What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-02-04 compared with 2024-02-08 · 144 added, 149 removed, 314 unchanged (48% of the section changed)

4 unchanged sentences

Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition.

The techniques used to attempt to obtain unauthorized or illegal access to systems and information (including customers’ personal data), disable or degrade service, exploit vulnerabilities, or sabotage systems are constantly evolving.

In some circumstances, these attempts may not be recognized or detected until after they have been launched against a target.

Unauthorized parties will continue to attempt to gain access to our systems or facilities through various means, including through hacking into our systems or facilities or those of our customers, partners, or vendors, and attempting to fraudulently induce users of our systems (including employees, vendor and partner personnel and customers) into disclosing user names, passwords, payment card information, multi-factor authentication application access or other sensitive information used to gain access to such systems or facilities.

Unauthorized parties continuously attempt to gain access to our systems or facilities through various means, including through hacking into our systems or facilities or those of our customers, partners, or vendors, and attempting to fraudulently induce users of our systems (including employees, vendor and partner personnel and customers) into disclosing user names, passwords, payment card information, multi-factor authentication application access or other sensitive information used to gain access to such systems or facilities.

This information may, in turn, be used to access our customers’ confidential personal or proprietary information and financial instrument data that are stored on or accessible through our information technology systems and those of third parties with whom we partner.

This information may also be used to execute fraudulent transactions or otherwise engage in fraudulent actions.

Numerous and evolving cybersecurity threats, including advanced and persisting cyberattacks, cyberextortion, distributed denial-of-service attacks, ransomware, spear phishing and social engineering schemes, the introduction of computer viruses or other malware, and the physical destruction of all or portions of our information technology and infrastructure and those of third parties with whom we partner or that are part of our information technology supply chain, are becoming increasingly sophisticated and complex, may be difficult to detect, and could compromise the confidentiality, availability, and integrity of the data in our systems, as well as the systems themselves.

Numerous and evolving cybersecurity and related threats, including advanced and persisting cyberattacks, cyberextortion, distributed denial-of-service attacks, ransomware, spear phishing and social engineering schemes, the introduction of computer viruses or other malware, and the physical destruction of all or portions of our information technology and infrastructure and those of third parties with whom we partner or that are part of our information technology supply chain, are becoming increasingly sophisticated and complex, may be difficult to detect, and could compromise the confidentiality, availability, and integrity of the data in our systems, as well as the systems themselves.

We believe that hostile actors, who may comprise individuals, coordinated groups, sophisticated organizations, or nation state supported entities, may target PayPal due to our name, brand recognition, types of data (including sensitive payments- and identity-related data) that customers provide to us, and the widespread adoption and use of our products and services.

We have experienced from time to time, and may experience in the future, cybersecurity incidents, including breaches of our security measures, network breaches, and compromise of personally identifiable customer information due to human error, deception, malfeasance, insider threats, system errors, defects, vulnerabilities, or other issues.

Any cybersecurity incidents, including cyberattacks or data security breaches affecting the information technology or infrastructure of companies we acquire or of our customers, partners, or vendors (including data center and cloud computing providers) could have similar negative effects.

Any of the foregoing events may subject us to fines, penalties, regulatory or other enforcement actions, and our business, reputation or financial condition may be adversely affected.

Any cybersecurity incidents, including cyberattacks or data security breaches affecting the information technology or infrastructure of our customers, partners, or vendors (including data center and cloud computing providers) or of companies we acquire, could have similar negative effects.

Under payment card network rules and our contracts with our payment processors, if there is a breach of payment card information stored by us or our direct payment card processing vendors, we could be liable to the payment card issuing banks, including for their cost of issuing new cards and related expenses.

Cybersecurity breaches and other exploited security vulnerabilities could subject us to significant costs and third-party liabilities, result in improper disclosure of data and violations of applicable privacy and other laws, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, damage our reputation and brands, divert the attention of management from the operation of our business, result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses to or claims by them, or expose us to litigation, regulatory investigations, and significant fines and penalties.

While we maintain insurance policies intended to help offset the financial impact we may experience from these risks, our coverage may be insufficient to compensate us for all losses caused by security breaches and other damage to or unavailability of our systems.

We have experienced, and may experience in the future, breaches involving customer information for which we have notified, and may notify, regulators, customers and other third parties.

These or other cybersecurity breaches and other exploited security vulnerabilities have subjected us and could further subject us to significant costs and third-party liabilities, result in improper disclosure of data and violations of applicable privacy and other laws, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, damage our reputation and brands, divert the attention of management from the operation of our business, result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses to or claims by them, or expose us to litigation, regulatory investigations, and significant fines and penalties.

Moreover, under payment card network rules and our contracts with our payment processors, if there is a breach of payment card information stored by us or our direct payment card processing vendors, we could be liable to the payment card issuing banks, including for their cost of issuing new cards and related expenses.

unavailability of our systems.

Business interruptions or systems failures may impair the availability of our websites, applications, products or services, or otherwise harm our business.

and other natural disasters, public health crises (including pandemics), power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks, computer viruses or other malware, or other events.

Our systems and operations and those of our service providers and partners have experienced from time to time, and may experience in the future, business interruptions or degradation of service because of distributed denial-of-service and other cyberattacks, insider threats, hardware and software defects or malfunctions, human error, earthquakes, hurricanes, floods, fires, and other natural disasters, public health crises (including pandemics), power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks, computer viruses or other malware, or other events.

The frequency and intensity of weather events related to climate change are increasing, which could increase the likelihood and severity of such disasters as well as related damage and business interruption.

2 unchanged sentences

Further, some of our systems, including those of companies that we have acquired, are not fully redundant and any failure of these acquired systems, including due to a catastrophic event, may lead to operational outages or delays.

While we engage in disaster recovery planning and testing intended to mitigate risks from outages or delays, our planning and testing may not be sufficient for all possible outcomes or events.

While we engage in disaster recovery planning and testing intended to mitigate risks from outages or delays, our planning and testing may not be effective or sufficient for all possible outcomes or events.

As a provider of payments solutions, we are also subject to heightened scrutiny by regulators that may require specific business continuity, resiliency and disaster recovery plans, and rigorous testing of such plans, which may be costly and time-consuming to implement, and may divert our resources from other business priorities.

1 unchanged sentence

We have experienced, and expect to continue to experience, system failures, cyberattacks, unplanned outages, and other events or conditions from time to time that have and may interrupt the availability, or reduce or adversely affect the speed or functionality, of our products and services.

A prolonged interruption of, or reduction in, the availability, speed, or functionality of our products and services could materially harm our business.

While we continue to undertake system upgrades and re-platforming efforts designed to improve the availability, reliability, resiliency, and speed of our payments platform, these efforts are costly and time-consuming, involve significant technical complexity and risk, may divert our resources from new features and products, and may ultimately not be effective.

A prolonged interruption of, or reduction in, the availability, speed, or functionality of our products and services could materially harm our business and financial condition.

Frequent or persistent interruptions in our services could permanently harm our relationship with our customers and partners and our reputation.

1 unchanged sentence

These claims, even if unsuccessful, would likely be time-consuming and costly for us to address.

We continue to undertake system upgrades and re-platforming efforts designed to improve the availability, reliability, resiliency, and speed of our payments platform.

These efforts are costly and time-consuming, involve significant technical complexity and risk, may divert our resources from new features and products, and may ultimately not be effective.

Frequent or persistent site interruptions could lead to regulatory scrutiny, significant fines and penalties, and mandatory and costly changes to our business practices, and ultimately could cause us to lose existing licenses that we need to operate or prevent or delay us from obtaining additional licenses that may be required for our business.

We also rely on facilities, components, applications, software, and services supplied by third parties, including data center facilities and cloud data storage and processing services.

From time to time, we have experienced interruptions in the provision of such facilities and services provided by these third parties.

If these third parties experience operational interference or disruptions (including a cybersecurity incident), fail to perform their obligations, or breach their agreements with us, our operations could be disrupted or otherwise negatively affected, which could result in customer dissatisfaction, regulatory scrutiny, and damage to our reputation and brands, and materially and adversely affect our business.

If these third parties experience operational interference or disruptions (including a cybersecurity incident), fail to perform their obligations, or breach their agreements with us, our operations could be disrupted or negatively affected, which could result in customer dissatisfaction, regulatory scrutiny, and damage to our reputation and brands, and materially and adversely affect our business.

While we maintain insurance policies intended to help offset the financial impact we may experience from these risks, our coverage may be insufficient to compensate us for all losses caused by interruptions in our service due to systems failures and similar events.

In addition, any failure to successfully implement new information systems and technologies, or improvements or upgrades to existing information systems and technologies in a timely manner could adversely impact our business, internal controls, results of operations, and financial condition.

In addition, any failure to successfully implement new information systems and technologies or improvements or upgrades to existing information systems and technologies in a timely manner could lead to regulatory scrutiny, significant fines and penalties, and mandatory and costly changes to our business, adversely impact our business, internal controls, results of operations, and financial condition, and ultimately could cause us to lose existing licenses that we need to operate or prevent or delay us from obtaining additional licenses that may be required for our business.

If we cannot keep pace with rapid technological developments to provide new and innovative products and services, the use of our products and services and, consequently, our revenues, could decline.

1 unchanged sentence

internet browser technologies that enable users to easily store their payment card information for use on any retail or e-commerce website;

artificial intelligence and machine learning;

developments in technologies supporting our regulatory and compliance obligations;

artificial intelligence (“AI”) and machine learning;

developments in technologies supporting our regulatory and

compliance obligations;

and in-store, digital, and social commerce.

We expect that new technologies applicable to the industries in which we operate will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services.

We expect that new technologies applicable to the industries in which we operate, including the development, adoption, and use of generative AI technologies, will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services.

We cannot predict the effects of technological changes on our business, which technological developments or innovations will become widely adopted, and how those technologies may be regulated.

Developing and incorporating new technologies into new and existing products and services may require significant investment, take considerable time, and may not ultimately be successful.

We rely in part on

third parties, including some of our competitors, for the development of and access to new or evolving technologies.

For example, AI algorithms that we use may be flawed or may be based on datasets that are biased or insufficient.

In addition, any latency, disruption, or failure in our AI systems or infrastructure could result in delays or errors in our offerings.

There also may be real or perceived social harm, unfairness, or other outcomes that undermine public confidence in the use of our products or of AI.

In addition, third parties may deploy AI technologies in a manner that reduces customer demand for our products and services.

We rely in part on third parties, including some of our competitors, for the development of and access to new or evolving technologies.

These third parties may restrict or prevent our access to, or utilization of, those technologies, as well as their platforms or products.

Our ability to develop, provide or incorporate new technologies and adapt our existing products and services or develop future and new products and services using new technologies may be limited or restricted by industry-wide standards, platform providers, payments networks, changes to laws and regulations, changing customer expectations, third-party intellectual property rights, and other factors.

If we are unable to develop and incorporate new technologies and adapt to technological changes and evolving industry standards in a timely or cost-effective manner, our business could be harmed.

If we are unable to develop and incorporate new technologies and adapt to technological changes and evolving industry standards in a timely or cost-effective manner, our business, results of operations, or reputation could be harmed.

LEGAL, REGULATORY AND COMPLIANCE RISKS

7 unchanged sentences

In addition, because we facilitate sales of goods and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws, which may impose different, more specific, or conflicting obligations on us, as well as broader liability.

Any failure or perceived failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to or expansion of their interpretation) may subject us to significant fines, penalties, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions;

Any failure or perceived failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to or expansion of their interpretation) may subject us to significant fines, penalties, monetary damages, injunctive relief, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions;

result in additional compliance and licensure requirements;

17 unchanged sentences

These restrictions may limit our ability to grow our business.

Outside of the U.S., we principally provide our services to customers in the European Economic Area (“EEA”) through PayPal (Europe) S.à.r.l.

We principally provide our services to customers in the European Economic Area (“EEA”) through PayPal (Europe) S.à.r.l.

et Cie, S.C.A.

(“PayPal (Europe)”), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg and PayPal U.K.

Limited (“PayPal U.K.”), a wholly-owned subsidiary that is subject to

regulation as an electronic money institution in the United Kingdom (“U.K.”) by the Financial Conduct Authority (“FCA”).

Limited (“PayPal U.K.”), a wholly-owned subsidiary that is subject to regulation as an electronic money institution and a consumer credit firm (and registration as a crypto asset business) in the United Kingdom (“U.K.”) by the Financial Conduct Authority (“FCA”).

PayPal (Europe) or PayPal U.K.

may be subject to enforcement actions and significant fines if either violates applicable requirements.

may be subject to enforcement actions and significant fines and penalties if either violates applicable requirements.

If the business activities of PayPal (Europe) exceed certain thresholds, or if the European Central Bank (“ECB”) so determines, PayPal (Europe) may be deemed a significant supervised entity and certain activities of PayPal (Europe) would become directly supervised by the ECB, rather than by the Luxembourg Commission de Surveillance du Secteur Financier.

2 unchanged sentences

Applicable regulation relating to payments, anti-money laundering, and digital services, which are key focus areas of regulators and subject to extensive new regulation, could subject us to additional and complex obligations, risks, and associated costs, and impact our ability to expand our business in Europe.

In many of the other markets outside the U.S.

in which we do business, we serve our customers through PayPal Pte.

For many of the other markets outside the U.S., we provide services on a cross-border basis through PayPal Pte.

Ltd., our wholly-owned subsidiary based in Singapore.

1 unchanged sentence

As of July 1, 2023, PayPal Pte.

has been issued a Major Payment Institution license by the MAS under the Payment Services Act 2019 to continue providing payments services.

In order to maintain this license and certain other licenses or registrations we hold in certain markets, we are required to comply with applicable regulatory requirements, which will result in increased operational complexity and costs for our Singapore and international operations.

In many of the markets outside the U.S.

(other than Singapore) served by PayPal Pte.

or by local branches or subsidiaries subject to local regulatory supervision or oversight, as the case may be, there may be uncertainty whether our Singapore-based service is subject only to Singapore law or also to other local laws, and whether such local laws might require a payment processor like us to be licensed as a payments service, bank, financial institution, or otherwise.

There are substantial costs and potential product and operational changes involved in maintaining and renewing licenses, certifications, and approvals, and we could be subject to enforcement actions, fines, and litigation if we are found to violate any of these requirements.

has been issued a Major Payment Institution license by the MAS under the Payment Services Act 2019.

In order to maintain this license and certain other licenses or registrations we hold in certain markets, we are required to comply with applicable regulatory requirements, which have imposed and will continue to impose increasing operational complexity and costs for our Singapore and international operations.

Moreover, in many non-U.S.

markets (other than Singapore) where customers of PayPal Pte.

or local branches or subsidiaries subject to local regulatory supervision or oversight, as the case may be, are located, there may be uncertainty whether our Singapore-based service is subject only to Singapore law or also to other local laws, and whether such local laws might require a payment processor like us to be licensed as a payments service, bank, financial institution, or otherwise.

There are substantial costs and potential product and operational changes involved in maintaining and renewing licenses, certifications, and approvals, and we could be subject to enforcement actions, fines, penalties, and litigation if we are found to violate any of these requirements.

There can be no assurance that we will be able to (or decide to) continue to apply for or obtain any licenses, renewals, certifications, and approvals in any jurisdiction.

In certain markets, we may need to rely on local banks or other partners to process payments and conduct foreign currency exchange transactions in local currency, and local regulators may use their authority over such local partners to prohibit, restrict, or limit us from doing business.

Any of the foregoing could, individually or in the aggregate, result in substantial additional costs, delay or preclude planned transactions, product launches or improvements, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, products and services, or prevent or limit us from providing our products or services in a given market.

Any of the foregoing could, individually or in the aggregate, result in substantial additional costs, delay or preclude planned transactions, geographical expansions, or product launches or improvements, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, products and services, or prevent or limit us from providing our products or services in a given market.

Cryptocurrency Regulation and Related Risks

Our customer cryptocurrency offerings could subject us to additional regulations, licensing requirements, or other obligations or liabilities.

Within the U.S., we are regulated by the New York Department of Financial Services as a virtual currency business, which does not qualify us to engage in securities brokerage or dealing activities.

Within the U.S., we are regulated by the New York State Department of Financial Services as a virtual currency business, which does not qualify us to engage in securities brokerage or dealing activities.

The regulatory status of particular cryptocurrencies is unclear under existing law.

For example, if the Securities and Exchange Commission (“SEC”) were to assert that any of the cryptocurrencies we support are securities, the SEC could assert that our activities involving that cryptocurrency require securities broker-dealer registration or other obligations under the federal securities laws.

The rapidly evolving regulatory landscape with respect to cryptocurrency may subject us to additional licensing and regulatory obligations or to additional inquiries or investigations from the SEC or other regulators and governmental authorities, and require us to make product changes, restrict or discontinue product offerings in certain markets, implement additional and potentially costly controls, or take other actions.

The rapidly evolving

legislative and regulatory landscapes with respect to cryptocurrency may subject us to additional licensing and regulatory obligations or to additional inquiries or investigations from the SEC or other regulators and governmental authorities, and require us to make product changes, restrict or discontinue product offerings in certain markets, implement additional and potentially costly controls, or take other actions.

In August 2023, a third-party issuer with which we have partnered commercially (the “PYUSD Issuer”) launched a U.S.

dollar-denominated stablecoin named PayPal USD (“PYUSD”), which was initially available to PayPal U.S.

customers and subsequently made available to Venmo customers in September 2023.

dollar-denominated stablecoin named PayPal USD (“PYUSD”), which is available to PayPal U.S.

customers and Venmo customers.

These PayPal and Venmo customers may, if provisioned for external transfers and subject to our sanctions and anti-money laundering controls, send PYUSD to external wallets not controlled by PayPal.

2 unchanged sentences

There are uncertainties on how ongoing changes to federal, state, and international laws and regulations would apply to stablecoins in practice, and we and the PYUSD Issuer may face substantial costs to operationalize and comply with any additional or changed requirement.

If we or the PYUSD Issuer fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, we could face regulatory or other enforcement actions, potential fines, and other consequences.

In addition, we could face

reputational harm through our relationship with the PYUSD Issuer if the PYUSD Issuer were to face regulatory scrutiny, PYUSD is deemed to be a security, or PYUSD is alleged to be used for transactions in connection with illicit or illegal activities.

In addition, we could face reputational harm through our relationship with the PYUSD Issuer if the PYUSD Issuer were to face regulatory scrutiny, PYUSD is deemed to be a security, or PYUSD is alleged to be used for transactions in connection with illicit or illegal activities.

We hold our customers’ cryptocurrency assets through one or more third-party custodians.

Financial and third-party risks related to our customer cryptocurrency offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodians, insufficient insurance coverage by a custodian to reimburse us for all such losses, a custodian’s failure to maintain effective controls over the custody and settlement services provided to us, a custodian’s inability to purchase or liquidate cryptocurrency holdings, the failure of the PYUSD Issuer to maintain sufficient reserve assets backing PYUSD and defaults on financial or performance obligations by a custodian, banks with which the PYUSD Issuer maintains reserve assets or counterparty financial institutions, could expose our customers and us to loss, and therefore significantly harm our business, financial performance, and reputation.

Financial and third-party risks related to our customer cryptocurrency offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodians, insufficient insurance coverage by a custodian to reimburse us for all such losses, a custodian’s failure to maintain effective controls over the custody and settlement services provided to us, a custodian’s inability to purchase or liquidate cryptocurrency holdings, the failure of the PYUSD Issuer to maintain sufficient reserve assets backing PYUSD and defaults on financial or performance obligations by a custodian, banks with which the PYUSD Issuer maintains reserve assets or counterparty financial institutions, could expose our customers and us to loss, and significantly harm our business, financial condition, and reputation.

We have selected custodian partners and the PYUSD Issuer, and may in the future select additional custodian partners and stablecoin issuing entities, that are subject to regulatory oversight, capital requirements, maintenance of audit and compliance industry certifications, and cybersecurity procedures and policies.

Nevertheless, operational disruptions at any such custodian or issuer, or such custodians’ or issuer’s failure to safeguard cryptocurrency holdings (or reserve assets) could result in losses of customer assets, expose us to customer claims, reduce consumer confidence and materially impact our operating results and our cryptocurrency product offerings.

Nevertheless, any operational disruptions at any such custodian or issuer, or such custodians’ or issuer’s failure to safeguard cryptocurrency holdings (or reserve assets), could result in losses of customer assets, expose us to customer claims, reduce consumer confidence and materially impact our cryptocurrency product offerings and our operating results.

Custodial arrangements to safeguard cryptocurrency assets involve unique risks and uncertainties in the event of a custodian’s bankruptcy.

3 unchanged sentences

In that event, our claim on behalf of such customers against a custodian’s estate for our customers’ cryptocurrency assets could be treated as a general unsecured claim against the custodian, in which case our customers could seek to hold us liable for any resulting losses.

In addition, our cryptocurrency product offerings could have the effect of heightening or exacerbating many of the risk factors described in this “Risk Factors” section.

Lending Regulation

2 unchanged sentences

consumer short-term installment loan product, which is subject to federal and state laws governing consumer credit and debt collection.

While the consumer short-term installment loan products that we offer outside the U.S.

are generally exempt from primary consumer credit legislation, certain consumer lending laws, consumer protection or banking transparency regulations continue to apply to these products.

Similarly, the consumer short-term installment loan products that we offer outside the U.S.

may be subject to consumer credit legislation, licensing requirements, consumer lending laws, consumer protection or banking transparency regulations.

Increased global regulatory focus on short-term installment products and consumer credit more broadly could result in laws or regulations requiring changes to our policies, procedures, operations, and product offerings, and restrict or limit our ability to offer credit products.

Consumer Protection

Violations of federal and state consumer protection laws and regulations, including the Electronic Fund Transfer Act (“EFTA”) and Regulation E as implemented by the Consumer Financial Protection Bureau (“CFPB”), could result in the assessment of significant actual damages or statutory damages or penalties (including treble damages in some instances) and plaintiffs’ attorneys’ fees.

Violations of consumer protection law in applicable jurisdictions, including both federal and state laws and regulations in the U.S., such as the Electronic Fund Transfer Act (“EFTA”) and Regulation E as implemented by the Consumer Financial Protection Bureau (“CFPB”), could result in the assessment of significant actual damages or statutory damages or penalties (including treble damages in some instances) and plaintiffs’ attorneys’ fees.

We are subject to, and have paid amounts in settlement of, lawsuits containing allegations that our business violated the EFTA and Regulation E or otherwise advance claims for relief relating to our business practices (e.g., that we improperly held consumer funds or otherwise improperly limited consumer accounts).

1 unchanged sentence

From time to time, we have received orders from the CFPB pursuant to such market-monitoring authority requiring us to provide, among other items, extensive information on our payment products, including with respect to the collection, use of, and access to data and consumer protections, as well as our Buy Now, Pay Later offerings.

Following the departure of the U.K.

from the European Union (“EU”) and the EEA on January 31, 2020 (commonly referred to as “Brexit”), effective November 1, 2023, PayPal’s wholly-owned U.K.

subsidiary received authorizations from the FCA as an electronic money institution and consumer credit firm, and registration as a cryptoasset business, subject to certain conditions that will require further implementation action by us.

If we are unable to meet these requirements, our U.K.

business and operations may be impacted and we may be subject to enforcement actions.

Anti-Money Laundering and Counter-Terrorist Financing;

Economic and Trade Sanctions

Regulators globally continue to increase standards and expectations regarding anti-money laundering and counter-terrorist financing, and to expand the scope of existing laws and regulations to emerging products and markets, which may require us to further revise or expand our compliance program globally and/or in specific jurisdictions, including the procedures we use to verify the identity of our customers and to monitor international and domestic transactions.

Regulators globally continue to increase standards and expectations regarding anti-money laundering and counter-terrorist financing, and to expand the scope of existing laws and regulations to emerging products and markets, which may require us to revise or expand our compliance program globally and/or in specific jurisdictions, including the procedures we use to verify the identity of our customers and to monitor international and domestic transactions.

Such changes could have the effect of making compliance more costly and operationally difficult to manage, lead to increased friction for customers, and result in a decrease in business.

Regulators regularly re-examine the transaction volume thresholds at which we must obtain and keep applicable records or the circumstances in which we must verify identities of customers, and any change to such obligations could result in greater compliance costs and impact our business.

We are also required to comply with economic and trade sanctions administered by the U.S., the EU and its member states, the U.K., and other jurisdictions in which we operate.

We are also required to comply with economic and trade sanctions administered by the U.S., the European Union (“EU”) and its member states, the U.K., and other jurisdictions in which we operate.

Non-compliance with anti-money laundering laws and regulations or economic and trade sanctions may subject us to significant fines, penalties, lawsuits, and enforcement actions, result in regulatory sanctions and additional compliance requirements, increase regulatory scrutiny of our business, restrict our operations, and damage our reputation and brands.

Our compliance history may be considered by OFAC and other regulators as part of any potential future investigation of our sanctions regulation.

In the ordinary course of business we may identify and voluntarily report, and have reported, potential compliance issues to regulatory authorities, including the U.S.

Department of the Treasury’s Office of Foreign Assets Control (“OFAC”), and our compliance history may be considered by OFAC and other regulators as part of any potential future investigation of our sanctions regulation.

Privacy and Protection of Customer Data

The legal and regulatory environment relating to privacy and data protection laws continues to develop and evolve in ways we cannot predict, including with respect to technologies such as cloud computing, artificial intelligence, machine learning, cryptocurrency, and blockchain technology.

Any failure or alleged failure by us to comply with our privacy policies as communicated to customers or with privacy and data protection laws relating to our collection, use, storage, transfer, or sharing of customer data with third parties could result in proceedings or actions against us by data protection authorities, other government agencies, or others, which could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, result in reputational harm, and materially harm our business.

The legal and regulatory environment relating to privacy and data protection laws continues to develop and evolve in ways we cannot predict, including with respect to technologies such as cloud computing, (generative) AI, machine learning, cryptocurrency, and blockchain technology.

Any failure or alleged failure by us to comply with our privacy policies as communicated to customers or with privacy and data protection laws relating to our collection, use, storage, transfer, or sharing of customer data with third parties could result in proceedings or actions against us by data protection authorities, other government agencies, our customers or others, which could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, result in reputational harm, and materially harm our business.

Compliance with inconsistent privacy and data protection laws may also restrict or limit our ability to provide products and services to our customers.

PayPal relies on a variety of compliance methods to transfer personal data of EEA individuals to the U.S., including Binding Corporate Rules for internal transfers of certain types of personal data and Standard Contractual Clauses (“SCCs”) as approved by the European Commission for transfers to and from third parties.

Additionally, in July 2023, the EU-U.S.

Data Privacy Framework, the U.K.

Extension to the EU-U.S.

Data Privacy Framework, and the Swiss-U.S.

Data Privacy Framework became effective as additional mechanisms to enable transfers of personal data to the U.S.

from the EU/EEA, the U.K., and Switzerland, respectively.

The new Data Protection Framework (DPF) replaces prior transatlantic personal data transfer regimes that were invalidated by the Court of Justice of the European Union.

As such, there are risks in solely relying on the DPF for internal transfers of personal data to the U.S.

While PayPal intends to continue to rely on Binding Corporate Rule and SCCs and will evaluate the circumstances under which the DPF may be leveraged for transfers of personal data to the U.S., we may be subject to regulatory enforcement actions if our approach is deemed to be noncompliant.

Many jurisdictions in which we operate globally have enacted, or are in the process of enacting, data privacy legislation or regulations aimed at creating and enhancing individual privacy rights.

Many jurisdictions in which we operate globally have enacted, or are in the process of enacting, data privacy legislation or regulations aimed at creating and enhancing individual privacy rights, including with respect to the use of personal data for personalization and cross-contextual advertising.

For example, numerous U.S.

states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and retention of their residents’ personal information.

states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and retention of their residents’ personal information as well as specific privacy obligations around youth.

The continued proliferation of privacy laws in the jurisdictions in which we operate is likely to result in a disparate array of privacy rules with unaligned or conflicting provisions, accountability requirements, individual rights, and national or local enforcement powers, which may subject us to increased regulatory scrutiny and business costs and could lead to unintended consumer confusion.

Artificial Intelligence (AI)

The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including in the areas of consumer protection, intellectual property, cybersecurity, and privacy and data protection.

In addition, there is uncertainty around the validity and enforceability of intellectual property rights related to the use, development, and deployment of AI-

generated outputs.

Compliance with new and emerging laws, regulations or industry standards relating to AI in the U.S.

and internationally, such as U.S.

state regulations and the Artificial Intelligence Act in the EU, may impose significant operational costs and may limit our ability to develop, deploy or use existing or future AI technologies.

As a result, our ability to adapt our existing products and services or develop future and new products and services using AI may be limited or restricted, which could adversely impact our business.

We are subject to regulatory scrutiny and may be subject to legal proceedings under antitrust and competition laws.

We are subject to scrutiny by various government agencies regarding antitrust and competition laws and regulations in the U.S.

and internationally, including in connection with proposed or implemented business combinations, acquisitions, investments,

partnerships, commercial agreements and business practices.

and internationally, including in connection with proposed or implemented business combinations, acquisitions, investments, partnerships, commercial agreements and business practices.

Some jurisdictions also provide private rights of action for competitors or consumers to assert claims of anticompetitive conduct.

Companies and government agencies have in the past alleged, and may in the future allege, that our actions violate the antitrust or competition laws in the U.S.

Companies and government agencies have in the past alleged, and may in the future allege, that our actions (or actions of companies with which we have commercial agreements) violate the antitrust or competition laws in the U.S.

or other jurisdictions in which we operate or otherwise constitute unfair competition, or that our products and services are used so broadly that otherwise uncontroversial business practices could be deemed anticompetitive.

Any claims or investigations, even if without merit, may be costly to defend or respond to, involve negative publicity, and cause substantial diversion of management’s time and effort, and could result in reputational harm, significant judgments, fines and other remedial actions against us, require us to change our business practices, make product or operational changes, or delay or preclude planned transactions, product launches or improvements.

Any claims or investigations, even if without merit, may be costly to defend or respond to, involve negative publicity, cause substantial diversion of management’s time and effort, and could result in reputational harm, significant judgments, fines and other remedial actions against us, require us to change our business practices, make product or operational changes, or delay or preclude planned transactions, product launches or improvements.

We are regularly subject to general litigation, regulatory scrutiny, and government inquiries.

We are regularly subject to claims, individual and class action lawsuits, arbitration proceedings, government and regulatory investigations, inquiries, actions or requests, and other proceedings alleging violations of laws, rules, and regulations with respect to competition, antitrust, intellectual property, privacy, data protection, information security, anti-money laundering, counter-terrorist financing, sanctions, anti-bribery, anti-corruption, consumer protection (including unfair, deceptive, or abusive acts or practices), the terms of our customer agreements, fraud, accessibility, securities, tax, labor and employment, commercial disputes, services, charitable fundraising, contract disputes, escheatment of unclaimed or abandoned property, product liability, use of our services for illegal purposes, the matters described in “Note 13—Commitments and Contingencies— Litigation and Regulatory Matters—General Matters ” to our consolidated financial statements, and other matters.

The number and significance of these disputes and inquiries is expected to continue to increase as our products, services, and business expand in complexity, scale, scope, and geographic reach, including through acquisitions of businesses and technology.

Investigations and legal proceedings are inherently uncertain, expensive and disruptive to our operations, and could result in substantial judgments, fines, penalties or settlements, negative publicity, substantial diversion of management’s time and effort, reputational harm, criminal sanctions, or orders that prevent or limit us from offering certain products or services;

We expect that the number and significance of these disputes and inquiries will continue to increase as our products, services, and business expand in complexity, scale, scope, and geographic reach, including through acquisitions of businesses and technology.

Investigations and legal proceedings are inherently uncertain, expensive and disruptive to our operations, and could result in substantial judgments, fines, penalties or settlements, substantial diversion of management’s time and effort, negative publicity, reputational harm, criminal sanctions, or orders that prevent or limit us from offering certain products or services;

require us to change our business practices or customer agreement terms in ways that may increase costs or reduce revenues, develop non-infringing or otherwise altered products or technologies, or pay substantial royalty or licensing fees;

10 unchanged sentences

Effective protection of our proprietary rights may not be available in every jurisdiction in which we offer our products and services.

Although we have generally taken measures to protect our intellectual property, there can be no assurance that we will be successful in protecting or enforcing our rights in every jurisdiction, that our contractual arrangements will prevent or deter third parties from infringing or misappropriating our intellectual property, or that third parties will not independently develop equivalent or superior intellectual property rights.

Although we have generally taken measures to protect our intellectual

property, there can be no assurance that we will be successful in protecting or enforcing our rights in every jurisdiction, that our contractual arrangements will prevent or deter third parties from infringing or misappropriating our intellectual property, or that third parties will not independently develop equivalent or superior intellectual property rights.

We may be required to expend significant time and resources to prevent infringement and enforce our rights, and we may be unable to discover or determine the extent of any unauthorized use of our proprietary rights.

2 unchanged sentences

These licensees may take actions that diminish the value of our proprietary rights or harm our reputation.

Any failure to adequately protect or enforce our

proprietary rights, or significant costs incurred in doing so, could diminish the value of our intangible assets and materially harm our business.

Any failure to adequately protect or enforce our proprietary rights, or significant costs incurred in doing so, could diminish the value of our intangible assets and materially harm our business.

BUSINESS AND OPERATIONS RISKS

We face substantial and increasingly intense competition worldwide in the global payments industry.

The global payments industry is highly competitive, dynamic, highly innovative, and increasingly subject to regulatory scrutiny and oversight.

Many of the areas in which we compete evolve rapidly with innovative and disruptive technologies, shifting user preferences and needs, price sensitivity of merchants and consumers, and frequent introductions of new products and services.

Competition also may intensify as new competitors emerge, businesses enter into business combinations and partnerships, and established companies in other segments expand to become competitive with various aspects of our business.

The global payments industry is highly competitive, dynamic, and innovative, and increasingly subject to regulatory scrutiny and oversight.

Many of the areas in which we compete evolve rapidly with innovative and disruptive technologies, shifting user preferences and needs, price sensitivity of consumers and merchants, and frequent introductions of new products and services.

Competition also may intensify as new competitors emerge, businesses combine or enter into new partnerships, and established companies in other segments expand to become competitive with various aspects of our business.

We compete with a wide range of businesses in every aspect of our business.

2 unchanged sentences

Our competitors may devote greater resources to the development, promotion, and sale of products and services, and/or offer lower prices or more effectively offer their own innovative programs, products, and services.

We often partner with other businesses, and the ability to continue establishing these partnerships is important to our business.

We often partner with other businesses, and the ability to continue developing these partnerships is important to our business.

Competition for relationships with these partners is intense, and there can be no assurance that we will be able to continue to establish, grow, or maintain these partner relationships.

If we are unable to differentiate our products and services from those of our competitors, drive value for our customers, or effectively and efficiently align our resources with our goals and objectives, we may not be able to compete effectively.

Business— Competition ” of this Form 10-K for further discussion of the competitive environment in the markets where we operate.

If we are unable to differentiate our products and services from those of our competitors, drive value for our customers and adoption of our products and services, or effectively and efficiently align our resources with our goals and objectives, we may not be able to compete effectively, which could negatively impact our results of operations and financial condition.

Changes to payment card networks or bank fees, rules, or practices could harm our business.

6 unchanged sentences

In some jurisdictions, government regulations have required payment card networks to reduce or cap interchange fees.

Any changes in interchange fee rates or limitations, or their applicability to PayPal, could adversely affect our competitive position against payment card service providers and the revenue we earn from our branded card programs, require us to change our business practices, and harm our business.

Any changes in interchange fee rates or limitations, or their applicability to PayPal’s products and services, could adversely affect our competitive position against payment card service providers and the revenue we earn from our branded card programs, require us to change our business practices, and harm our business.

We may also be subject to fines and other penalties assessed by networks resulting from any rule violations by us or our merchants.

2 unchanged sentences

The network rules may also increase the cost of, impose restrictions on, or otherwise impact the development of, our products which may negatively affect product deployment and adoption.

The networks could adopt new operating rules or interpret or re-interpret existing rules that we or our payment processors might find difficult or impractical to follow, or costly to implement, which could require us to make significant changes to our products, increase our operational costs, and negatively impact our business.

The networks could adopt new operating rules or interpret or re-interpret existing rules that

we or our payment processors might find difficult or impractical to follow, or costly to implement, which could require us to make significant changes to our products, increase our operational costs, and negatively impact our business.

If we become unable or limited in our ability to accept certain payment types such as debit or credit cards, our business would be materially and adversely affected.

Changes in how consumers fund their PayPal transactions could harm our business.

We pay transaction fees when consumers fund payment transactions using credit cards, lower fees when consumers fund payments with debit cards, and nominal fees when consumers fund payment transactions by electronic transfer of funds from bank accounts, from an existing PayPal account balance or Venmo account balance, or through our PayPal branded consumer

credit products.

Our financial performance is sensitive to changes in the rate at which our consumers fund payments using payment cards, which can significantly increase our costs.

9 unchanged sentences

The accuracy of these risk models and the ability to manage credit risk related to our credit products may also be affected by legal or regulatory requirements, changes in consumer behavior, changes in the economic environment, issuing bank policies, and other factors.

We are subject to the risk that account holders who use our credit products will default on their payment obligations.

The non-payment rate among account holders may increase due to, among other factors, changes to underwriting standards, risk models not accurately predicting the creditworthiness of a user, worsening economic conditions, such as a recession or government austerity programs, increases in prevailing interest rates, and high unemployment rates.

Account holders who miss payments often fail to repay their loans, and account holders who file for protection under the bankruptcy laws generally do not repay their loans.

Further, laws or regulations may limit the assessment of late fees or penalties on certain credit products, which could negatively impact our revenue share arrangement with an independent chartered financial institution with respect to our U.S.

consumer credit products.

Any deterioration in the performance of loans facilitated through our platform or unexpected losses on such loans may increase the risk of potential charge-offs, increase our allowance for loans and interest receivable, negatively impact our revenue share arrangement (as discussed in “Item 7.

Management’s Discussion and Analysis of Financial Condition and Results of Operations — Key Metrics and Financial Results ”), and materially and adversely affect our financial condition and results of operations .

We generally rely on the activities and charters of unaffiliated financial institutions to provide PayPal and Venmo branded consumer credit and merchant financing offerings to our U.S.

7 unchanged sentences

installment loan products are provided by a state-chartered industrial bank under a program agreement with us, and we acquire the receivables generated by those loans from the state-chartered bank after origination.

In June 2020, the Federal Deposit Insurance Corporation (“FDIC”) approved a final rule clarifying that loans validly originated by state-chartered banks or insured branches of foreign banks remain valid throughout the lifetime of the loan, reflecting a similar rule finalized by the Office of the Comptroller of Currency (“OCC”) in May 2020 for nationally chartered banks.

In June 2020, the Federal

Deposit Insurance Corporation (“FDIC”) approved a final rule clarifying that loans validly originated by state-chartered banks or insured branches of foreign banks remain valid throughout the lifetime of the loan, reflecting a similar rule finalized by the Office of the Comptroller of Currency (“OCC”) in May 2020 for nationally chartered banks.

The final rule reaffirms and codifies the so-called “valid-when-made doctrine,” which provides that the permissibility of an interest rate for a loan is determined when the loan is made and will not be affected by subsequent events such as sale, assignment, or other transfer.

1 unchanged sentence

An adverse outcome of these or similar challenges, or changes to applicable laws and regulations or regulatory policy, could materially impact our U.S.

PPWC, PPBL, certain installment products, and our business.

We are subject to the risk that account holders who use our credit products will default on their payment obligations.

Account holders who miss payments often fail to repay their loans, and account holders who file for protection under the bankruptcy laws generally do not repay their loans.

consumer credit products, and materially and adversely affect our financial condition and results of operations .

PPWC and PPBL products, certain installment products, and our business.

We currently purchase receivables related to our U.S.

1 unchanged sentence

consumer installment loan products and extend credit for our consumer and merchant products outside the U.S.

through our international

subsidiaries.

In June 2023, we entered into a multi-year agreement to sell up to €40 billion of U.K.

through our international subsidiaries.

In June 2023, we entered into a multi-year agreement to sell U.K.

and European buy now, pay later (“BNPL”) loan receivables originated by PayPal (Europe) and PayPal U.K., consisting of the sale of a substantial majority of the U.K.

and European BNPL loan portfolio held on PayPal (Europe)’s balance sheet at the closing of the transaction and a forward-flow arrangement for the sale of future originations of eligible loans, and in October 2023, we began selling those receivables.

and European BNPL loan portfolio held on PayPal (Europe)’s balance sheet at the closing of the transaction and a forward-flow arrangement for the sale of future originations of eligible loans.

The sale of future eligible receivables is subject to certain conditions.

If these conditions are not satisfied or waived or if the parties are unable to fulfill their obligations under these arrangements, the sale of these receivables could be delayed and we may not realize the expected benefits of this arrangement.

From time to time, we may consider other third-party sources of funding (including asset sales, warehouse facilities, forward-flow arrangements, securitizations, partnerships or other funding structures) for our credit portfolio or other receivables.

The availability of such third-party funding is subject to a number of factors, including economic conditions and interest rates, and there can be no assurance that any such funding arrangements can be obtained on favorable terms or at all.

If we are unable to fund our credit products or the purchase of the receivables related to our credit products and offerings adequately or in a cost-effective manner, the growth of our credit products and our results of operations and financial condition could be materially and adversely impacted.

We rely on third parties in many aspects of our business, which creates additional risk.

We rely on third parties in many aspects of our business, including networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions;

We rely on third parties in many aspects of our business, including, but not limited to, networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions;

unaffiliated third-party lenders to originate our U.S.

3 unchanged sentences

cryptocurrency custodial service providers;

and external business partners and contractors who provide key functions (e.g., outsourced customer support and product development functions;

information technology, data center facilities and cloud computing).

We are subject to additional risks inherent in engaging and relying upon third-party providers, including legal, regulatory, information security, reputational and operational risks.

We are undertaking efforts to diversify our reliance on a small number of third-party payment processors in various markets.

We are working with our primary payment processor in the U.S.

to facilitate the migration of our arrangements to other payment processors over a transition period in connection with the wind-down of our agreement;

however, if we are unable to timely and efficiently migrate our business to other payment processors or experience disruptions in connection with this transition, our business could be harmed.

If we are unable to effectively manage our third-party relationships, these third parties are unable to meet their obligations to us, or we experience substantial disruptions in these relationships, our operations, results of operations, and financial results could be adversely impacted.

and external business partners and contractors who provide key functions (including, but not limited to, data center facilities and cloud computing, information technology, and outsourced customer support and product development functions).

We are subject to additional risks inherent in engaging and relying upon third-party providers, including operational, legal, regulatory, information security, reputational, commercial, and resiliency risks.

If we are unable to effectively manage our third-party relationships, these third parties are unable to meet their obligations to us, we are overly reliant on certain relationships, or we experience substantial disruptions in these relationships (including interruptions to the availability of our products and services), our operations, results of operations, and financial results could be adversely impacted.

Additionally, our relationships with third parties inherently involve a lesser degree of control over business operations, governance, and compliance, which potentially increases our financial, legal, reputational, and operational risk.

2 unchanged sentences

Cross-border transactions generally provide higher revenues and operating income than similar transactions that take place within a single country or market.

In certain markets, cross-border trade represents our primary (and in some instances our only) presence.

Cross-border trade may be negatively impacted by various factors including foreign currency exchange rate fluctuations, tariffs, trade barriers or restrictions, sanctions, import or export controls, and the interpretation and application of laws of multiple jurisdictions in the context of cross-border trade and foreign exchange.

In certain markets, cross-border trade represents our primary (and in some instances our only) offerings.

Cross-border trade may be negatively impacted by various factors including foreign exchange rate fluctuations, tariffs, trade barriers or restrictions, sanctions, import or export controls, and the interpretation and application of laws of multiple jurisdictions in the context of cross-border trade and foreign exchange.

Any factors that increase the costs of cross-border trade for us or our customers or that restrict, delay, or make cross-border trade more difficult or impractical could reduce our cross-border transactions and volume, negatively impact our revenues and profits, and harm our business.

Failure to deal effectively with fraud, abusive behaviors, bad transactions, and negative customer experiences may increase our loss rate and could negatively impact our business and severely diminish merchant and consumer confidence in and use of our services.

We expect that third parties will continue to attempt to abuse access to and misuse our payments services to commit fraud by, among other things, creating fictitious PayPal accounts using stolen or synthetic identities or personal information, making transactions with stolen financial instruments, abusing or misusing our services for financial gain, or fraudulently inducing users of our systems into engaging in fraudulent transactions.

Due to the nature of PayPal’s digital payments services, third parties may seek to engage in abusive schemes or fraud attacks that are often difficult to detect and may be deployed at a scale that would otherwise not be possible in physical transactions.

Measures to detect and reduce the risk of fraud and abusive

behavior are complex, require continuous improvement, and may not be effective in detecting and preventing fraud, particularly new and continually evolving forms of fraud or in connection with new or expanded product offerings.

We expect that third parties will continue to attempt to abuse access to and misuse our payments services to commit fraud by, among other things, creating fictitious PayPal accounts using stolen or synthetic identities or personal information, taking over customer accounts or creating fraudulent accounts, making transactions with stolen financial instruments, abusing or misusing our services for financial gain, or fraudulently inducing users of our products and services into engaging in fraudulent transactions.

transactions.

Measures to detect and reduce the risk of fraud and abusive behavior are complex, require continuous improvement, and may not be effective in detecting and preventing fraud, particularly new and continually evolving forms of fraud or in connection with new or expanded product offerings.

If these measures are not effective, our business could be negatively impacted.

We also incur substantial losses from erroneous transactions and situations where funding instruments used for legitimate transactions are closed or have insufficient funds to satisfy payments, or the payment is initiated to an unintended recipient in error.

We also incur substantial losses from erroneous transactions and situations where linked accounts designated by customers to fund PayPal transactions have insufficient funds or are otherwise unavailable to fund the payments, or the payment is initiated to an unintended recipient in error.

Numerous and evolving fraud schemes and misuse of our payments services could subject us to significant costs and liabilities, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, damage our reputation and brands, divert the attention of management from the operation of our business, and result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses or claims.

3 unchanged sentences

We incur substantial losses from our protection programs as a result of disputes filed by our customers.

We seek to recover losses from our protection programs from the merchant, but may not be able to fully recover our losses (for example, if the merchant is unwilling or unable to pay, the transaction involves a fraudulent merchant, or the merchant provides sufficient evidence that the item was delivered).

While we may seek to recover losses from our protection programs from the merchant, we ultimately may not be able to fully recover such losses (for example, if the merchant is unwilling or unable to pay, the transaction involves a fraudulent merchant, or the merchant provides sufficient evidence that the item was delivered).

In addition, consumers who pay through PayPal or Venmo may have reimbursement rights from their payment card issuer, which in turn will seek recovery from us.

1 unchanged sentence

Regulators and card networks may also adapt error resolution and chargeback requirements to account for evolving forms of fraud, which could increase PayPal’s exposure to fraud losses and impact the scope of coverage of our protection programs.

Increases in our loss rate, including as a result of changes to the scope of transactions covered by our protection programs, could negatively impact our business.

Increases in our loss rate, including as a result of changes to the scope of transactions covered by our protection programs, could negatively impact our business and results of operations.

See “Note 13—Commitments and Contingencies— Protection Programs ” to our consolidated financial statements.

6 unchanged sentences

Owners of intellectual property rights or government authorities may seek to bring legal action against providers of payments solutions, including PayPal, that are peripherally involved in the sale of infringing or allegedly infringing items by a user.

While we invest in measures intended to prevent and detect illegal activities that may occur on our payments platform, these measures require continuous improvement and may not be effective in detecting and preventing illegal activity or improper uses.

Any illegal or improper uses of our payments platform or failure by us to detect or prevent illegal or improper activity by our users may subject us to claims, individual and class action lawsuits, and government and regulatory requests, inquiries, or investigations that could result in liability, restrict our operations, impose additional restrictions or limitations on our business or require us to change our business practices, harm our reputation, increase our costs, and negatively impact our business.

While we invest in measures intended to prevent and detect illegal activities that may occur on our payments platform, these measures may not be effective in detecting and preventing illegal activity or improper uses, and we may be subject to claims, individual and class action lawsuits, and government and regulatory requests, inquiries, or investigations that could result in liability, restrict our operations, impose additional restrictions or limitations on our business or require us to change our business practices, harm our reputation, increase our costs, and negatively impact our business.

Acquisitions, dispositions, strategic investments, and other strategic transactions could result in operating difficulties and could harm our business.

We expect to continue to consider and evaluate a wide array of potential strategic transactions as part of our overall business strategy, including business combinations, acquisitions, and dispositions of certain businesses, technologies, services, products, and other assets;

We expect to continue to consider and evaluate a wide array of potential strategic transactions as part of our overall business

strategy, including business combinations, acquisitions, and dispositions of certain businesses, technologies, services, products, and other assets;

strategic investments;

18 unchanged sentences

Our international operations generate a significant portion of our net revenues.

Our international operations subject us to significant challenges, uncertainties, and risks, including local regulatory, licensing, reporting, and legal obligations;

Our international operations subject us to significant challenges, uncertainties, and risks, including, but not limited to, local regulatory, licensing, reporting, and legal obligations;

costs and challenges associated with operating in markets in which we may have limited or no experience, including effectively localizing our products and services and adapting them to local preferences;

2 unchanged sentences

difficulties in recruiting and retaining qualified employees and maintaining our company culture;

fluctuations in foreign currency exchange rates;

fluctuations in foreign exchange rates;

exchange control regulations;

6 unchanged sentences

and national or regional political, economic, or social instability.

In addition, some countries have enacted or are considering data localization or residency laws, which require that certain data be maintained, stored and/or processed within their country of origin.

Maintaining local data centers in individual countries could significantly increase our operating costs.

Our international operations also may heighten many of the other risks described in this “Risk Factors” section.

6 unchanged sentences

Global and regional economic conditions could harm our business.

Adverse global and regional economic conditions such as turmoil affecting the banking system or financial markets, including, but not limited to, tightening in the credit markets, extreme volatility or distress in the financial markets (including the fixed income, credit, currency, equity, and commodity markets), higher unemployment, high consumer debt levels, recessionary or inflationary pressures, supply chain issues, reduced consumer confidence or economic activity, government fiscal, monetary and tax policies, U.S.

and international trade relationships, agreements, treaties, tariffs and restrictive actions, the inability of a government to enact a budget in a fiscal year, government shutdowns, government austerity programs, and other negative financial news or macroeconomic developments could have a material adverse impact on the demand for our products and services, including a reduction in the volume and size of transactions on our payments platform.

Additionally, any inability to access the capital markets when needed due to volatility or illiquidity in the markets or increased regulatory liquidity and capital requirements may strain our liquidity position.

Such conditions may also expose us to fluctuations in foreign currency exchange rates or interest rates that could materially and adversely affect our financial results.

income, credit, currency, equity, and commodity markets), unemployment, consumer debt levels, recessionary or inflationary pressures, supply chain issues, reduced consumer confidence or economic activity, government fiscal, monetary and tax policies, U.S.

and international trade relationships, agreements, treaties, tariffs and restrictive actions, the inability of a government to enact a budget in a fiscal year, government shutdowns, government austerity programs, geopolitical conditions or events, and other negative financial news or macroeconomic developments could have a material adverse impact on the demand for our products and services, including a reduction in the volume and size of transactions on our payments platform.

Additionally, any inability to access the capital markets when needed due to volatility or illiquidity in the markets, liquidity needs due to unanticipated reductions in customer balances, or increased regulatory liquidity and capital requirements may strain our liquidity position.

Such conditions may also expose us to fluctuations in foreign exchange rates or interest rates that could materially and adversely affect our financial results.

If our reputation or our brands are damaged, our business and operating results may be harmed.

1 unchanged sentence

There are numerous ways our reputation or brands could be damaged.

We may experience scrutiny or criticism from customers, partners, employees, government entities, media, advocacy groups, and other influencers or stakeholders that disagree with, among other things, our product offering decisions or public policy positions.

Damage to our reputation or our brands may result from, among other things, new features, products, services, operational efforts, or terms of service (or changes to the same), or our decisions regarding user privacy, data practices, or information security.

12 unchanged sentences

Environmental, social and governance (“ESG”) issues may have an adverse effect on our business, financial condition and results of operations and damage our reputation.

Investors, customers, employees, regulators, legislators and other stakeholders are increasingly focused on ESG matters and related disclosures, including with respect to cybersecurity, data privacy and protection, global talent and climate.

If we are unable to comply with new laws and regulations or changes to legal or regulatory requirements concerning ESG matters, or fail to meet investor, industry or stakeholder expectations and standards, our reputation may be harmed, customers may choose to refrain from using our products and services, we may be subject to fines, penalties, regulatory or other enforcement actions, and our business or financial condition may be adversely affected.

We may also experience additional scrutiny or criticism from investors, customers, partners, media, government entities, and other stakeholders if they perceive PayPal to not have acted appropriately with respect to ESG matters.

If our ESG-related data, processes and reporting are incomplete or inaccurate, or if we fail to achieve progress with respect to ESG-related goals on a timely basis, or at all, our reputation, business, financial performance and growth could be adversely affected.

We specifically recognize the inherent physical climate-related risks where we conduct business.

Our primary locations may be vulnerable to the adverse effects of climate change.

For example, California, where our headquarters are located, has

historically experienced, and is projected to continue to experience, extreme weather and natural disaster events more frequently, including drought, water scarcity, flooding, heat waves, wildfires and resultant air quality impacts, and power shutoffs associated with wildfire prevention.

Such events may disrupt our business and may cause us to experience additional costs to maintain or resume operations and higher attrition.

Various jurisdictions are adopting or considering new laws and regulations that expand mandatory disclosure, reporting and diligence requirements with respect to ESG matters.

If we are unable to comply with new laws and regulations concerning ESG matters or fail to meet investor, industry or stakeholder expectations and standards, our reputation may be harmed, customers may choose to refrain from using our products and services, we may be subject to fines, penalties, regulatory or other enforcement actions, and our business or financial condition may be adversely affected.

If our ESG-related data, processes and reporting are viewed as incomplete or inaccurate, or if we fail to achieve progress with respect to ESG-related goals on a timely basis or at all, we may be viewed negatively by stakeholders concerned about these matters.

Moreover, investors, customers, partners, media, government entities, and other stakeholders (including those in support of or in opposition to ESG principles) may have a negative view of us to the extent we are perceived to have not responded appropriately to their ESG concerns or take positions that are contrary to their views or expectations.

We recognize that climate-related risks may impact our business.

For example, California, where our headquarters are located, has historically experienced, and is projected to continue to experience, extreme weather and natural disaster events more frequently, including drought, flooding, heat waves, and wildfires.

Such events may disrupt our business and may cause us to experience additional costs to maintain or resume operations.

If one or more of our counterparty financial institutions default on their financial or performance obligations to us or fail,we may incur significant losses.

1 unchanged sentence

and international jurisdictions.

As part of our foreign currency hedging activities, we regularly enter into transactions involving derivative financial instruments with various financial institutions.

As part of our foreign exchange hedging activities, we regularly enter into transactions involving derivative financial instruments with various financial institutions.

Certain banks and other financial institutions are also lenders under our credit facilities.

24 unchanged sentences

federal government, and governments of foreign jurisdictions, such as the EU Commission, as well as international organizations, such as the Organization for Economic Co-operation and Development (“OECD”), are focused on tax reform and other legislative or regulatory action to increase tax revenue.

For example, various countries have proposed or enacted digital services taxes and global minimum tax provisions under the Pillar Two OECD model rules.

These actions may materially and adversely affect our effective tax rate, net income, and cash flows.

These actions may

materially and adversely affect our effective tax rate, net income, and cash flows.

Specifically, the OECD has published model rules and is coordinating negotiations among participating countries with the goal of achieving consensus on significant changes to international tax rules, including the implementation of a global minimum tax rate of 15%, commonly referred to as Pillar Two.

Each individual jurisdiction will need to enact minimum tax legislation which may result in various interpretations of the OECD model rules and applicable timelines.

Certain countries in which we do business have enacted implementing legislation effective January 1, 2024.

As additional jurisdictions enact similar legislation, transition rules expire, and other provisions of the minimum tax legislation become effective, our effective tax rate and cash tax payments could increase in future years.

The impact will depend on several factors including U.S and foreign tax legislation as well as our overall tax profile.

A number of details around the provisions are still uncertain as the OECD and individual jurisdictions continue to issue guidance.

The determination of our worldwide provision for income taxes and other tax liabilities requires estimation and significant judgment, and there are many transactions and calculations for which the ultimate tax determination is uncertain.

3 unchanged sentences

While we have established reserves based on assumptions and estimates that we believe are reasonable to cover such eventualities, these reserves may prove to be insufficient.

In addition, our future income taxes could be adversely affected by the incurrence of losses or earnings being lower than anticipated in jurisdictions that have lower statutory tax rates, and earnings being higher than anticipated in jurisdictions that have higher statutory tax rates;

by changes in the valuation of our deferred tax assets and liabilities, including as a result of gains on our foreign currency exchange risk management program;

In addition, our future income taxes could be adversely affected by changes in our geographical mix of income and impacts of statutory tax rates;

by changes in the valuation of our deferred tax assets and liabilities, including as a result of gains on our foreign exchange risk management program;

by changes in tax laws, regulations, or accounting principles;

11 unchanged sentences

We are subject to risks associated with information disseminated through our products and services.

We may be subject to claims relating to information disseminated through our online services, including claims alleging defamation, libel, harassment, hate speech, breach of contract, invasion of privacy, negligence, copyright or trademark infringement, or other theories based on the nature and content of the materials disseminated through the services, among other things.

We may be subject to claims relating to information disseminated through our online services by our customers and other third parties, including, but not limited to, claims alleging defamation, libel, harassment, hate speech, breach of contract, invasion of privacy, negligence, copyright or trademark infringement, or other theories based on the nature and content of the materials disseminated through the services.

We invest in measures intended to detect and block activities that may occur on our payments platform in violation of our policies and applicable laws.

These measures require continuous improvement and may not be sufficiently effective in detecting and preventing the exchange of information in violation of our policies and applicable laws.

If these measures are not sufficiently effective, our business could be negatively impacted.

If the laws or regulations that provide protections for online dissemination of information are invalidated or are modified to reduce protections available to us and we become liable for information provided by our customers and carried on our products and services, we could be directly harmed and we may be forced to implement new measures to reduce our exposure, including expending substantial resources or discontinuing certain product or service offerings, which could harm our business.

These measures require continuous improvement and may not be sufficiently effective in detecting and preventing the exchange of information in violation of our policies and applicable laws, which could negatively impact our business.

If the laws or regulations that provide protections for online dissemination of information are invalidated, modified, or supplemented to reduce protections available to us, or to increase requirements on us to remove certain information or implement other processes, we could be harmed and may be forced to implement new measures to reduce our potential liability for information provided by our customers and carried on our products and services.

This increased risk could require us to expend substantial resources or discontinue certain product or service offerings, which could harm our business.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors