What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-02-03 compared with 2025-02-04 · 204 added, 187 removed, 271 unchanged (59% of the section changed)

4 unchanged sentences

Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition.

The techniques used to attempt to obtain unauthorized or illegal access to systems and information (including customers’ personal data), disable or degrade service, exploit vulnerabilities, or sabotage systems are continuously evolving.

In some circumstances, these attempts may not be recognized or detected until after they have been launched against a target.

Unauthorized parties continuously attempt to gain access to our systems or facilities through various means, including through hacking into our systems or facilities or those of our customers, partners, or vendors, and attempting to fraudulently induce users of our systems (including employees, vendor and partner personnel and customers) into disclosing user names, passwords, payment card information, multi-factor authentication application access or other sensitive information used to gain access to such systems or facilities.

This information may, in turn, be used to access our customers’ confidential personal or proprietary information and financial instrument data that are stored on or accessible through our information technology systems and those of third parties with whom we partner.

This information may also be used to execute fraudulent transactions or otherwise engage in fraudulent actions.

Numerous and evolving cybersecurity and related threats, including advanced and persisting cyberattacks, cyberextortion, distributed denial-of-service attacks, ransomware, spear phishing and social engineering schemes, the introduction of computer viruses or other malware, and the physical destruction of all or portions of our information technology and infrastructure and those of third parties with whom we partner or that are part of our information technology supply chain, are becoming increasingly sophisticated and complex, may be difficult to detect, and could compromise the confidentiality, availability, and integrity of the data in our systems, as well as the systems themselves.

Techniques used to attempt to obtain unauthorized or illegal access to systems and information (including customers’ personal data), disable or degrade service, exploit vulnerabilities, or sabotage systems are continuously evolving.

These attempts may not be recognized or detected until after they have been launched against a target.

Unauthorized parties continuously attempt to gain access to our systems or facilities through various means, including through hacking into our systems or facilities or those of our customers, partners, or vendors, and attempting to fraudulently induce users of our systems (including customers, employees, and partner and vendor personnel) into disclosing user names, passwords, payment card information, multi-factor authentication application access or other sensitive information used to gain access to such systems or facilities.

This information may, in turn, be used to access our customers’ confidential personal or proprietary information and financial instrument data that are stored on or accessible through our information technology (“IT”) systems and those of third parties with whom we partner.

This information may also be used to execute fraudulent transactions or other activity.

Numerous and evolving cybersecurity and related threats, including advanced and persisting cyberattacks, artificial intelligence (“AI”)-enabled threats, cyberextortion, distributed denial-of-service attacks, ransomware, spear phishing and social engineering schemes, the introduction of computer viruses or other malware, and the destruction of all or portions of our IT and infrastructure and those of third parties with whom we partner or that are part of our IT supply chain, are becoming increasingly sophisticated and complex, may be difficult to detect, and could compromise the confidentiality, availability, and integrity of the data in our systems, as well as the systems themselves.

We believe that hostile actors, who may comprise individuals, coordinated groups, sophisticated organizations, or nation-state supported entities, may target PayPal due to our name, brand recognition, types of data (including sensitive payments- and identity-related data) that customers provide to us, and the widespread adoption and use of our products and services.

We have experienced from time to time, and may experience in the future, cybersecurity incidents, including breaches of our security measures, network breaches, and compromise of personally identifiable customer information due to human error, deception, malfeasance, insider threats, system errors, defects, vulnerabilities, or other issues.

Any of the foregoing events may subject us to fines, penalties, regulatory or other enforcement actions, and our business, reputation or financial condition may be adversely affected.

Any cybersecurity incidents, including cyberattacks or data security breaches affecting the information technology or infrastructure of our customers, partners, or vendors (including data center and cloud computing providers) or of companies we acquire, could have similar negative effects.

Under payment card network rules and our contracts with our payment processors, if there is a breach of payment card information stored by us or our direct payment card processing vendors, we could be liable to the payment card issuing banks, including for their cost of issuing new cards and related expenses.

Any of the foregoing events may subject us to fines, penalties, regulatory or other enforcement actions, and adversely affect our business, reputation, or financial condition.

Any cybersecurity incidents, including cyberattacks or data security breaches affecting the IT or infrastructure of our customers, partners, or vendors (including data center and cloud computing providers) or of companies we acquire, could have similar negative effects.

We have experienced, and may experience in the future, breaches involving customer information for which we have notified, and may notify, regulators, customers and other third parties.

1 unchanged sentence

Moreover, under payment card network rules and our contracts with our payment processors, if there is a breach of payment card information stored by us or our direct payment card processing vendors, we could be liable to the payment card issuing banks, including for their cost of issuing new cards and related expenses.

While we maintain insurance policies intended to help offset the financial impact we may experience from these risks, our coverage may be insufficient to compensate us for all losses caused by security breaches and other damage to or

unavailability of our systems.

While we maintain insurance to help offset the financial impact of these risks, our coverage may be insufficient to cover all our losses caused by security breaches and other damage to or unavailability of our systems.

FY 2025 FORM 10-K

Business interruptions or systems failures may impair the availability of our websites, applications, products or services, or otherwise harm our business.

2 unchanged sentences

Our corporate headquarters are located in the San Francisco Bay Area, a seismically active region in California.

A catastrophic event that could lead to a disruption or failure of our systems or operations could result in significant losses and require substantial recovery time and significant expenditures to resume or maintain operations.

Further, some of our systems, including those of companies that we have acquired, are not fully redundant and any failure of these acquired systems, including due to a catastrophic event, may lead to operational outages or delays.

A catastrophic event that results in a disruption to or failure of our systems or operations could result in significant losses and require substantial recovery time and significant expenditures to resume or maintain operations.

Some of our systems, including those of companies that we have acquired, are not fully redundant and any failure of these systems, including due to a catastrophic event, may lead to operational outages or delays.

While we engage in disaster recovery planning and testing intended to mitigate risks from outages or delays, our planning and testing may not be effective or sufficient for all possible outcomes or events.

1 unchanged sentence

Any of the foregoing risks could have a material adverse impact on our business, financial condition, and results of operations.

We have experienced, and expect to continue to experience, system failures, cyberattacks, unplanned outages, and other events or conditions from time to time that have and may interrupt the availability, or reduce or adversely affect the speed or functionality, of our products and services.

While we continue to undertake system upgrades and re-platforming efforts designed to improve the availability, reliability, resiliency, and speed of our payments platform, these efforts are costly and time-consuming, involve significant technical complexity and risk, may divert our resources from new features and products, and may ultimately not be effective.

We have experienced, and expect to continue to experience, system failures, cyberattacks, unplanned outages, and other events or conditions that have or may interrupt the availability, or reduce or adversely affect the speed or functionality, of our products and services.

While we continue to undertake system upgrades and re-platforming efforts designed to improve the availability, reliability, resiliency, and speed of our platform, these efforts are costly and time-consuming, involve significant technical complexity and risk, may divert our resources from new features and products, and may ultimately not be effective.

A prolonged interruption of, or reduction in, the availability, speed, or functionality of our products and services could materially harm our business and financial condition.

Frequent or persistent interruptions in our services could permanently harm our relationship with our customers and partners and our reputation.

For example, in August 2025, PayPal experienced a temporary service disruption triggered by a coding error in a system update, which primarily impacted a limited number of customers and partners in Germany.

In connection with this disruption, we experienced some fraudulent transaction activity for a limited time period.

We have incurred transaction losses and other expenses as a result, including claims under our protection programs, and this or other disruptions may subject us to increased regulatory scrutiny, fines, penalties and litigation.

Frequent or persistent interruptions in or disruptions to our services could permanently harm our relationship with our customers and partners and our reputation.

If any system failure or similar event results in damage to our customers or their business partners, they could seek significant compensation or contractual penalties from us for their losses.

These claims, even if unsuccessful, would likely be time-consuming and costly for us to address.

We also rely on facilities, components, applications, software, and services supplied by third parties, including data center facilities and cloud data storage and processing services.

We rely on facilities, components, applications, software, and services supplied by third parties, including data center facilities and cloud data storage and processing services.

From time to time, we have experienced interruptions in the provision of such facilities and services provided by these third parties.

If these third parties experience operational interference or disruptions (including a cybersecurity incident), fail to perform their obligations, or breach their agreements with us, our operations could be disrupted or negatively affected, which could result in customer dissatisfaction, regulatory scrutiny, and damage to our reputation and brands, and materially and adversely affect our business.

In addition, any failure to successfully implement new information systems and technologies or improvements or upgrades to existing information systems and technologies in a timely manner could lead to regulatory scrutiny, significant fines and penalties, and mandatory and costly changes to our business, adversely impact our business, internal controls, results of operations, and financial condition, and ultimately could cause us to lose existing licenses that we need to operate or prevent or delay us from obtaining additional licenses that may be required for our business.

While we maintain business interruption insurance, our coverage may be insufficient to cover all our losses caused by interruptions in our service due to systems failures and similar events.

In addition, any failure to successfully implement new information systems and technologies or improvements or upgrades to existing information systems and technologies in a timely manner could lead to regulatory scrutiny, significant fines and penalties, and mandatory and costly changes to our business, adversely impact our business, internal controls, results of operations, and financial condition, and ultimately cause us to lose existing licenses that we need to operate or prevent or delay us from obtaining additional licenses that may be required for our business.

If we cannot keep pace with rapid technological developments to provide new and innovative products and services, the use of our products and services and, consequently, our revenues, could decline.

Rapid, significant, and disruptive technological changes impact the industries in which we operate, including payment technologies (including real-time payments, payment card tokenization, virtual currencies, distributed ledger and blockchain technologies, and proximity payment technology such as Near Field Communication and other contactless payments);

internet browser technologies that enable users to easily store their payment card information for use on any retail or e-commerce website;

artificial intelligence (“AI”) and machine learning;

developments in technologies supporting our regulatory and

compliance obligations;

and in-store, digital, and social commerce.

We expect that new technologies applicable to the industries in which we operate, including the development, adoption, and use of generative AI technologies, will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services.

web browser technologies that enable users to easily store their payment card information for use on any retail or e-commerce

FY 2025 FORM 10-K

developments in technologies supporting our regulatory and compliance obligations;

and in-store, digital, agentic and social commerce.

We expect that new technologies applicable to the industries in which we operate, including the development, adoption, and use of generative AI technologies and autonomous AI agents, will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services.

We cannot predict the effects of technological changes on our business, which technological developments or innovations will become widely adopted, and how those technologies may be regulated.

6 unchanged sentences

These third parties may restrict or prevent our access to, or utilization of, those technologies, as well as their platforms or products.

Our ability to develop, provide or incorporate new technologies and adapt our existing products and services or develop future and new products and services using new technologies may be limited or restricted by industry-wide standards, platform providers, payments networks, changes to laws and regulations, changing customer expectations, third-party intellectual property rights, and other factors.

Our ability to adapt our existing products and services to incorporate new technologies or develop future and new products and services using new technologies may be limited or restricted by industry-wide standards, platform providers, payments networks, changes to laws and regulations, changing customer expectations, third-party intellectual property rights, and other factors.

If we are unable to develop and incorporate new technologies and adapt to technological changes and evolving industry standards in a timely or cost-effective manner, our business, results of operations, or reputation could be harmed.

2 unchanged sentences

Our failure to comply with extensive, complex, overlapping, and frequently changing rules, regulations, and legal interpretations could materially harm our business.

Our business is subject to complex and changing laws, rules, regulations, policies, and legal interpretations in the markets in which we offer services directly or through partners, including, but not limited to, those governing:

Our business is subject to complex and changing laws, rules, regulations, policies, licensing schemes, and legal interpretations in the markets where (and relating to the industries and merchants to which) we offer services directly or through partners, including, but not limited to, those governing:

banking, credit, deposit taking, cross-border and domestic money transmission, prepaid access, foreign currency exchange, privacy, data protection, data governance, cybersecurity, banking secrecy, digital payments, cryptocurrency, payment services (including payment processing and settlement services), lending, fraud detection, consumer protection, antitrust and competition, economic and trade sanctions, anti-money laundering, and counter-terrorist financing.

Regulators and legislators globally have been establishing, evolving, and increasing their regulatory authority, oversight, and enforcement in a manner that impacts our business.

As we introduce new products and services and expand into new markets, including through acquisitions, we expect to become subject to additional regulations, restrictions, and licensing requirements.

Regulators and legislators globally continue to establish, evolve, and increase their regulatory authority, oversight, and enforcement, and it may be difficult to predict how these may be applied to our business and the way we conduct our operations.

As we introduce new products and services and expand into new markets and support new industries and merchants, including through acquisitions, we expect to become subject to additional regulations, restrictions, and licensing requirements.

As we expand and localize our international activities, we expect that our obligations in the markets in which we operate will continue to increase.

In addition, because we facilitate sales of goods and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws, which may impose different, more specific, or conflicting obligations on us, as well as broader liability.

Any failure or perceived failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to or expansion of their interpretation) may subject us to significant fines, penalties, monetary damages, injunctive relief, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions;

In addition, because we facilitate sales of goods and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws and regulations, which may impose different, more specific, and/or conflicting obligations on us, as well as broader liability.

We may not be able to respond quickly or effectively to regulatory, legislative, and other developments, and any failure or perceived failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to or expansion of their interpretation) may result in audits, inquiries, investigations, whistleblower complaints, and adverse media coverage;

subject us to significant fines, penalties, monetary damages, injunctive relief, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions;

result in additional compliance and licensure requirements;

cause us to lose existing licenses or prevent or delay us from obtaining additional licenses that may be required for our business;

cause us to temporarily or permanently lose existing licenses or prevent or delay us from obtaining additional licenses that may be required for our business;

increase regulatory scrutiny of our business;

2 unchanged sentences

lead to increased friction for customers;

lead to loss of banking and other commercial partner relationships;

force us to make changes to our business practices, products, or operations;

3 unchanged sentences

The complexity of U.S.

federal and state and international regulatory and enforcement regimes, coupled with the global scope of our operations and the evolving global regulatory environment, could result in a single event prompting a large number of overlapping investigations and legal and regulatory proceedings by multiple government authorities in different jurisdictions.

FY 2025 FORM 10-K

government authorities in different jurisdictions.

While we have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, there can be no assurance that our employees, contractors, and agents will not violate such laws and regulations.

7 unchanged sentences

et Cie, S.C.A.

(“PayPal (Europe)”), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg and PayPal U.K.

Limited (“PayPal U.K.”), a wholly-owned subsidiary that is subject to regulation as an electronic money institution and a consumer credit firm (and registration as a crypto asset business) in the United Kingdom (“U.K.”) by the Financial Conduct Authority (“FCA”).

(“PayPal (Europe)”), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg, and to our customers in the United Kingdom (“U.K.”) through PayPal U.K.

Limited (“PayPal U.K.”), a wholly-owned subsidiary that is subject to regulation as an electronic money institution and a consumer credit firm (and registered as a crypto asset business) in the U.K.

by the Financial Conduct Authority (“FCA”).

PayPal (Europe) or PayPal U.K.

may be subject to enforcement actions and significant fines and penalties if either violates applicable requirements.

may be subject to enforcement actions and significant fines and penalties if they violate applicable requirements.

If the business activities of PayPal (Europe) exceed certain thresholds, or if the European Central Bank (“ECB”) so determines, PayPal (Europe) may be deemed a significant supervised entity and certain activities of PayPal (Europe) would become directly supervised by the ECB, rather than by the Luxembourg Commission de Surveillance du Secteur Financier.

PayPal (Europe) is also subject to regulation by the ECB under the oversight framework for electronic payment instruments, schemes and arrangements (“PISA”).

Compliance with applicable laws and regulations could become more costly and operationally difficult to manage due to additional supervision, potentially inconsistent interpretations, and domestic regulations by various countries in the region.

Applicable regulation relating to payments, anti-money laundering, and digital services, which are key focus areas of regulators and subject to extensive new regulation, could subject us to additional and complex obligations, risks, and associated costs, and impact our ability to expand our business in Europe.

For many of the other markets outside the U.S., we provide services on a cross-border basis through PayPal Pte.

Applicable regulation relating to payments, anti-money laundering, and digital services, which are key focus areas of European regulators and subject to extensive new regulation, could subject us to additional and complex obligations, risks, and associated costs, and impact our ability to expand our business in Europe.

For many of our other markets outside the U.S., we provide services on a cross-border basis through PayPal Pte.

Ltd., our wholly-owned subsidiary based in Singapore.

is supervised by the Monetary Authority of Singapore (“MAS”).

As of July 1, 2023, PayPal Pte.

has been issued a Major Payment Institution license by the MAS under the Payment Services Act 2019.

is supervised by the Monetary Authority of Singapore (“MAS”), and in July 2023 was issued a Major Payment Institution license by the MAS under the Payment Services Act 2019.

In order to maintain this license and certain other licenses or registrations we hold in certain markets, we are required to comply with applicable regulatory requirements, which have imposed and will continue to impose increasing operational complexity and costs for our Singapore and international operations.

2 unchanged sentences

or local branches or subsidiaries subject to local regulatory supervision or oversight, as the case may be, are located, there may be uncertainty whether our Singapore-based service is subject only to Singapore law or also to other local laws, and whether such local laws might require a payment processor like us to be licensed as a payments service, bank, financial institution, or otherwise.

There are substantial costs and potential product and operational changes involved in maintaining and renewing licenses, certifications, and approvals, and we could be subject to enforcement actions, fines, penalties, and litigation if we are found to violate any of these requirements.

There are substantial costs and potential product and operational considerations involved in maintaining and renewing licenses, certifications, and approvals, and we could be subject to enforcement actions, fines, penalties, and litigation if we are found to violate any of these requirements.

There can be no assurance that we will be able to (or decide to) continue to apply for or obtain any licenses, renewals, certifications, and approvals in any jurisdiction.

In certain markets, we may need to rely on local banks or other partners to process payments and conduct foreign currency exchange transactions in local currency, and local regulators may use their authority over such local partners to prohibit, restrict, or limit us from doing business.

Any of the foregoing could, individually or in the aggregate, result in substantial additional costs, delay or preclude planned transactions, geographical expansions, or product launches or improvements, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, products and services, or prevent or limit us from providing our products or services in a given market.

In certain markets, we may need to rely on local banks or other partners to process payments and conduct foreign currency exchange transactions in local currency, and local regulators may use their authority, including over such local partners, to prohibit, restrict, or limit us from doing business.

Any of the foregoing could, individually or in the aggregate, result in substantial additional costs, delay or preclude planned transactions, geographical expansion, or product launches or improvements, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, products and services, or prevent or limit us from providing our products or services in a given market.

Cryptocurrency Regulation and Related Risks

Our customer cryptocurrency offerings could subject us to additional regulations, licensing requirements, or other obligations or liabilities.

Within the U.S., we are regulated by the New York State Department of Financial Services as a virtual currency business, which does not qualify us to engage in securities brokerage or dealing activities.

Our customer cryptocurrency offerings may subject us to additional regulations, licensing requirements, or other obligations or liabilities.

Within the U.S., we are regulated by the New York State Department of Financial Services as a virtual currency

FY 2025 FORM 10-K

business, which does not permit us to engage in securities brokerage or dealing activities.

Additionally, we are a digital asset service provider under the Guiding and Establishing National Innovation for U.S.

Stablecoins Act of 2025 (the “GENIUS Act”), which subjects us to obligations relating to our cryptocurrency business and may affect the competitive landscape for payment stablecoins.

The regulatory status of particular cryptocurrencies is unclear under existing law.

For example, if the Securities and Exchange Commission (“SEC”) were to assert that any of the cryptocurrencies we support are securities, the SEC could assert that our activities involving that cryptocurrency require securities broker-dealer registration or other obligations under the federal securities laws.

The rapidly evolving

legislative and regulatory landscapes with respect to cryptocurrency may subject us to additional licensing and regulatory obligations or to additional inquiries or investigations from the SEC or other regulators and governmental authorities, and require us to make product changes, restrict or discontinue product offerings in certain markets, implement additional and potentially costly controls, or take other actions.

The evolving legislative and regulatory landscapes with respect to cryptocurrency in addition to stablecoins may subject us to additional licensing and regulatory obligations or to inquiries or investigations from various regulators and governmental authorities, and require us to change, restrict or discontinue product offerings in certain markets, implement additional and potentially costly controls, or take other actions.

In August 2023, a third-party issuer with which we have partnered commercially (the “PYUSD Issuer”) launched a U.S.

dollar-denominated stablecoin named PayPal USD (“PYUSD”), which is available to PayPal U.S.

customers and Venmo customers.

dollar-denominated stablecoin named PayPal USD (“PYUSD”), which is available to PayPal customers and Venmo customers in certain markets.

These PayPal and Venmo customers may, if provisioned for external transfers and subject to our sanctions and anti-money laundering controls, send PYUSD to external wallets not controlled by PayPal.

The PYUSD Issuer may also allow institutional users to directly purchase PYUSD from the PYUSD Issuer (as per the PYUSD Issuer’s stablecoin terms and conditions).

The regulatory treatment of stablecoins is evolving and has drawn significant attention from legislative and regulatory bodies around the world, including the SEC.

There are uncertainties on how ongoing changes to federal, state, and international laws and regulations would apply to stablecoins in practice, and we and the PYUSD Issuer may face substantial costs to operationalize and comply with any additional or changed requirement.

If we or the PYUSD Issuer fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, we could face regulatory or other enforcement actions, potential fines, penalties, and other consequences.

In addition, we could face reputational harm through our relationship with the PYUSD Issuer if the PYUSD Issuer were to face regulatory scrutiny, PYUSD is deemed to be a security, or PYUSD is alleged to be used for transactions in connection with illicit or illegal activities.

The regulatory treatment of stablecoins is evolving and has drawn significant attention from legislative and regulatory bodies around the world.

The recently enacted GENIUS Act provides a regulatory framework that is in the process of being implemented.

While PYUSD is designed to comply with this U.S.

framework, there remain uncertainties on how ongoing changes to international laws and regulations will apply to stablecoins in practice, and we and the PYUSD Issuer may face substantial costs and risks to operationalize and comply with any additional or changed requirements.

If we or the PYUSD Issuer fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, or make operational errors, we could face regulatory or other enforcement actions, potential fines, penalties, and other consequences.

In addition, we could face reputational harm through our relationship with the PYUSD Issuer if the PYUSD Issuer were to face regulatory scrutiny or make operational errors or if PYUSD is alleged to be used for transactions in connection with illicit or illegal activities.

We hold our customers’ cryptocurrency assets through one or more third-party custodians.

Financial and third-party risks related to our customer cryptocurrency offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodians, insufficient insurance coverage by a custodian to reimburse us for all such losses, a custodian’s failure to maintain effective controls over the custody and settlement services provided to us, a custodian’s inability to purchase or liquidate cryptocurrency holdings, the failure of the PYUSD Issuer to maintain sufficient reserve assets backing PYUSD and defaults on financial or performance obligations by a custodian, banks with which the PYUSD Issuer maintains reserve assets or counterparty financial institutions, could expose our customers and us to loss, and significantly harm our business, financial condition, and reputation.

We have selected custodian partners and the PYUSD Issuer, and may in the future select additional custodian partners and stablecoin issuing entities, that are subject to regulatory oversight, capital requirements, maintenance of audit and compliance industry certifications, and cybersecurity procedures and policies.

Nevertheless, any operational disruptions at any such custodian or issuer, or such custodians’ or issuer’s failure to safeguard cryptocurrency holdings (or reserve assets), could result in losses of customer assets, expose us to customer claims, reduce consumer confidence and materially impact our cryptocurrency product offerings and our operating results.

Financial and third-party risks related to our customer cryptocurrency offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodians, insufficient insurance coverage by a custodian to fully reimburse us for such losses, a custodian’s failure to maintain effective controls over the custody and settlement services provided to us, a custodian’s inability to purchase or liquidate cryptocurrency holdings, the failure of the PYUSD Issuer to maintain sufficient reserve assets backing PYUSD, and defaults on financial or performance obligations by a custodian, banks with which the PYUSD Issuer maintains reserve assets or counterparty financial institutions, could expose us and our customers to loss and significantly harm our business, financial condition, and reputation.

We have selected custodian partners and the PYUSD Issuer, and may in the future select additional custodian partners and stablecoin issuing entities subject to regulatory oversight, capital requirements, maintenance of audit and compliance industry certifications, and cybersecurity procedures and policies.

Any operational disruptions at any such custodian or issuer, or such custodians’ or issuer’s failure to safeguard cryptocurrency holdings (or reserve assets), could result in losses of customer assets, expose us to customer claims, reduce consumer confidence, harm our reputation, and materially impact our cryptocurrency product offerings and our operating results.

Custodial arrangements to safeguard cryptocurrency assets involve unique risks and uncertainties in the event of a custodian’s bankruptcy.

1 unchanged sentence

In the event of a custodian’s bankruptcy, the lack of precedent and the highly fact-dependent nature of the determination could delay or preclude the return of custodied cryptocurrency assets to us or to our customers.

Although we contractually require our custodians to segregate our customer assets and not commingle them with proprietary or other assets, we cannot be certain that these contractual obligations, even if duly observed by a custodian, will be effective in preventing such assets from being treated as part of the custodian’s estate under bankruptcy or other insolvency law.

Although we contractually require our custodians to segregate our customer assets and not commingle them with proprietary or other assets, we cannot assure that these contractual obligations, even if duly observed by a custodian, will be effective in preventing such assets from being treated as part of the custodian’s estate under bankruptcy or other insolvency law.

In that event, our claim on behalf of such customers against a custodian’s estate for our customers’ cryptocurrency assets could be treated as a general unsecured claim against the custodian, in which case our customers could seek to hold us liable for any resulting losses.

5 unchanged sentences

may be subject to consumer credit legislation, licensing requirements, consumer lending laws, consumer protection or banking transparency regulations.

Increased global regulatory focus on short-term installment products and consumer credit more broadly could result in laws or regulations requiring changes to our policies, procedures, operations, and product offerings, and restrict or limit our ability to offer credit products.

Increased global regulatory focus on short-term installment

FY 2025 FORM 10-K

products and consumer credit more broadly could result in laws or regulations requiring changes to our product offerings, policies, procedures, and operations, and restrict or limit our ability to offer credit products.

Consumer Protection

Violations of consumer protection law in applicable jurisdictions, including both federal and state laws and regulations in the U.S., such as the Electronic Fund Transfer Act (“EFTA”) and Regulation E as implemented by the Consumer Financial Protection Bureau (“CFPB”), could result in the assessment of significant actual damages or statutory damages or penalties (including treble damages in some instances) and plaintiffs’ attorneys’ fees.

We are subject to, and have paid amounts in settlement of, lawsuits containing allegations that our business violated the EFTA and Regulation E or otherwise advance claims for relief relating to our business practices (e.g., that we improperly held consumer funds or otherwise improperly limited consumer accounts).

In addition, the CFPB, pursuant to its market-monitoring authority, may require us to provide extensive information on our products and offerings.

From time to time, we have received orders from the CFPB pursuant to such market-monitoring authority requiring us to provide, among other items, extensive information on our payment products, including with respect to the collection, use of, and access to data and consumer protections, as well as our Buy Now, Pay Later offerings.

Violations of consumer protection law in applicable jurisdictions, including federal and state laws and regulations in the U.S.

such as the Electronic Fund Transfer Act (“EFTA”) and Regulation E as implemented by the Consumer Financial Protection Bureau (“CFPB”), could result in the assessment of significant actual damages or statutory damages or penalties (including treble damages in some instances) and plaintiffs’ attorneys’ fees.

We are subject to, and have paid amounts in settlement of, lawsuits alleging that our business violated the EFTA and Regulation E or otherwise advancing claims for relief relating to our business practices (e.g., that we improperly held consumer funds or otherwise improperly limited consumer accounts).

Anti-Money Laundering and Counter-Terrorist Financing;

1 unchanged sentence

Regulators globally continue to increase standards and expectations regarding anti-money laundering and counter-terrorist financing, and to expand the scope of existing laws and regulations to emerging products and markets, which may require us to revise or expand our compliance program globally and/or in specific jurisdictions, including the procedures we use to verify the identity of our customers and to monitor international and domestic transactions.

Such changes could have the effect of making compliance more costly and operationally difficult to manage, lead to increased friction for customers, and result in a decrease in business.

Regulators regularly re-examine the transaction volume thresholds at which we must obtain and keep applicable records or the circumstances in which we must verify identities of customers, and any change to such obligations could result in greater compliance costs and impact our business.

Such changes could increase the costs and complexity of compliance, lead to increased friction for customers, and result in a decrease in business.

We are also required to comply with economic and trade sanctions administered by the U.S., the European Union (“EU”) and its member states, the U.K., and other jurisdictions in which we operate.

1 unchanged sentence

In the ordinary course of business we may identify and voluntarily report, and have reported, potential compliance issues to regulatory authorities, including the U.S.

Department of the Treasury’s Office of Foreign Assets Control (“OFAC”), and our compliance history may be considered by OFAC and other regulators as part of any potential future investigation of our sanctions regulation.

Privacy and Protection of Customer Data

The legal and regulatory environment relating to privacy and data protection laws continues to develop and evolve in ways we cannot predict, including with respect to technologies such as cloud computing, (generative) AI, machine learning, cryptocurrency, and blockchain technology.

Any failure or alleged failure by us to comply with our privacy policies as communicated to customers or with privacy and data protection laws relating to our collection, use, storage, transfer, or sharing of customer data with third parties could result in proceedings or actions against us by data protection authorities, other government agencies, our customers or others, which could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, result in reputational harm, and materially harm our business.

The legal and regulatory environment relating to privacy and data protection laws continues to develop and evolve in ways we cannot predict, including with respect to technologies such as cloud computing, AI (including generative AI), cryptocurrency, and blockchain technology.

Any failure or alleged failure by us to comply with our privacy policies as communicated to customers or with applicable privacy and data protection laws relating to our collection, use, storage, transfer, or sharing of customer data with third parties could result in proceedings or actions against us by data protection authorities, other government agencies, our customers or others, which could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, damage our reputation, and materially harm our business.

Compliance with inconsistent privacy and data protection laws may also restrict or limit our ability to provide products and services to our customers.

1 unchanged sentence

For example, numerous U.S.

states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and retention of their residents’ personal information as well as specific privacy obligations around youth.

The continued proliferation of privacy laws in the jurisdictions in which we operate is likely to result in a disparate array of privacy rules with unaligned or conflicting provisions, accountability requirements, individual rights, and national or local enforcement powers, which may subject us to increased regulatory scrutiny and business costs and could lead to unintended consumer confusion.

states have enacted or are in the process of enacting state-level data privacy laws and regulations governing the collection, use, and retention of their residents’ personal information as well as specific privacy obligations with respect to youth.

The continued proliferation of privacy laws in the jurisdictions in which we operate is likely to result in a disparate array of privacy rules with unaligned or conflicting provisions, accountability requirements, individual rights, and national or local enforcement powers, which could lead to unintended consumer confusion and may subject us to increased regulatory scrutiny and business costs.

Artificial Intelligence (AI)

The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including in the areas of consumer protection, intellectual property, cybersecurity, and privacy and data protection.

In addition, there is uncertainty around the validity and enforceability of intellectual property rights related to the use, development, and deployment of AI-

generated outputs.

The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including areas such as consumer protection, intellectual property, cybersecurity, and privacy and data protection.

In addition, there is uncertainty around the validity and enforceability of intellectual property rights related to the use, development, and deployment of AI systems, including issues arising from both the inputs they rely on and the outputs they generate.

Compliance with new and emerging laws, regulations or industry standards relating to AI in the U.S.

and internationally, such as U.S.

state regulations and the Artificial Intelligence Act in the EU, may impose significant operational costs and may limit our ability to develop, deploy or use existing or future AI technologies.

state regulations and the Artificial Intelligence Act in the EU, may impose significant operational costs and limit or restrict our ability to develop,

FY 2025 FORM 10-K

deploy or use existing or future AI technologies.

As a result, our ability to adapt our existing products and services or develop future and new products and services using AI may be limited or restricted, which could adversely impact our business.

3 unchanged sentences

Some jurisdictions also provide private rights of action for competitors or consumers to assert claims of anticompetitive conduct.

Companies and government agencies have in the past alleged, and may in the future allege, that our actions (or actions of companies with which we have commercial agreements) violate the antitrust or competition laws in the U.S.

Companies, consumers, and government agencies have alleged, and may in the future allege, that our actions (or actions of companies with which we have commercial agreements) violate the antitrust or competition laws in the U.S.

or other jurisdictions in which we operate or otherwise constitute unfair competition, or that our products and services are used so broadly that otherwise uncontroversial business practices could be deemed anticompetitive.

2 unchanged sentences

We are regularly subject to claims, individual and class action lawsuits, arbitration proceedings, government and regulatory investigations, inquiries, actions or requests, and other proceedings alleging violations of laws, rules, and regulations with respect to competition, antitrust, intellectual property, privacy, data protection, information security, anti-money laundering, counter-terrorist financing, sanctions, anti-bribery, anti-corruption, consumer protection (including unfair, deceptive, or abusive acts or practices), the terms of our customer agreements, fraud, accessibility, securities, tax, labor and employment, commercial disputes, services, charitable fundraising, contract disputes, escheatment of unclaimed or abandoned property, product liability, use of our services for illegal purposes, the matters described in “Note 13—Commitments and Contingencies— Litigation and Regulatory Matters—General Matters ” to our consolidated financial statements, and other matters.

Investigations and legal proceedings are inherently uncertain, expensive and disruptive to our operations, and could result in substantial judgments, fines, penalties or settlements, substantial diversion of management’s time and effort, negative publicity, reputational harm, criminal sanctions, or orders that prevent or limit us from offering certain products or services;

We expect that the number and significance of these disputes and inquiries will continue to increase as our products, services, and business expand in complexity, scale, scope, and geographic reach, including through acquisitions of businesses and technology, and as a result of expanded enforcement of certain existing laws and regulations by federal, state and local agencies.

For example, there continues to be enforcement activity in connection with federal and state consumer protection laws, including suits which seek civil penalties.

Investigations, changes in, or expanded enforcement of federal, state or local laws and regulations, and legal and regulatory proceedings are inherently uncertain, expensive and disruptive to our operations, and could result in substantial judgments, fines, penalties or settlements, substantial diversion of management’s time and effort, negative publicity, reputational harm, criminal sanctions, or orders that prevent or limit us from offering certain products or services;

require us to change our business practices or customer agreement terms in ways that may increase costs or reduce revenues, develop non-infringing or otherwise altered products or technologies, or pay substantial royalty or licensing fees;

10 unchanged sentences

Effective protection of our proprietary rights may not be available in every jurisdiction in which we offer our products and services.

Although we have generally taken measures to protect our intellectual

property, there can be no assurance that we will be successful in protecting or enforcing our rights in every jurisdiction, that our contractual arrangements will prevent or deter third parties from infringing or misappropriating our intellectual property, or that third parties will not independently develop equivalent or superior intellectual property rights.

There can be no assurance that we will be successful in protecting or

FY 2025 FORM 10-K

enforcing our proprietary rights in every jurisdiction, that our contractual arrangements will prevent or deter third parties from infringing or misappropriating our intellectual property, or that third parties will not independently develop equivalent or superior intellectual property rights.

We may be required to expend significant time and resources to prevent infringement and enforce our rights, and we may be unable to discover or determine the extent of any unauthorized use of our proprietary rights.

If we are unable to prevent third parties from infringing or otherwise violating our proprietary rights, the uniqueness and value of our products and services could be adversely affected, the value of our brands could be diminished, and our business could be adversely affected.

We expect to continue to license in the future certain of our proprietary rights, such as trademarks or copyrighted material, to others.

We expect to continue to license certain of our proprietary rights, such as trademarks or copyrighted material, to others.

These licensees may take actions that diminish the value of our proprietary rights or harm our reputation.

2 unchanged sentences

We face substantial and increasingly intense competition worldwide in the global payments industry.

The global payments industry is highly competitive, dynamic, and innovative, and increasingly subject to regulatory scrutiny and oversight.

Many of the areas in which we compete evolve rapidly with innovative and disruptive technologies, shifting user preferences and needs, price sensitivity of consumers and merchants, and frequent introductions of new products and services.

The global payments industry is highly competitive, dynamic, and innovative, and subject to regulatory scrutiny and oversight.

Many of the areas in which we compete evolve rapidly with innovative and disruptive technologies, shifting preferences, needs, and price sensitivity of consumers and merchants, and frequent introductions of new products and services.

Competition also may intensify as new competitors emerge, businesses combine or enter into new partnerships, and established companies in other segments expand to become competitive with various aspects of our business.

3 unchanged sentences

Our competitors may devote greater resources to the development, promotion, and sale of products and services, and/or offer lower prices or more effectively offer their own innovative programs, products, and services.

We often partner with other businesses, and the ability to continue developing these partnerships is important to our business.

Competition for relationships with these partners is intense, and there can be no assurance that we will be able to continue to establish, grow, or maintain these partner relationships.

We regularly partner with other businesses, and the ability to continue developing these partnerships is important to our business.

Competition for relationships with these partners is intense, and there can be no assurance that we will be able to continue to establish, grow, or maintain partner relationships.

If we are unable to differentiate our products and services from those of our competitors, drive value for our customers and adoption of our products and services, or effectively and efficiently align our resources with our goals and objectives, we may not be able to compete effectively, which could negatively impact our results of operations and financial condition.

3 unchanged sentences

From time to time, the networks have increased the fees and assessments that they charge for transactions that access their networks.

Certain networks have also imposed special fees or assessments for transactions that are executed through a digital wallet such as the one that PayPal offers.

Certain networks have also imposed special fees or assessments for transactions that are executed through digital wallets such as those PayPal offers.

Our payment processors may have the right to pass any increases in fees and assessments on to us and to increase their own fees for processing.

Any increase in interchange fees, special fees, or assessments for transactions that we pay to the networks or our payment processors could make our pricing less competitive, increase our operating costs, and reduce our operating income, which could materially harm our business, financial condition, and results of operations.

Any increase in interchange fees, special fees, or assessments for transactions that we pay to networks or payment processors could make our pricing less competitive, increase our operating costs, and reduce our operating income, which could materially harm our business, financial condition, and results of operations.

In some jurisdictions, government regulations have required payment card networks to reduce or cap interchange fees.

1 unchanged sentence

We may also be subject to fines and other penalties assessed by networks resulting from any rule violations by us or our merchants.

The networks set and interpret their rules, and have alleged from time to time that various aspects of our business model violate these rules, or our agreements with the networks.

Such allegations may result in significant fines, penalties, damages, or other liabilities, adversely impact benefits to us under the agreements, or require changes in our business practices that may be costly and adversely affect our business, results of operations and financial condition.

The network rules may also increase the cost of, impose restrictions on, or otherwise impact the development of, our products which may negatively affect product deployment and adoption.

The networks could adopt new operating rules or interpret or re-interpret existing rules that

we or our payment processors might find difficult or impractical to follow, or costly to implement, which could require us to make significant changes to our products, increase our operational costs, and negatively impact our business.

The networks set and interpret their rules, and from time to time have alleged that various aspects of our business model violate these rules, or our agreements with the networks.

Such allegations may result in significant fines, penalties, damages, or other liabilities, adversely impact benefits to us under the agreements, or require changes to our business practices that may be costly and adversely affect our business, results of operations, and financial condition.

The network rules may also increase the cost of, impose restrictions on, or otherwise impact the development of, our products which may negatively affect product innovation, deployment, and adoption.

The networks could adopt new operating rules or interpret or re-interpret existing rules that we or our payment processors might find difficult or impractical to follow, or costly to implement, which could require us to make significant changes to our products, increase our operational costs, and negatively impact our business.

FY 2025 FORM 10-K

If we become unable or limited in our ability to accept certain payment types such as debit or credit cards, our business would be materially and adversely affected.

Changes in how consumers fund their PayPal transactions could harm our business.

We pay transaction fees when consumers fund payment transactions using credit cards, lower fees when consumers fund payments with debit cards, and nominal fees when consumers fund payment transactions by electronic transfer of funds from bank accounts, from an existing PayPal account balance or Venmo account balance, or through our PayPal branded consumer credit products.

We pay transaction fees when consumers fund payment transactions using credit cards, lower fees when consumers fund payments with debit cards, and nominal fees when consumers fund payment transactions by electronic transfer of funds from bank accounts, from an existing PayPal or Venmo account balance, or through our PayPal branded consumer credit products.

Our financial performance is sensitive to changes in the rate at which our consumers fund payments using payment cards, which can significantly increase our costs.

Although we provide consumers in certain markets with the opportunity to use their existing PayPal account balance or Venmo account balance to fund payment transactions, some of our consumers may prefer to use payment cards, which may offer features and benefits not provided as part of their PayPal accounts.

Although we provide consumers in certain markets with the opportunity to use their existing PayPal or Venmo account balance to fund payment transactions, some consumers may prefer to use payment cards, which may offer features and benefits not provided as part of their PayPal or Venmo accounts.

Any increase in the portion of our payment volume funded using payment cards or in fees associated with our funding mix, or other events or developments that make it more difficult or costly for us to fund transactions with lower-cost funding options, could materially and adversely affect our financial performance and significantly harm our business.

3 unchanged sentences

The financial success of these products depends largely on the effective management of related risk.

The credit decision-making process for our consumer credit products uses proprietary methodologies and credit algorithms and other analytical techniques designed to analyze the credit risk of specific consumers based on, among other factors, their past purchase and transaction history with PayPal or Venmo and their credit scores.

The credit decision-making process for our consumer credit products uses proprietary methodologies, credit algorithms and other analytical techniques designed to analyze the credit risk of specific consumers based on, among other factors, their past purchase and transaction history with PayPal or Venmo and their credit scores.

Similarly, proprietary risk models and other indicators are applied to assess merchants who desire to use our merchant financing offerings to help predict their ability to repay.

These risk models may not accurately predict the creditworthiness of a consumer or merchant due to inaccurate assumptions, including those related to the particular consumer or merchant, market conditions, economic environment, or limited transaction history or other data.

The accuracy of these risk models and the ability to manage credit risk related to our credit products may also be affected by legal or regulatory requirements, changes in consumer behavior, changes in the economic environment, issuing bank policies, and other factors.

We are subject to the risk that account holders who use our credit products will default on their payment obligations.

The non-payment rate among account holders may increase due to, among other factors, changes to underwriting standards, risk models not accurately predicting the creditworthiness of a user, worsening economic conditions, such as a recession or government austerity programs, increases in prevailing interest rates, and high unemployment rates.

These risk models may not accurately predict the creditworthiness of a consumer or merchant due to inaccurate assumptions, including those related to the particular consumer or merchant, market conditions or economic environment, or limited transaction history or other data.

The accuracy of these risk models and our ability to manage credit risk related to our credit products may also be affected by legal or regulatory requirements or consumer behavior, changes in the economic environment, issuing bank policies, and other factors.

We are subject to the risk that account holders who use our credit products may default on their payment obligations.

The non-payment rate among account holders may increase due to, among other factors, changes to underwriting standards, risk models not accurately predicting the creditworthiness of a user, worsening economic conditions, such as recessions, economic downturns or government austerity programs, increases in prevailing interest rates, and high unemployment rates.

Account holders who miss payments often fail to repay their loans, and account holders who file for protection under the bankruptcy laws generally do not repay their loans.

1 unchanged sentence

consumer credit products.

Any deterioration in the performance of loans facilitated through our platform or unexpected losses on such loans may increase the risk of potential charge-offs, increase our allowance for loans and interest receivable, negatively impact our revenue share arrangement (as discussed in “Item 7.

Management’s Discussion and Analysis of Financial Condition and Results of Operations — Key Metrics and Financial Results ”), and materially and adversely affect our financial condition and results of operations .

We generally rely on the activities and charters of unaffiliated financial institutions to provide PayPal and Venmo branded consumer credit and merchant financing offerings to our U.S.

7 unchanged sentences

installment loan products are provided by a state-chartered industrial bank under a program agreement with us, and we acquire the receivables generated by those loans from the state-chartered bank after origination.

In June 2020, the Federal

Deposit Insurance Corporation (“FDIC”) approved a final rule clarifying that loans validly originated by state-chartered banks or insured branches of foreign banks remain valid throughout the lifetime of the loan, reflecting a similar rule finalized by the Office of the Comptroller of Currency (“OCC”) in May 2020 for nationally chartered banks.

The final rule reaffirms and codifies the so-called “valid-when-made doctrine,” which provides that the permissibility of an interest rate for a loan is determined when the loan is made and will not be affected by subsequent events such as sale, assignment, or other transfer.

In June 2020, the Federal Deposit Insurance Corporation (“FDIC”) approved a final rule clarifying that loans validly originated by state-chartered banks or insured branches of foreign banks remain valid throughout the lifetime of the loan, reflecting a similar rule finalized by the Office of the Comptroller of Currency (“OCC”) in May 2020 for nationally chartered banks.

The final rule reaffirms and codifies the so-called “valid-when-made doctrine,” which provides that the permissibility of an interest rate for a loan is

FY 2025 FORM 10-K

determined when the loan is made and will not be affected by subsequent events such as sale, assignment, or other transfer.

While a number of state attorneys general have unsuccessfully challenged these FDIC and OCC rules, there remains some uncertainty whether non-bank entities purchasing loan receivables originated by FDIC-insured, state-chartered banks may rely on federal preemption of state usury laws and other state laws.

An adverse outcome of these or similar challenges, or changes to applicable laws and regulations or regulatory policy, could materially impact our U.S.

PPWC and PPBL products, certain installment products, and our business.

PPWC and PPBL products, certain installment loan products, and our business.

We currently purchase receivables related to our U.S.

2 unchanged sentences

through our international subsidiaries.

In June 2023, we entered into a multi-year agreement to sell U.K.

and European buy now, pay later (“BNPL”) loan receivables originated by PayPal (Europe) and PayPal U.K., consisting of the sale of a substantial majority of the U.K.

and European BNPL loan portfolio held on PayPal (Europe)’s balance sheet at the closing of the transaction and a forward-flow arrangement for the sale of future originations of eligible loans.

We have entered into agreements with third parties to sell various buy now, pay later loan receivables originated by PayPal entities.

The sale of future eligible receivables is subject to certain conditions.

If these conditions are not satisfied or waived or if the parties are unable to fulfill their obligations under these arrangements, the sale of these receivables could be delayed and we may not realize the expected benefits of this arrangement.

We rely on third parties in many aspects of our business, which creates additional risk.

We rely on third parties in many aspects of our business, including, but not limited to, networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions;

unaffiliated third-party lenders to originate our U.S.

unaffiliated third-party lenders to originate U.S.

credit products to consumers, U.S.

2 unchanged sentences

cryptocurrency custodial service providers;

and external business partners and contractors who provide key functions (including, but not limited to, data center facilities and cloud computing, information technology, and outsourced customer support and product development functions).

and external business partners and contractors who provide key functions (including, but not limited to, data center facilities and cloud computing, IT, and outsourced customer support, accounting, human resources, and product development functions).

We are subject to additional risks inherent in engaging and relying upon third-party providers, including operational, legal, regulatory, information security, reputational, commercial, and resiliency risks.

If we are unable to effectively manage our third-party relationships, these third parties are unable to meet their obligations to us, we are overly reliant on certain relationships, or we experience substantial disruptions in these relationships (including interruptions to the availability of our products and services), our operations, results of operations, and financial results could be adversely impacted.

Additionally, our relationships with third parties inherently involve a lesser degree of control over business operations, governance, and compliance, which potentially increases our financial, legal, reputational, and operational risk.

If we are unable to effectively manage our third-party relationships, these third parties are unable to meet their obligations to us, we are overly reliant on certain relationships, we are unable to negotiate favorable contractual terms, or we experience substantial disruptions in these relationships (including interruptions to the availability of our products and services), our operations, liquidity, results of operations, and financial results could be adversely impacted.

Additionally, our relationships with third parties inherently involve a lesser degree of control over business operations, governance, and compliance (including anti-money laundering and sanctions compliance), which potentially increases our financial, legal, reputational, and operational risk.

Any factors that reduce cross-border trade or make such trade more difficult could harm our business.

1 unchanged sentence

Cross-border transactions generally provide higher revenues and operating income than similar transactions that take place within a single country or market.

In certain markets, cross-border trade represents our primary (and in some instances our only) offerings.

Cross-border trade may be negatively impacted by various factors including foreign exchange rate fluctuations, tariffs, trade barriers or restrictions, sanctions, import or export controls, and the interpretation and application of laws of multiple jurisdictions in the context of cross-border trade and foreign exchange.

Any factors that increase the costs of cross-border trade for us or our customers or that restrict, delay, or make cross-border trade more difficult or impractical could reduce our cross-border transactions and volume, negatively impact our revenues and profits, and harm our business.

Failure to deal effectively with fraud, abusive behaviors, bad transactions, and negative customer experiences may increase our loss rate and could negatively impact our business and severely diminish merchant and consumer confidence in and use of our services.

We expect that third parties will continue to attempt to abuse access to and misuse our payments services to commit fraud by, among other things, creating fictitious PayPal accounts using stolen or synthetic identities or personal information, taking over customer accounts or creating fraudulent accounts, making transactions with stolen financial instruments, abusing or misusing our services for financial gain, or fraudulently inducing users of our products and services into engaging in fraudulent transactions.

Due to the nature of PayPal’s digital payments services, third parties may seek to engage in abusive schemes or fraud attacks that are often difficult to detect and may be deployed at a scale that would otherwise not be possible in physical

transactions.

In certain markets, cross-border trade may represent our primary or sole offering.

Cross-border trade has been and may be negatively impacted by various factors including foreign exchange rate fluctuations;

changes in or new tariffs, trade disputes, barriers or restrictions threats of such actions, and the related uncertainty thereof;

import or export controls;

and the interpretation and application of laws of multiple jurisdictions in the context of cross-border trade and foreign exchange.

Any factors that increase the costs or uncertainty of cross-border trade for us or our customers or that restrict, delay, or make cross-border trade more expensive, difficult or impractical could reduce our cross-border transactions and volume, negatively impact our revenues and profits, and harm our business.

Failure to deal effectively with fraud, abusive behaviors, bad transactions, and negative customer experiences may increase our loss rate and could severely diminish merchant and consumer confidence in and use of our services and negatively impact our business.

We expect that third parties will continue to attempt to abuse access to and misuse our payments services to commit fraud by, among other things, creating fictitious accounts using stolen or synthetic identities or personal information, taking over customer accounts or creating fraudulent accounts, making transactions with stolen financial instruments, abusing or misusing our services for financial gain, or fraudulently inducing users of our products and services into engaging in fraudulent transactions.

Due to the nature of our digital payments services, third parties may seek to engage in abusive schemes or fraud attacks that are often difficult to detect and may be deployed at a scale that would otherwise not be possible in physical transactions.

Measures to detect and reduce the risk of fraud and abusive behavior are complex, require continuous improvement, and may not be effective in detecting and preventing fraud, particularly new and continually evolving forms of fraud or in connection with new or expanded product offerings.

1 unchanged sentence

We also incur substantial losses from erroneous transactions and situations where linked accounts designated by customers to fund PayPal transactions have insufficient funds or are otherwise unavailable to fund the payments, or the payment is initiated to an unintended recipient in error.

Numerous and evolving fraud schemes and misuse of our payments services could subject us to significant costs and liabilities, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, damage our reputation and brands, divert the attention of management from the operation of our business, and result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses or claims.

Numerous and evolving fraud schemes and misuse of our

FY 2025 FORM 10-K

payments services could subject us to significant costs and liabilities, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, damage our reputation and brands, divert the attention of management from the operation of our business, and result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses or claims.

While we actively seek to recover transaction losses where possible, such recoveries may be insufficient to compensate us for such losses.

Our purchase and seller protection programs (“protection programs”) are intended to reduce the likelihood of losses for consumers and merchants from unauthorized and fraudulent transactions.

Our purchase protection program also protects consumers who do not receive the item ordered or who receive an item that is significantly different from its description.

Our purchase protection program also protects eligible transactions where consumers do not receive the item ordered or receive an item that is significantly different from its description.

We incur substantial losses from our protection programs as a result of disputes filed by our customers.

While we may seek to recover losses from our protection programs from the merchant, we ultimately may not be able to fully recover such losses (for example, if the merchant is unwilling or unable to pay, the transaction involves a fraudulent merchant, or the merchant provides sufficient evidence that the item was delivered).

While we may seek to recover losses from our protection programs from the merchant, we ultimately may not be able to fully recover such losses.

In addition, consumers who pay through PayPal or Venmo may have reimbursement rights from their payment card issuer, which in turn will seek recovery from us.

2 unchanged sentences

Increases in our loss rate, including as a result of changes to the scope of transactions covered by our protection programs, could negatively impact our business and results of operations.

See “Note 13—Commitments and Contingencies— Protection Programs ” to our consolidated financial statements.

Failure to effectively monitor and evaluate the financial condition of our merchants may expose PayPal to losses.

2 unchanged sentences

Use of our payments services for illegal activities or improper purposes could harm our business.

We expect that users will continue to attempt to use our payments platform for illegal activities or improper uses, including money laundering, terrorist financing, sanctions evasion, illegal online gambling, fraudulent sales of goods or services, illegal telemarketing activities, illegal sales of prescription medications or controlled substances, piracy of software, movies, music, and other copyrighted, trademarked or digital goods, bank fraud, child pornography, human trafficking, prohibited sales of alcoholic beverages or tobacco products, securities fraud, pyramid or Ponzi schemes, or the facilitation of other illegal or improper activity.

Moreover, certain activity that may be legal in one jurisdiction may be illegal in another jurisdiction, and a merchant may be found responsible for intentionally or inadvertently importing or exporting illegal goods, resulting in liability for us.

We expect that users will continue to attempt to use our platform for illegal activities or improper uses, including money laundering, terrorist financing, sanctions evasion, illegal gambling or gaming, fraudulent sales of goods or services, illegal telemarketing activities, illegal sales of prescription medications or controlled substances, piracy of software, movies, music, and other copyrighted, trademarked or digital goods, bank fraud, child pornography, human trafficking, prohibited sales of alcoholic beverages or tobacco products, securities fraud, pyramid or Ponzi schemes, or the facilitation of other illegal or improper activity.

Moreover, certain activity that may be legal in one jurisdiction may be illegal in another jurisdiction, and a customer may be found responsible for intentionally or inadvertently importing or exporting illegal goods, resulting in liability for us.

Owners of intellectual property rights or government authorities may seek to bring legal action against providers of payments solutions, including PayPal, that are peripherally involved in the sale of infringing or allegedly infringing items by a user.

While we invest in measures intended to prevent and detect illegal activities that may occur on our payments platform, these measures may not be effective in detecting and preventing illegal activity or improper uses, and we may be subject to claims, individual and class action lawsuits, and government and regulatory requests, inquiries, or investigations that could result in liability, restrict our operations, impose additional restrictions or limitations on our business or require us to change our business practices, harm our reputation, increase our costs, and negatively impact our business.

While we invest in measures intended to prevent and detect illegal activities that may occur on our platform, these measures require continuous improvement and may not be effective in detecting and preventing illegal activity or improper uses, and we may be subject to claims, individual and class action lawsuits, and government and regulatory requests, inquiries, or investigations that could result in liability, restrict our operations, impose additional restrictions or limitations on our business or require us to change our business practices, harm our reputation, increase our costs, and negatively impact our business.

Acquisitions, dispositions, strategic investments, and other strategic transactions could result in operating difficulties and could harm our business.

We expect to continue to consider and evaluate a wide array of potential strategic transactions as part of our overall business

strategy, including business combinations, acquisitions, and dispositions of certain businesses, technologies, services, products, and other assets;

We expect to continue to consider and evaluate a wide array of potential strategic transactions as part of our overall business strategy, including business combinations, acquisitions, and dispositions of certain businesses, technologies, services, products, and other assets;

strategic investments;

1 unchanged sentence

At any given time, we may be engaged in discussions or negotiations with respect to one or more strategic transactions, any of which could, individually or in the aggregate, be material to our financial condition and results of operations.

There can be no assurance that we will be successful in identifying, negotiating, consummating and integrating transaction opportunities.

There can be no assurance that we will be successful in identifying, negotiating, consummating, or integrating suitable transaction opportunities.

Strategic transactions may involve additional significant challenges, uncertainties, and risks, including challenges of obtaining regulatory or other approvals, integrating new employees, products, systems, technologies, operations, and business cultures;

challenges associated with operating acquired businesses in markets or business areas in which we may have limited or no experience;

challenges associated with operating acquired businesses in markets or business areas in which we may have limited or no

FY 2025 FORM 10-K

disruption of our ongoing operations and diversion of our management’s attention;

inadequate data security, cybersecurity, or operational and information technology resilience;

failure to identify, or our underestimation of, commitments, liabilities, deficiencies and other risks associated with acquired businesses or assets;

inadequate data security, cybersecurity, or operational and IT resilience;

failure to identify or accurately assess commitments, liabilities, deficiencies and other risks associated with acquired businesses or assets;

potential exposure to new or incremental risks associated with acquired businesses and entities, strategic investments or other strategic transactions, including potential new or increased regulatory oversight and uncertain or evolving legal, regulatory, and compliance requirements, particularly with respect to companies in new or developing businesses or industries;

4 unchanged sentences

Strategic transactions are inherently risky, may not be successful, and may harm our business, results of operations, and financial condition.

Strategic investments in which we have a minority ownership stake inherently involve a lesser degree of influence over business operations.

The success of our strategic investments may be dependent on controlling shareholders, management, or other persons or entities that may have business interests, strategies, or goals that are inconsistent with ours.

Strategic investments in which we have a minority ownership stake inherently involve a lesser degree of influence and visibility over business operations and we may be dependent on controlling shareholders, management, or other persons or entities that may have business interests, strategies, or goals that are inconsistent with ours.

Business decisions or other actions or omissions of the controlling shareholders, management, or other persons or entities who control companies in which we invest may adversely affect the value of our investment, result in litigation or regulatory action against us, and damage our reputation.

Our international operations subject us to increased risks, which could harm our business.

Our international operations generate a significant portion of our net revenues.

Our international operations subject us to significant challenges, uncertainties, and risks, including, but not limited to, local regulatory, licensing, reporting, and legal obligations;

costs and challenges associated with operating in markets in which we may have limited or no experience, including effectively localizing our products and services and adapting them to local preferences;

difficulties in developing, staffing, and simultaneously managing a large number of varying foreign operations as a result of distance, language, and cultural differences and in light of varying laws, regulations, and customs;

Our international operations generate a significant portion of our net revenues and subject us to significant challenges, uncertainties, and risks, including, but not limited to, local regulatory, licensing, reporting, and legal obligations;

costs and challenges associated with operating in markets in which we may have limited or no experience, including adapting our products and services to local requirements and customer preferences;

differing employment practices and the existence of works councils;

difficulties in recruiting and retaining qualified employees and maintaining our company culture;

difficulties in hiring, retaining and integrating qualified employees and maintaining our company culture;

fluctuations in foreign exchange rates;

1 unchanged sentence

profit repatriation restrictions;

potential tariffs, sanctions, fines, or other trade barriers or restrictions;

changes in or new tariffs, sanctions, fines, or other trade barriers or restrictions and the related uncertainty thereof;

import or export regulations;

8 unchanged sentences

laws, rules and regulations that may apply to our international operations may result in lawsuits, enforcement actions, criminal actions, or sanctions against us and, our directors, officers, and employees;

prohibit or require us to change our business practices;

prohibit or require us to change our products, services and business practices;

and damage our reputation.

Although we have implemented policies and procedures designed to promote compliance with these laws, there can be no assurance that our employees, contractors, or agents will not violate our policies.

There can be no assurance that our employees, contractors, or agents will not violate applicable laws or our policies, procedures and controls designed to help ensure compliance with these laws.

These risks are inherent in our international operations, may increase our costs of doing business internationally, and could materially and adversely affect our business.

Global and regional economic conditions could harm our business.

Adverse global and regional economic conditions such as turmoil affecting the banking system or financial markets, including, but not limited to, tightening in the credit markets, extreme volatility or distress in the financial markets (including the fixed

income, credit, currency, equity, and commodity markets), unemployment, consumer debt levels, recessionary or inflationary pressures, supply chain issues, reduced consumer confidence or economic activity, government fiscal, monetary and tax policies, U.S.

and international trade relationships, agreements, treaties, tariffs and restrictive actions, the inability of a government to enact a budget in a fiscal year, government shutdowns, government austerity programs, geopolitical conditions or events, and other negative financial news or macroeconomic developments could have a material adverse impact on the demand for our products and services, including a reduction in the volume and size of transactions on our payments platform.

Adverse global and regional economic conditions such as political unrest and turmoil affecting the banking system or financial markets, including, but not limited to, tightening in the credit markets, extreme volatility or distress in the financial markets (including the fixed income, credit, currency, equity, and commodity markets), unemployment, consumer debt levels, recessionary or inflationary pressures, supply chain issues, reduced consumer confidence or economic activity, government fiscal, monetary and tax policies, U.S.

and international trade relationships, agreements, treaties, changes in or new tariffs and restrictive actions or threats of such actions, including an escalation of trade tensions between the U.S.

and its trading partners, the inability of a government to enact a budget in a fiscal year, government shutdowns, government austerity programs, geopolitical conditions or events, and other negative financial news or macroeconomic developments could have a material adverse impact on the demand for our products and services, including a reduction in the volume and size of transactions on our platform.

In particular, recent tariffs and reciprocal trade measures enacted or threatened to be enacted by the U.S.

and other countries have led to increased volatility and uncertainty in certain parts of the global economy.

We cannot predict the timing, strength or duration of any economic volatility, slowdown, instability or recovery, whether in the U.S.

or globally, or within any particular industry.

These conditions could have a material adverse impact on the demand for our products and services which

FY 2025 FORM 10-K

could adversely affect our results of operations.

Additionally, any inability to access the capital markets when needed due to volatility or illiquidity in the markets, liquidity needs due to unanticipated reductions in customer balances, or increased regulatory liquidity and capital requirements may strain our liquidity position.

4 unchanged sentences

We may experience scrutiny or criticism from customers, partners, employees, government entities, media, advocacy groups, and other influencers or stakeholders that disagree with, among other things, our product offering decisions, internal policies, or public policy positions.

Damage to our reputation or our brands may result from, among other things, new features, products, services, operational efforts, or terms of service (or changes to the same), or our decisions regarding user privacy, data practices, or information security.

The proliferation of social media may increase and compound the likelihood, speed, magnitude, and unpredictability of negative brand events.

Damage to our reputation or our brands may result from, among other things, change to or new features, products, services, operational efforts, or terms of service, or our decisions regarding user privacy, data practices, or information security.

The pervasiveness of social media may increase and compound the likelihood, speed, magnitude, and unpredictability of negative brand events.

If our brands or reputation are damaged, our business and operating results may be adversely impacted.

Real or perceived inaccuracies in our key metrics may harm our reputation and negatively affect our business.

Our key metrics are calculated using internal company data based on the activity we measure on our payments platform and compiled from multiple systems, including systems that are internally developed or acquired through business combinations.

While the measurement of our key metrics is based on what we believe to be reasonable methodologies and estimates, there are inherent challenges and limitations in measuring our key metrics globally at scale.

Our key metrics are calculated using internal company data based on the activity we measure on our platform and compiled from multiple systems, including systems that are internally developed or acquired through business combinations.

There are inherent challenges and limitations in measuring our key metrics globally at scale.

The methodologies used to calculate our key metrics require significant judgment.

We regularly review our processes for calculating these key metrics, and from time to time we may make adjustments to improve the accuracy or relevance of our metrics.

For example, we continuously apply models, processes and practices designed to detect and prevent fraudulent account creation on our platforms, and work to improve and enhance those capabilities.

When we detect a significant volume of illegitimate activity, we generally remove the activity identified from our key metrics.

Although such adjustments may impact key metrics reported in prior periods, we generally do not update previously reported key metrics to reflect these subsequent adjustments unless the retrospective impact of process improvements or enhancements is determined by management to be material.

Further, as our business develops, we may revise or cease reporting metrics if we determine that such metrics are no longer appropriate measures of our performance.

Further, as our business evolves, we may revise or cease reporting metrics if we determine that such metrics are no longer appropriate measures of our performance.

If investors, analysts, or customers do not consider our reported measures to be sufficient or to accurately reflect our business, we may receive negative publicity, our reputation may be harmed, and our business may be adversely impacted.

Environmental, social and governance (“ESG”) issues may have an adverse effect on our business, financial condition and results of operations and damage our reputation.

Various jurisdictions are adopting or considering new laws and regulations that expand mandatory disclosure, reporting and diligence requirements with respect to ESG matters.

If we are unable to comply with new laws and regulations concerning ESG matters or fail to meet investor, industry or stakeholder expectations and standards, our reputation may be harmed, customers may choose to refrain from using our products and services, we may be subject to fines, penalties, regulatory or other enforcement actions, and our business or financial condition may be adversely affected.

If our ESG-related data, processes and reporting are viewed as incomplete or inaccurate, or if we fail to achieve progress with respect to ESG-related goals on a timely basis or at all, we may be viewed negatively by stakeholders concerned about these matters.

Moreover, investors, customers, partners, media, government entities, and other stakeholders (including those in support of or in opposition to ESG principles) may have a negative view of us to the extent we are perceived to have not responded appropriately to their ESG concerns or take positions that are contrary to their views or expectations.

We recognize that climate-related risks may impact our business.

For example, California, where our headquarters are located, has historically experienced, and is projected to continue to experience, extreme weather and natural disaster events more frequently, including drought, flooding, heat waves, and wildfires.

Such events may disrupt our business and may cause us to experience additional costs to maintain or resume operations.

Evolving laws, regulations and stakeholder expectations with respect to environmental, social and governance matters could harm our reputation and adversely affect our business.

Various jurisdictions both in the U.S.

and internationally have adopted or are developing laws, regulations and policies relating to environmental, social and governance matters (e.g., environmental sustainability and climate change) which include disclosure, reporting and diligence requirements.

Compliance with these requirements may involve significant costs, and any actual or perceived failure to comply with applicable (and potentially conflicting) federal, state, local or international laws or regulations concerning environmental, social, and governance matters could subject us to fines, penalties, regulatory or other enforcement actions, and adversely affect our business or financial condition.

In addition, various stakeholders, including investors, customers, employees, governmental authorities and regulators, may have differing expectations regarding environmental, social and governance matters related to us (including those supporting and opposing various environmental, social and governance matters), whose expectations and requirements are evolving and varied.

Any initiatives, targets, data, or commitments we disclose with respect to these matters involve risks and uncertainties and could be difficult to achieve and costly to implement.

Any actual or perceived failure or inaccuracy with respect to such initiatives, targets, data or commitments or to otherwise successfully manage investor or other stakeholder expectations on these matters could result in adverse reaction by consumers or other stakeholders (including, but not limited to, customers choosing not to use our products and services and the commencement of legal and regulatory proceedings against us), harm our reputation, and adversely affect our business, results of operation and financial condition.

If one or more of our counterparty financial institutions default on their financial or performance obligations to us or fail, we may incur significant losses.

We have significant amounts of cash, cash equivalents, receivables outstanding, and other investments on deposit or in accounts with banks or other financial institutions in the U.S.

and international jurisdictions.

and internationally.

As part of our foreign exchange hedging activities, we regularly enter into transactions involving derivative financial instruments with various financial institutions.

Certain banks and other financial institutions are also lenders under our credit facilities.

We regularly monitor our concentration of, and exposure to counterparty risk, and actively manage this exposure to mitigate the associated risk.

Despite these efforts, we may be exposed to the risk of default on obligations by, or deteriorating operating results or financial condition or failure of, these counterparty financial institutions.

If one of our counterparty financial institutions were to become insolvent, placed into receivership, or file for bankruptcy, our ability to recover losses incurred as a result of default or to access or recover our assets that are deposited, held in accounts with, or otherwise due from, such counterparty may be limited due to the insufficiency of the failed institutions’ estate to satisfy all claims in full or the applicable laws or regulations governing the insolvency, bankruptcy, or resolution proceedings.

While we seek to diversify counterparty risk, regularly monitor and actively manage our concentration of, and exposure to, counterparty risk, we may be exposed to the risk of default on obligations by, or deteriorating operating results or financial condition or failure of, these counterparty financial institutions.

If one of our counterparty financial institutions were to become insolvent, placed into receivership, or file for bankruptcy, our

FY 2025 FORM 10-K

ability to recover losses incurred as a result of default or to access or recover our assets that are deposited, held in accounts with, or otherwise due from, such counterparty may be limited due to the insufficiency of the failed institutions’ estate to satisfy all claims in full or the applicable laws or regulations governing the insolvency, bankruptcy, or resolution proceedings.

In the event of default on obligations by, or the failure of, one or more of these counterparties, we could incur significant losses, which could negatively impact our results of operations and financial condition.

7 unchanged sentences

Our ability to pay interest and repay the principal for our indebtedness is dependent upon our ability to manage our business operations and generate sufficient cash flows to service such debt.

Our outstanding indebtedness and any additional indebtedness we incur may have significant consequences, including the need to use a significant portion of our cash flow from operations and other available cash to service our indebtedness, thereby reducing the funds available for other purposes, including capital expenditures, acquisitions, strategic investments, and share repurchases;

the reduction of our flexibility in planning for or reacting to changes in our business, competitive pressures and market conditions;

and limits on our ability to obtain additional financing for working capital, capital expenditures, acquisitions, strategic investments, share repurchases, or other general corporate purposes.

Our outstanding indebtedness and any additional indebtedness we incur may have significant consequences, including the need to use a significant portion of our cash flow from operations and other available cash to service our indebtedness, thereby reducing the funds available for other purposes, including working capital, capital expenditures, acquisitions, strategic investments, share repurchases, dividend payments, or other general corporate purposes;

limits on our ability to obtain additional financing for such purposes;

and the reduction of our flexibility in planning for or reacting to changes in our business, competitive pressures and market conditions.

Our revolving credit facilities and the indentures for our senior unsecured notes pursuant to which certain of our outstanding debt securities were issued contain financial and other covenants that restrict or could restrict, among other things, our business and operations.

If we fail to pay amounts due under a debt instrument or breach any of its covenants, the lenders or noteholders would typically have the right to demand immediate repayment of all borrowings thereunder (subject in certain cases to a grace or cure period).

Moreover, any such acceleration and required repayment of, or default in respect of, our indebtedness could, in turn, constitute an event of default under other debt instruments, thereby resulting in the acceleration and required repayment of our indebtedness.

Any such acceleration and required repayment of, or default in respect of, our indebtedness could, in turn, constitute an event of default under other debt instruments, thereby resulting in the acceleration and required repayment of our indebtedness.

Any of these events could materially adversely affect our liquidity and financial condition.

Changes by any rating agency to our outlook or credit rating could negatively affect the value of both our debt and equity securities and increase our borrowing costs.

If our credit ratings are downgraded or other negative action is taken, the interest rates payable by us under our indebtedness may increase, and our ability to obtain additional financing in the future on favorable terms or at all could be adversely affected.

Any downgrade in our credit rating or negative change in our rating outlook could increase our future borrowing costs and adversely affect our ability to obtain additional financing in the future on favorable terms or at all.

Changes in tax laws, exposure to unanticipated additional tax liabilities, or implementation of reporting or record-keeping obligations could have a material adverse effect on our business.

2 unchanged sentences

federal government, and governments of foreign jurisdictions, such as the EU Commission, as well as international organizations, such as the Organization for Economic Co-operation and Development (“OECD”), are focused on tax reform and other legislative or regulatory action to increase tax revenue.

These actions may

materially and adversely affect our effective tax rate, net income, and cash flows.

These actions may materially and adversely affect our effective tax rate, net income, and cash flows.

Specifically, the OECD has published model rules and is coordinating negotiations among participating countries with the goal of achieving consensus on significant changes to international tax rules, including the implementation of a global minimum tax rate of 15%, commonly referred to as Pillar Two.

5 unchanged sentences

The determination of our worldwide provision for income taxes and other tax liabilities requires estimation and significant judgment, and there are many transactions and calculations for which the ultimate tax determination is uncertain.

We are currently undergoing a number of investigations, audits, and reviews by tax authorities in multiple U.S.

and foreign tax jurisdictions.

Any adverse outcome of any such audit or review could result in unforeseen tax-related liabilities that differ from the amounts recorded in our financial statements, which may, individually or in the aggregate, materially affect our financial results in the periods for which such determination is made.

While we have established reserves based on assumptions and estimates that we believe are reasonable to cover such eventualities, these reserves may prove to be insufficient.

In addition, our future income taxes could be adversely affected by changes in our geographical mix of income and impacts of statutory tax rates;

FY 2025 FORM 10-K

income taxes could be adversely affected by changes in our geographical mix of income and impacts of statutory tax rates;

by changes in the valuation of our deferred tax assets and liabilities, including as a result of gains on our foreign exchange risk management program;

1 unchanged sentence

or by certain discrete items.

A number of U.S.

In addition, we are currently undergoing a number of investigations, audits, and reviews by tax authorities in multiple U.S.

and foreign tax jurisdictions.

While we have established reserves based on assumptions and estimates that we believe are reasonable to cover such eventualities, these reserves may prove to be insufficient.

To improve tax compliance, a number of U.S.

states, the U.S.

federal government, and foreign jurisdictions have implemented and may impose reporting or record-keeping obligations on companies that engage in or facilitate e-commerce to improve tax compliance.

federal government, and foreign jurisdictions have implemented and may impose reporting or record-keeping obligations on companies that engage in or facilitate ecommerce as well as companies offering digital asset services.

A number of jurisdictions are also reviewing whether payment service providers and other intermediaries could be deemed to be the legal agent of merchants for certain tax purposes.

2 unchanged sentences

We may be unable to attract, retain, and develop the highly skilled employees we need to support our business.

Competition for key and other highly skilled personnel is intense, especially for executive talent, software engineers, and other technology talent.

Competition for key and other highly skilled personnel is intense, particularly for executive talent, software engineers, and other technology talent.

We may be limited in our ability to recruit or hire internationally, including due to restrictive laws or policies on immigration, travel, or availability of visas for skilled workers.

The loss of the services of any of our key personnel, or our inability to attract, hire, develop, motivate and retain key and other highly qualified and diverse talent, whether in a remote or in-office environment, or protect the safety, health and productivity of our workforce could harm our overall business and results of operations.

The loss of the services of any of our key personnel, or our inability to attract, hire, develop, motivate and retain key and other highly qualified and diverse talent, could harm our overall business and results of operations.

We are subject to risks associated with information disseminated through our products and services.

We may be subject to claims relating to information disseminated through our online services by our customers and other third parties, including, but not limited to, claims alleging defamation, libel, harassment, hate speech, breach of contract, invasion of privacy, negligence, copyright or trademark infringement, or other theories based on the nature and content of the materials disseminated through the services.

We invest in measures intended to detect and block activities that may occur on our payments platform in violation of our policies and applicable laws.

These measures require continuous improvement and may not be sufficiently effective in detecting and preventing the exchange of information in violation of our policies and applicable laws, which could negatively impact our business.

If the laws or regulations that provide protections for online dissemination of information are invalidated, modified, or supplemented to reduce protections available to us, or to increase requirements on us to remove certain information or implement other processes, we could be harmed and may be forced to implement new measures to reduce our potential liability for information provided by our customers and carried on our products and services.

This increased risk could require us to expend substantial resources or discontinue certain product or service offerings, which could harm our business.

While we invest in measures intended to detect and block activities that may occur on our platform in violation of our policies and applicable laws, they may not be sufficiently effective in detecting and preventing the exchange of information in violation of our policies and applicable laws, which could negatively impact our business.

If the laws or regulations that provide protections for online dissemination of information are invalidated, modified, or supplemented to reduce protections available to us or to increase requirements on us, we could be directly harmed and may be forced to implement new measures to reduce our exposure to this liability, including expending substantial resources and discontinuing certain product or service offerings, which could harm our business.

There can be no assurance that we will continue to repurchase stock or declare cash dividends, and stock repurchases or dividends could increase the volatility of our stock price and could diminish our cash reserves.

We engage in share repurchases of our common stock from time to time, and our stock repurchase programs do not have expiration dates and do not obligate us to repurchase any specific dollar amount or to acquire any specific number of shares.

In October 2025, we announced the initiation of a cash dividend program.

Future cash dividends are subject to declaration by our Board of Directors at its sole discretion and are therefore subject to numerous factors including, among others, prevailing market conditions, our results of operations, financial condition and liquidity, applicable laws and agreements.

Our stock repurchases and our dividends could affect our share trading prices, increase its volatility, reduce our cash reserves and may be suspended or terminated at any time, which may result in a decrease in our share trading price.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors