recover our assets that are deposited, held in accounts with, or otherwise due from, such counterparty may be limited due to the insufficiency of the failed institutions’ estate to satisfy all claims in full or the applicable laws or regulations governing the insolvency, bankruptcy, or resolution proceedings.

In the event of default on obligations by, or the failure of, one or more of these counterparties, we could incur significant losses, which could negatively impact our results of operations and financial condition.

If we are unable, or perceived as unable, to effectively manage customer funds, our business could be harmed.

We hold a substantial amount of funds belonging to our customers, including balances in customer accounts and funds being remitted to sellers of goods and services or recipients of peer-to-peer transactions.

In certain jurisdictions where we operate, we are required to comply with applicable regulatory requirements with respect to customer balances.

Our success is reliant on public confidence in our ability to effectively manage our customers’ balances and handle substantial transaction volumes and amounts of customer funds.

Any failure to manage customer funds in compliance with applicable regulatory requirements, or any public loss of confidence in us or our ability to effectively manage customer balances, could lead customers to discontinue or reduce their use of our products or reduce customer balances held with us, which could significantly harm our business.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors