What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-04-29 compared with 2024-10-29 · 117 added, 77 removed, 5 unchanged (97% of the section changed)

We are subject to various risks and uncertainties, which could materially affect our business, results of operations, financial condition, future results, and the trading price of our common stock.

You should read carefully the following information together with the information appearing in Part I, Item 1A, Risk Factors in our Annual Report on Form 10-K for the year ended December 31, 2023 as filed with the United States (“U.S.”) Securities and Exchange Commission (“SEC”) on February 8, 2024 (“2023 Form 10-K”), as updated by the information appearing in Part II, Item 1A, Risk Factors in our subsequent Quarterly Reports on Form 10-Q as filed with the SEC (“Forms 10-Q”).

The following information supplements and, to the extent inconsistent, supersedes some of the information appearing in the Risk Factors section of our 2023 Form 10‑K and Forms 10-Q.

The following information supplements and, to the extent inconsistent, supersedes some of the information appearing in the Risk Factors section of our 2024 Form 10‑K.

These risk factors, as well as our condensed consolidated financial statements and notes thereto and the other information appearing in this report, should be reviewed carefully for important information regarding risks that affect us.

CYBERSECURITY AND TECHNOLOGY RISKS

Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition.

The techniques used to attempt to obtain unauthorized or illegal access to systems and information (including customers’ personal data), disable or degrade service, exploit vulnerabilities, or sabotage systems are constantly evolving.

In some circumstances, these attempts may not be recognized or detected until after they have been launched against a target.

Unauthorized parties continuously attempt to gain access to our systems or facilities through various means, including through hacking into our systems or facilities or those of our customers, partners, or vendors, and attempting to fraudulently induce users of our systems (including employees, vendor and partner personnel and customers) into disclosing user names, passwords, payment card information, multi-factor authentication application access or other sensitive information used to gain access to such systems or facilities.

This information may, in turn, be used to access our customers’ confidential personal or proprietary information and financial instrument data that are stored on or accessible through our information technology systems and those of third parties with whom we partner.

This information may also be used to execute fraudulent transactions or otherwise engage in fraudulent actions.

Numerous and evolving cybersecurity threats, including advanced and persisting cyberattacks, cyberextortion, distributed denial-of-service attacks, ransomware, spear phishing and social engineering schemes, the introduction of computer viruses or other malware, and the physical destruction of all or portions of our information technology and infrastructure and those of third parties with whom we partner or that are part of our information technology supply chain, are becoming increasingly sophisticated and complex, may be difficult to detect, and could compromise the confidentiality, availability, and integrity of the data in our systems, as well as the systems themselves.

We believe that hostile actors, who may comprise individuals, coordinated groups, sophisticated organizations, or nation state supported entities may target PayPal due to our name, brand recognition, types of data (including sensitive payments- and identity-related data) that customers provide to us, and the widespread adoption and use of our products and services.

We have experienced from time to time, and may experience in the future, cybersecurity incidents, including breaches of our security measures, network breaches, and compromise of personally identifiable customer information due to human error, deception, malfeasance, insider threats, system errors, defects, vulnerabilities, or other issues.

Any cybersecurity incidents, including cyberattacks or data security breaches affecting the information technology or infrastructure of companies we acquire or of our customers, partners, or vendors (including data center and cloud computing providers) could have similar negative effects.

Under payment card network rules and our contracts with our payment processors, if there is a breach of payment card information stored by us or our direct payment card processing vendors, we could be liable to the payment card issuing banks, including for their cost of issuing new cards and related expenses.

We have experienced, and may experience in the future, breaches involving customer information for which we have notified, and may notify, regulators, customers and other third parties.

These or other cybersecurity breaches and other exploited security vulnerabilities have subjected us and could further subject us to significant costs and third-party liabilities, result in improper disclosure of data and violations of applicable privacy and other laws, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, damage our reputation and brands, divert the attention of management from the operation of our business, result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses to or claims by them, or expose us to litigation, regulatory investigations, and significant fines and penalties.

While we maintain insurance policies intended to help offset the financial impact we may experience from these risks, our coverage may be insufficient to compensate us for all losses caused by security breaches and other damage to or unavailability of our systems.

LEGAL, REGULATORY AND COMPLIANCE RISKS

Our business is subject to extensive government regulation and oversight.

Our failure to comply with extensive, complex, overlapping, and frequently changing rules, regulations, and legal interpretations could materially harm our business.

Privacy and Protection of Customer Data

The legal and regulatory environment relating to privacy and data protection laws continues to develop and evolve in ways we cannot predict, including with respect to technologies such as cloud computing, (generative) artificial intelligence, machine learning, cryptocurrency, and blockchain technology.

Any failure or alleged failure by us to comply with our privacy policies as communicated to customers or with privacy and data protection laws relating to our collection, use, storage, transfer, or sharing of customer data with third parties could result in proceedings or actions against us by data protection authorities, other government agencies, our customers or others, which could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, result in reputational harm, and materially harm our business.

Compliance with inconsistent privacy and data protection laws may also restrict or limit our ability to provide products and services to our customers.

PayPal relies on a variety of compliance methods to transfer personal data of Europe Economic Area individuals to the U.S., including Binding Corporate Rules for internal transfers of certain types of personal data and Standard Contractual Clauses (“SCCs”) as approved by the European Commission for transfers to and from third parties.

While PayPal intends to continue to rely on Binding Corporate Rules and SCCs and will evaluate the circumstances under which additional mechanisms, such as the EU-U.S.

Data Privacy Framework may be leveraged for transfers of personal data to the U.S., we may be subject to regulatory enforcement actions if our approach is deemed to be noncompliant.

Many jurisdictions in which we operate globally have enacted, or are in the process of enacting, data privacy legislation or regulations aimed at creating and enhancing individual privacy rights.

For example, numerous U.S.

states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and retention of their residents’ personal information.

The continued proliferation of privacy laws in the jurisdictions in which we operate is likely to result in a disparate array of privacy rules with unaligned or conflicting provisions, accountability requirements, individual rights, and national or local enforcement powers, which may subject us to increased regulatory scrutiny and business costs and could lead to unintended consumer confusion.

Our credit products expose us to additional risks.

We offer credit products to a wide range of consumers and merchants in the U.S.

and various international markets.

The financial success of these products depends largely on the effective management of related risk.

The credit decision-making process for our consumer credit products uses proprietary methodologies and credit algorithms and other analytical techniques designed to analyze the credit risk of specific consumers based on, among other factors, their past purchase and transaction history with PayPal or Venmo and their credit scores.

Similarly, proprietary risk models and other indicators are applied to assess merchants who desire to use our merchant financing offerings to help predict their ability to repay.

These risk models may not accurately predict the creditworthiness of a consumer or merchant due to inaccurate assumptions, including those related to the particular consumer or merchant, market conditions, economic environment, or limited transaction history or other data.

The accuracy of these risk models and the ability to manage credit risk related to our credit products may also be affected by legal or regulatory requirements, changes in consumer behavior, changes in the economic environment, issuing bank policies, and other factors.

We generally rely on the activities and charters of unaffiliated financial institutions to provide PayPal and Venmo branded consumer credit and merchant financing offerings to our U.S.

As a service provider to these unaffiliated financial institutions, which are federally supervised U.S.

financial institutions, we are subject from time to time to examination by their federal banking regulators.

In the event of any termination or interruption in a partner bank’s ability or willingness to lend, our ability to offer consumer credit and merchant financing products could be interrupted or limited, which could materially and adversely affect our business.

We may be unable to reach a similar arrangement with another unaffiliated financial institution on favorable terms or at all.

Obtaining and maintaining the lending licenses required for us to originate such loans ourselves would be a costly, time-consuming and uncertain process, and would subject us to additional laws and regulatory requirements, which could significantly increase our costs and compliance obligations and require us to change our business practices.

Merchant loans under our U.S.

PayPal Working Capital (“PPWC”) and PayPal Business Loan (“PPBL”) products and certain U.S.

installment loan products are provided by a state-chartered industrial bank under a program agreement with us, and we acquire the receivables generated by those loans from the state-chartered bank after origination.

In June 2020, the Federal Deposit Insurance Corporation (“FDIC”) approved a final rule clarifying that loans validly originated by state-chartered banks or insured branches of foreign banks remain valid throughout the lifetime of the loan, reflecting a similar rule finalized by the Office of the Comptroller of Currency (“OCC”) in May 2020 for nationally chartered banks.

The final rule reaffirms and codifies the so-called “valid-when-made doctrine,” which provides that the permissibility of an interest rate for a loan is determined when the loan is made and will not be affected by subsequent events such as sale, assignment, or other transfer.

While a number of state attorneys general have unsuccessfully challenged these FDIC and OCC rules, there remains some uncertainty whether non-bank entities purchasing loan receivables originated by FDIC-insured, state-chartered banks may rely on federal preemption of state usury laws and other state laws.

An adverse outcome of these or similar challenges, or changes to applicable laws and regulations or regulatory policy, could materially impact our U.S.

PPWC and PPBL products, certain installment products, and our business.

We are subject to the risk that account holders who use our credit products will default on their payment obligations.

The non-payment rate among account holders may increase due to, among other factors, changes to underwriting standards, risk models not accurately predicting the creditworthiness of a user, worsening economic conditions, such as a recession or government austerity programs, increases in prevailing interest rates, and high unemployment rates.

Account holders who miss payments often fail to repay their loans, and account holders who file for protection under the bankruptcy laws generally do not repay their loans.

Further, laws or regulations may limit the assessment of late fees or penalties on certain credit products, which could negatively impact our revenue share arrangement with an independent chartered financial institution with respect to our U.S.

consumer credit products.

Any deterioration in the performance of loans facilitated through our platform or unexpected losses on such loans may increase the risk of potential charge-offs, increase our allowance for loans and interest receivable, negatively impact our revenue share arrangement (as discussed above), and materially and adversely affect our financial condition and results of operations .

We currently purchase receivables related to our U.S.

PayPal-branded merchant financing offerings and certain U.S.

consumer installment loan products and extend credit for our consumer and merchant products outside the U.S.

through our international subsidiaries.

In June 2023, we entered into a multi-year agreement to sell up to €40 billion of U.K.

and European buy now, pay later (“BNPL”) loan receivables originated by PayPal (Europe) and PayPal U.K., consisting of the sale of a substantial majority of the U.K.

and European BNPL loan portfolio held on PayPal (Europe)’s balance sheet at the closing of the transaction and a forward-flow arrangement for the sale of future originations of eligible loans, and in October 2023, we began selling those receivables.

The sale of future eligible receivables is subject to certain conditions.

If these conditions are not satisfied or waived or if the parties are unable to fulfill their obligations under these arrangements, the sale of these receivables could be delayed and we may not realize the expected benefits of this arrangement.

From time to time, we may consider other third-party sources of funding (including asset sales, warehouse facilities, forward-flow arrangements, securitizations, partnerships or other funding structures) for our credit portfolio or other receivables.

The availability of such third-party funding is subject to a number of factors, including economic conditions and interest rates, and there can be no assurance that any such funding arrangements can be obtained on favorable terms or at all.

If we are unable to fund our credit products or the purchase of the receivables related to our credit products and offerings adequately or in a cost-effective manner, the growth of our credit products and our results of operations and financial condition could be materially and adversely impacted.

Our business is subject to complex and changing laws, rules, regulations, policies, licensing schemes, and legal interpretations in the markets in which we offer services directly or through partners, including, but not limited to, those governing:

banking, credit, deposit taking, cross-border and domestic money transmission, prepaid access, foreign currency exchange, privacy, data protection, data governance, cybersecurity, banking secrecy, digital payments, cryptocurrency, payment services (including payment processing and settlement services), lending, fraud detection, consumer protection, antitrust and competition, economic and trade sanctions, anti-money laundering, and counter-terrorist financing.

Regulators and legislators globally have been establishing, evolving, and increasing their regulatory authority, oversight, and enforcement, and it can be difficult to predict how these may be applied to our business and the way we conduct our operations.

As we introduce new products and services and expand into new markets, including through acquisitions, we expect to become subject to additional regulations, restrictions, and licensing requirements.

As we expand and localize our international activities, we expect that our obligations in the markets in which we operate will continue to increase.

In addition, because we facilitate sales of goods and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws or other types of regulation, which may impose different, more specific, and/or conflicting obligations on us, as well as broader liability.

We may not be able to respond quickly or effectively to regulatory, legislative, and other developments, any failure or perceived failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to or expansion of their interpretation) may result in audits, inquiries, investigations, whistleblower complaints, and adverse media coverage;

subject us to significant fines, penalties, monetary damages, injunctive relief, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions;

result in additional compliance and licensure requirements;

cause us to temporarily or permanently lose existing licenses or prevent or delay us from obtaining additional licenses that may be required for our business;

increase regulatory scrutiny of our business;

divert management’s time and attention from our business;

restrict our operations;

lead to increased friction for customers;

force us to make changes to our business practices, products, or operations;

require us to engage in remediation activities;

or delay planned transactions, product launches, or improvements.

Any of the foregoing could, individually or in the aggregate, harm our reputation, damage our brands and business, and adversely affect our results of operations and financial condition.

The complexity of U.S.

federal and state and international regulatory and enforcement regimes, coupled with the global scope of our operations and the evolving global regulatory environment, could result in a single event prompting a large number of overlapping investigations and legal and regulatory proceedings by multiple government authorities in different jurisdictions.

While we have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, there can be no assurance that our employees, contractors, and agents will not violate such laws and regulations.

Cryptocurrency Regulation and Related Risks

Our customer cryptocurrency offerings could subject us to additional regulations, licensing requirements, or other obligations or liabilities.

Within the U.S., we are regulated by the New York State Department of Financial Services as a virtual currency business, which does not qualify us to engage in securities brokerage or dealing activities.

The regulatory status of particular cryptocurrencies is unclear under existing law.

For example, if the SEC were to assert that any of the cryptocurrencies we support are securities, the SEC could assert that our activities involving that cryptocurrency require securities broker-dealer registration or other obligations under the federal securities laws.

The rapidly evolving legislative and regulatory landscapes with respect to cryptocurrency may subject us to additional licensing and regulatory obligations or to inquiries or investigations from various regulators and governmental authorities, and require us to make product changes, restrict or discontinue product offerings in certain markets, implement additional and potentially costly controls, or take other actions.

In August 2023, a third-party issuer with which we have partnered commercially (the “PYUSD Issuer”) launched a U.S.

dollar-denominated stablecoin named PayPal USD (“PYUSD”), which is available to PayPal U.S.

customers and Venmo customers.

These PayPal and Venmo customers may, if provisioned for external transfers and subject to our sanctions and anti-money laundering controls, send PYUSD to external wallets not controlled by PayPal.

The PYUSD Issuer may also allow institutional users to directly purchase PYUSD from the PYUSD Issuer (as per the PYUSD Issuer’s stablecoin terms and conditions).

The regulatory treatment of stablecoins is evolving and has drawn significant attention from legislative and regulatory bodies around the world, including the SEC.

Although stablecoin legislation is currently pending in the U.S.

Congress, there remain uncertainties on how ongoing changes to federal, state, and international laws and regulations will apply to stablecoins in practice, and we and the PYUSD Issuer may face substantial costs to operationalize and comply with any additional or changed requirement.

If we or the PYUSD Issuer fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, we could face regulatory or other enforcement actions, potential fines, penalties, and other consequences.

In addition, we could face reputational harm through our relationship with the PYUSD Issuer if the PYUSD Issuer were to face regulatory scrutiny, PYUSD is deemed to be a security, or PYUSD is alleged to be used for transactions in connection with illicit or illegal activities.

We hold our customers’ cryptocurrency assets through one or more third-party custodians.

Financial and third-party risks related to our customer cryptocurrency offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodians, insufficient insurance coverage by a custodian to reimburse us for all such losses, a custodian’s failure to maintain effective controls over the custody and settlement services provided to us, a custodian’s inability to purchase or liquidate cryptocurrency holdings, the failure of the PYUSD Issuer to maintain sufficient reserve assets backing PYUSD and defaults on financial or performance obligations by a custodian, banks with which the PYUSD Issuer maintains reserve assets or counterparty financial institutions, could expose our customers and us to loss, and significantly harm our business, financial condition, and reputation.

We have selected custodian partners and the PYUSD Issuer, and may in the future select additional custodian partners and stablecoin issuing entities, that are subject to regulatory oversight, capital requirements, maintenance of audit and compliance industry certifications, and cybersecurity procedures and policies.

Nevertheless, any operational disruptions at any such custodian or issuer, or such custodians’ or issuer’s failure to safeguard cryptocurrency holdings (or reserve assets), could result in losses of customer assets, expose us to customer claims, reduce consumer confidence and materially impact our cryptocurrency product offerings and our operating results.

Custodial arrangements to safeguard cryptocurrency assets involve unique risks and uncertainties in the event of a custodian’s bankruptcy.

While other types of assets and some custodied cryptocurrencies have been deemed not to be part of the custodian’s bankruptcy estate under various regulatory regimes, bankruptcy courts have not yet definitively determined the appropriate treatment of custodial holdings of digital assets in a bankruptcy proceeding.

In the event of a custodian’s bankruptcy, the lack of precedent and the highly fact-dependent nature of the determination could delay or preclude the return of custodied cryptocurrency assets to us or to our customers.

Although we contractually require our custodians to segregate our customer assets and not commingle them with proprietary or other assets, we cannot be certain that these contractual obligations, even if duly observed by a custodian, will be effective in preventing such assets from being treated as part of the custodian’s estate under bankruptcy or other insolvency law.

In that event, our claim on behalf of such customers against a custodian’s estate for our customers’ cryptocurrency assets could be treated as a general unsecured claim against the custodian, in which case our customers could seek to hold us liable for any resulting losses.

We are regularly subject to general litigation, regulatory scrutiny, and government inquiries.

We are regularly subject to claims, individual and class action lawsuits, arbitration proceedings, government and regulatory investigations, inquiries, actions or requests, and other proceedings alleging violations of laws, rules, and regulations with respect to competition, antitrust, intellectual property, privacy, data protection, information security, anti-money laundering, counter-terrorist financing, sanctions, anti-bribery, anti-corruption, consumer protection (including unfair, deceptive, or abusive acts or practices), the terms of our customer agreements, fraud, accessibility, securities, tax, labor and employment, commercial disputes, services, charitable fundraising, contract disputes, escheatment of unclaimed or abandoned property, product liability, use of our services for illegal purposes, the matters described in “Note 13—Commitments and Contingencies—Litigation and Regulatory Matters—General Matters” to our condensed consolidated financial statements, and other matters.

We expect that the number and significance of these disputes and inquiries will continue to increase as our products, services, and business expand in complexity, scale, scope, and geographic reach, including through acquisitions of businesses and technology, and as a result of expanded enforcement of certain existing laws and regulations by federal, state and local agencies.

For example, there is an increase in enforcement activity in connection with federal and state consumer protection laws, including suits which seek civil penalties.

Investigations, changes in, or expanded enforcement of federal, state or local laws and regulations, and legal proceedings are inherently uncertain, expensive and disruptive to our operations, and could result in substantial judgments, fines, penalties or settlements, substantial diversion of management’s time and effort, negative publicity, reputational harm, criminal sanctions, or orders that prevent or limit us from offering certain products or services;

require us to change our business practices or customer agreement terms in ways that may increase costs or reduce revenues, develop non-infringing or otherwise altered products or technologies, or pay substantial royalty or licensing fees;

or delay or preclude planned transactions or product launches or improvements.

Determining legal reserves or possible losses from such matters involves significant estimates and judgments and may not reflect the full range of uncertainties and unpredictable outcomes.

We may be exposed to losses in excess of the amount recorded, and such amounts could be material.

If our estimates and assumptions change or prove to have been incorrect, this could have a material adverse effect on our business, financial position, results of operations, or cash flows.

We rely on third parties in many aspects of our business, which creates additional risk.

We rely on third parties in many aspects of our business, including, but not limited to, networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions;

unaffiliated third-party lenders to originate our U.S.

credit products to consumers, U.S.

merchant financing, and branded credit card products;

branded debit card and savings products issued by unaffiliated banks;

cryptocurrency custodial service providers;

and external business partners and contractors who provide key functions (including, but not limited to, data center facilities and cloud computing, information technology, and outsourced customer support and product development functions).

We are subject to additional risks inherent in engaging and relying upon third-party providers, including operational, legal, regulatory, information security, reputational, commercial, and resiliency risks.

If we are unable to effectively manage our third-party relationships, these third parties are unable to meet their obligations to us, we are overly reliant on certain relationships, we are unable to negotiate favorable contractual terms, or we experience substantial disruptions in these relationships (including interruptions to the availability of our products and services), our operations, results of operations, liquidity and financial results could be adversely impacted.

Additionally, our relationships with third parties inherently involve a lesser degree of control over business operations, governance, and compliance, which potentially increases our financial, legal, reputational, and operational risk.

Any factors that reduce cross-border trade or make such trade more difficult could harm our business.

Cross-border trade (i.e., transactions where the merchant and consumer are in different countries) is an important source of our revenues and profits.

Cross-border transactions generally provide higher revenues and operating income than similar transactions that take place within a single country or market.

In certain markets, cross-border trade represents our primary (and in some instances our only) offerings.

Cross-border trade may be negatively impacted by various factors including foreign exchange rate fluctuations, changes in or new tariffs, trade wars, barriers or restrictions, or threats of such actions, sanctions, import or export controls, and the interpretation and application of laws of multiple jurisdictions in the context of cross-border trade and foreign exchange.

Any factors that increase the costs or uncertainty of cross-border trade for us or our customers or that restrict, delay, or make cross-border trade more difficult or impractical could reduce our cross-border transactions and volume, negatively impact our revenues and profits, and harm our business.

Our international operations subject us to increased risks, which could harm our business.

Our international operations generate a significant portion of our net revenues.

Our international operations subject us to significant challenges, uncertainties, and risks, including, but not limited to, local regulatory, licensing, reporting, and legal obligations;

costs and challenges associated with operating in markets in which we may have limited or no experience, including effectively localizing our products and services and adapting them to local preferences;

difficulties in developing, staffing, and simultaneously managing a large number of varying foreign operations as a result of distance, language, and cultural differences and in light of varying laws, regulations, and customs;

differing employment practices and the existence of works councils;

difficulties in recruiting and retaining qualified employees and maintaining our company culture;

fluctuations in foreign exchange rates;

exchange control regulations;

profit repatriation restrictions;

changes in or new tariffs, sanctions, fines, or other trade barriers or restrictions;

import or export regulations;

compliance with U.S.

and foreign anti-bribery, anti-corruption, sanctions, anti-money laundering and counter-terrorist financing laws and regulations;

the interpretation and application of laws of multiple jurisdictions;

and national or regional political, economic, or social instability.

In addition, some countries have enacted or are considering data localization or residency laws, which require that certain data be maintained, stored and/or processed within their country of origin.

Maintaining local data centers in individual countries could significantly increase our operating costs.

Our international operations also may heighten many of the other risks described in this “Risk Factors” section.

Any violations of the complex foreign and U.S.

laws, rules and regulations that may apply to our international operations may result in lawsuits, enforcement actions, criminal actions, or sanctions against us and, our directors, officers, and employees;

prohibit or require us to change our business practices;

and damage our reputation.

Although we have implemented policies and procedures designed to promote compliance with these laws, there can be no assurance that our employees, contractors, or agents will not violate our policies.

These risks are inherent in our international operations, may increase our costs of doing business internationally, and could materially and adversely affect our business.

Global and regional economic conditions could harm our business.

Adverse global and regional economic conditions such as political unrest and turmoil affecting the banking system or financial markets, including, but not limited to, tightening in the credit markets, extreme volatility or distress in the financial markets (including the fixed income, credit, currency, equity, and commodity markets), unemployment, consumer debt levels, recessionary or inflationary pressures, supply chain issues, reduced consumer confidence or economic activity, government fiscal, monetary and tax policies, U.S.

and international trade relationships, agreements, treaties, changes in or new tariffs and restrictive actions or threats of such actions, including an escalation of trade tensions between the U.S.

and its trading partners, the inability of a government to enact a budget in a fiscal year, government shutdowns, government austerity programs, geopolitical conditions or events, and other negative financial news or macroeconomic developments could have a material adverse impact on the demand for our products and services, including a reduction in the volume and size of transactions on our payments platform.

In particular, recent tariffs and reciprocal trade measures enacted or threatened to be enacted by the U.S.

and other countries have led to increased volatility and uncertainty in certain parts of the global economy.

We cannot predict the timing, strength or duration of the current or any future potential economic volatility or slowdown in the U.S.

These conditions could have a material adverse impact on the demand for our products and services which could adversely affect our results of operations.

Additionally, any inability to access the capital markets when needed due to volatility or illiquidity in the markets, liquidity needs due to unanticipated reductions in customer balances, or increased regulatory liquidity and capital requirements may strain our liquidity position.

Such conditions may also expose us to fluctuations in foreign exchange rates or interest rates that could materially and adversely affect our financial results.

Environmental, social and governance (“ESG”) issues may have an adverse effect on our business, financial condition and results of operations and damage our reputation.

Investors, customers, employees, regulators, legislators and other stakeholders are increasingly focused on ESG matters and related disclosures, including with respect to cybersecurity, data privacy and protection, global talent and climate, and new ESG laws and regulations are expanding mandatory disclosure, reporting and diligence requirements.

If we are unable to comply with new laws and regulations or changes to legal or regulatory requirements concerning ESG matters, or fail to meet investor, industry or stakeholder expectations and standards, our reputation may be harmed, customers may choose to refrain from using our products and services, we may be subject to fines, penalties, regulatory or other enforcement actions, and our business or financial condition may be adversely affected.

We may also experience additional scrutiny or criticism from investors, customers, partners, media, government entities, and other stakeholders if they perceive PayPal to not have acted appropriately with respect to ESG matters.

If our ESG-related data, processes and reporting are incomplete or inaccurate, or if we fail to achieve progress with respect to ESG-related goals on a timely basis, or at all, our reputation, business, financial performance and growth could be adversely affected.

We specifically recognize the inherent physical climate-related risks where we conduct business.

Our primary locations may be vulnerable to the adverse effects of climate change.

For example, California, where our headquarters are located, has historically experienced, and is projected to continue to experience, extreme weather and natural disaster events more frequently, including drought, water scarcity, flooding, heat waves, wildfires and resultant air quality impacts, and power shutoffs associated with wildfire prevention.

Such events may disrupt our business and may cause us to experience additional costs to maintain or resume operations and higher attrition.

Various jurisdictions are adopting or considering new laws and regulations that expand or curtail disclosure, reporting and diligence requirements with respect to ESG matters.

If we are unable to comply with new laws, regulations or guidance concerning ESG matters or fail to meet investor, industry or stakeholder expectations and standards, our reputation may be harmed, customers may choose to refrain from using our products and services, we may be subject to fines, penalties, regulatory or other enforcement actions, and our business or financial condition may be adversely affected.

If our ESG-related data, processes and reporting are viewed as incomplete or inaccurate, or if we fail to achieve progress with respect to ESG-related goals on a timely basis or at all, we may be viewed negatively by stakeholders concerned about these matters.

Moreover, investors, customers, partners, media, government entities, and other stakeholders (including those in support of or in opposition to ESG principles) may have a negative view of us to the extent we are perceived to have not responded appropriately to their ESG concerns or take positions that are contrary to their views or expectations.

We recognize that climate-related risks may impact our business.

Such events may disrupt our business and may cause us to experience additional costs to maintain or resume operations.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors