Biggest changeFrom time to time, we have received orders from the CFPB pursuant to such market-monitoring authority requiring us to provide, among other items, extensive information on our payment products, including with respect to the collection, use of, and access to data and consumer protections, as well as our Buy Now, Pay Later offerings. 20 Table of Contents Following the departure of the U.K. from the European Union (“EU”) and the EEA on January 31, 2020 (commonly referred to as “Brexit”), effective November 1, 2023, PayPal’s wholly-owned U.K. subsidiary received authorizations from the FCA as an electronic money institution and consumer credit firm, and registration as a cryptoasset business, subject to certain conditions that will require further implementation action by us.
Biggest changeFrom time to time, we have received orders from the CFPB pursuant to such market-monitoring authority requiring us to provide, among other items, extensive information on our payment products, including with respect to the collection, use of, and access to data and consumer protections, as well as our Buy Now, Pay Later offerings.
Any cybersecurity incidents, including cyberattacks or data security breaches affecting the information technology or infrastructure of companies we acquire or of our customers, partners, or vendors (including data center and cloud computing providers) could have similar negative effects.
Any cybersecurity incidents, including cyberattacks or data security breaches affecting the information technology or infrastructure of our customers, partners, or vendors (including data center and cloud computing providers) or of companies we acquire, could have similar negative effects.
Nevertheless, operational disruptions at any such custodian or issuer, or such custodians’ or issuer’s failure to safeguard cryptocurrency holdings (or reserve assets) could result in losses of customer assets, expose us to customer claims, reduce consumer confidence and materially impact our operating results and our cryptocurrency product offerings.
Nevertheless, any operational disruptions at any such custodian or issuer, or such custodians’ or issuer’s failure to safeguard cryptocurrency holdings (or reserve assets), could result in losses of customer assets, expose us to customer claims, reduce consumer confidence and materially impact our cryptocurrency product offerings and our operating results.
Any failure or alleged failure by us to comply with our privacy policies as communicated to customers or with privacy and data protection laws relating to our collection, use, storage, transfer, or sharing of customer data with third parties could result in proceedings or actions against us by data protection authorities, other government agencies, or others, which could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, result in reputational harm, and materially harm our business.
Any failure or alleged failure by us to comply with our privacy policies as communicated to customers or with privacy and data protection laws relating to our collection, use, storage, transfer, or sharing of customer data with third parties could result in proceedings or actions against us by data protection authorities, other government agencies, our customers or others, which could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, result in reputational harm, and materially harm our business.
Any claims or investigations, even if without merit, may be costly to defend or respond to, involve negative publicity, and cause substantial diversion of management’s time and effort, and could result in reputational harm, significant judgments, fines and other remedial actions against us, require us to change our business practices, make product or operational changes, or delay or preclude planned transactions, product launches or improvements.
Any claims or investigations, even if without merit, may be costly to defend or respond to, involve negative publicity, cause substantial diversion of management’s time and effort, and could result in reputational harm, significant judgments, fines and other remedial actions against us, require us to change our business practices, make product or operational changes, or delay or preclude planned transactions, product launches or improvements.
Investigations and legal proceedings are inherently uncertain, expensive and disruptive to our operations, and could result in substantial judgments, fines, penalties or settlements, negative publicity, substantial diversion of management’s time and effort, reputational harm, criminal sanctions, or orders that prevent or limit us from offering certain products or services; require us to change our business practices or customer agreement terms in ways that may increase costs or reduce revenues, develop non-infringing or otherwise altered products or technologies, or pay substantial royalty or licensing fees; or delay or preclude planned transactions or product launches or improvements.
Investigations and legal proceedings are inherently uncertain, expensive and disruptive to our operations, and could result in substantial judgments, fines, penalties or settlements, substantial diversion of management’s time and effort, negative publicity, reputational harm, criminal sanctions, or orders that prevent or limit us from offering certain products or services; require us to change our business practices or customer agreement terms in ways that may increase costs or reduce revenues, develop non-infringing or otherwise altered products or technologies, or pay substantial royalty or licensing fees; or delay or preclude planned transactions or product launches or improvements.
The global payments industry is highly competitive, dynamic, highly innovative, and increasingly subject to regulatory scrutiny and oversight. Many of the areas in which we compete evolve rapidly with innovative and disruptive technologies, shifting user preferences and needs, price sensitivity of merchants and consumers, and frequent introductions of new products and services.
The global payments industry is highly competitive, dynamic, and innovative, and increasingly subject to regulatory scrutiny and oversight. Many of the areas in which we compete evolve rapidly with innovative and disruptive technologies, shifting user preferences and needs, price sensitivity of consumers and merchants, and frequent introductions of new products and services.
Numerous and evolving cybersecurity threats, including advanced and persisting cyberattacks, cyberextortion, distributed denial-of-service attacks, ransomware, spear phishing and social engineering schemes, the introduction of computer viruses or other malware, and the physical destruction of all or portions of our information technology and infrastructure and those of third parties with whom we partner or that are part of our information technology supply chain, are becoming increasingly sophisticated and complex, may be difficult to detect, and could compromise the confidentiality, availability, and integrity of the data in our systems, as well as the systems themselves.
Numerous and evolving cybersecurity and related threats, including advanced and persisting cyberattacks, cyberextortion, distributed denial-of-service attacks, ransomware, spear phishing and social engineering schemes, the introduction of computer viruses or other malware, and the physical destruction of all or portions of our information technology and infrastructure and those of third parties with whom we partner or that are part of our information technology supply chain, are becoming increasingly sophisticated and complex, may be difficult to detect, and could compromise the confidentiality, availability, and integrity of the data in our systems, as well as the systems themselves.
Anti-Money Laundering and Counter-Terrorist Financing; Economic and Trade Sanctions Regulators globally continue to increase standards and expectations regarding anti-money laundering and counter-terrorist financing, and to expand the scope of existing laws and regulations to emerging products and markets, which may require us to further revise or expand our compliance program globally and/or in specific jurisdictions, including the procedures we use to verify the identity of our customers and to monitor international and domestic transactions.
Anti-Money Laundering and Counter-Terrorist Financing; Economic and Trade Sanctions Regulators globally continue to increase standards and expectations regarding anti-money laundering and counter-terrorist financing, and to expand the scope of existing laws and regulations to emerging products and markets, which may require us to revise or expand our compliance program globally and/or in specific jurisdictions, including the procedures we use to verify the identity of our customers and to monitor international and domestic transactions.
Cryptocurrency Regulation and Related Risks Our customer cryptocurrency offerings could subject us to additional regulations, licensing requirements, or other obligations or liabilities. Within the U.S., we are regulated by the New York Department of Financial Services as a virtual currency business, which does not qualify us to engage in securities brokerage or dealing activities.
Cryptocurrency Regulation and Related Risks Our customer cryptocurrency offerings could subject us to additional regulations, licensing requirements, or other obligations or liabilities. Within the U.S., we are regulated by the New York State Department of Financial Services as a virtual currency business, which does not qualify us to engage in securities brokerage or dealing activities.
We are regularly subject to claims, individual and class action lawsuits, arbitration proceedings, government and regulatory investigations, inquiries, actions or requests, and other proceedings alleging violations of laws, rules, and regulations with respect to competition, antitrust, intellectual property, privacy, data protection, information security, anti-money laundering, counter-terrorist financing, sanctions, anti-bribery, anti-corruption, consumer protection (including unfair, deceptive, or abusive acts or practices), the terms of our customer agreements, fraud, accessibility, securities, tax, labor and employment, commercial disputes, services, charitable fundraising, contract disputes, escheatment of unclaimed or abandoned property, product liability, use of our services for illegal purposes, the matters described in “Note 13—Commitments and Contingencies—Litigation and Regulatory Matters—General Matters” to our consolidated financial statements, and other matters.
We are regularly subject to claims, individual and class action lawsuits, arbitration proceedings, government and regulatory investigations, inquiries, actions or requests, and other proceedings alleging violations of laws, rules, and regulations with respect to competition, antitrust, intellectual property, privacy, data protection, information security, anti-money laundering, counter-terrorist financing, sanctions, anti-bribery, anti-corruption, consumer protection (including unfair, deceptive, or abusive acts or practices), the terms of our customer agreements, fraud, accessibility, securities, tax, labor and employment, commercial disputes, services, charitable fundraising, contract disputes, escheatment of unclaimed or abandoned property, product liability, use of our services for illegal purposes, the matters described in “Note 13—Commitments and Contingencies— Litigation and Regulatory Matters—General Matters ” to our consolidated financial statements, and other matters.
If these third parties experience operational interference or disruptions (including a cybersecurity incident), fail to perform their obligations, or breach their agreements with us, our operations could be disrupted or otherwise negatively affected, which could result in customer dissatisfaction, regulatory scrutiny, and damage to our reputation and brands, and materially and adversely affect our business.
If these third parties experience operational interference or disruptions (including a cybersecurity incident), fail to perform their obligations, or breach their agreements with us, our operations could be disrupted or negatively affected, which could result in customer dissatisfaction, regulatory scrutiny, and damage to our reputation and brands, and materially and adversely affect our business.
We continue to undertake system upgrades and re-platforming efforts designed to improve the availability, reliability, resiliency, and speed of our payments platform. These efforts are costly and time-consuming, involve significant technical complexity and risk, may divert our resources from new features and products, and may ultimately not be effective.
While we continue to undertake system upgrades and re-platforming efforts designed to improve the availability, reliability, resiliency, and speed of our payments platform, these efforts are costly and time-consuming, involve significant technical complexity and risk, may divert our resources from new features and products, and may ultimately not be effective.
Our international operations subject us to significant challenges, uncertainties, and risks, including local regulatory, licensing, reporting, and legal obligations; costs and challenges associated with operating in markets in which we may have limited or no experience, including effectively localizing our products and services and adapting them to local preferences; difficulties in developing, staffing, and simultaneously managing a large number of varying foreign operations as a result of distance, language, and cultural differences and in light of varying laws, regulations, and customs; differing employment practices and the existence of works councils; difficulties in recruiting and retaining qualified employees and maintaining our company culture; fluctuations in foreign currency exchange rates; exchange control regulations; profit repatriation restrictions; potential tariffs, sanctions, fines, or other trade barriers or restrictions; import or export regulations; compliance with U.S. and foreign anti-bribery, anti-corruption, sanctions, anti-money laundering and counter-terrorist financing laws and regulations; the interpretation and application of laws of multiple jurisdictions; and national or regional political, economic, or social instability.
Our international operations subject us to significant challenges, uncertainties, and risks, including, but not limited to, local regulatory, licensing, reporting, and legal obligations; costs and challenges associated with operating in markets in which we may have limited or no experience, including effectively localizing our products and services and adapting them to local preferences; difficulties in developing, staffing, and simultaneously managing a large number of varying foreign operations as a result of distance, language, and cultural differences and in light of varying laws, regulations, and customs; differing employment practices and the existence of works councils; difficulties in recruiting and retaining qualified employees and maintaining our company culture; fluctuations in foreign exchange rates; exchange control regulations; profit repatriation restrictions; potential tariffs, sanctions, fines, or other trade barriers or restrictions; import or export regulations; compliance with U.S. and foreign anti-bribery, anti-corruption, sanctions, anti-money laundering and counter-terrorist financing laws and regulations; the interpretation and application of laws of multiple jurisdictions; and national or regional political, economic, or social instability.
Financial and third-party risks related to our customer cryptocurrency offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodians, insufficient insurance coverage by a custodian to reimburse us for all such losses, a custodian’s failure to maintain effective controls over the custody and settlement services provided to us, a custodian’s inability to purchase or liquidate cryptocurrency holdings, the failure of the PYUSD Issuer to maintain sufficient reserve assets backing PYUSD and defaults on financial or performance obligations by a custodian, banks with which the PYUSD Issuer maintains reserve assets or counterparty financial institutions, could expose our customers and us to loss, and therefore significantly harm our business, financial performance, and reputation.
Financial and third-party risks related to our customer cryptocurrency offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodians, insufficient insurance coverage by a custodian to reimburse us for all such losses, a custodian’s failure to maintain effective controls over the custody and settlement services provided to us, a custodian’s inability to purchase or liquidate cryptocurrency holdings, the failure of the PYUSD Issuer to maintain sufficient reserve assets backing PYUSD and defaults on financial or performance obligations by a custodian, banks with which the PYUSD Issuer maintains reserve assets or counterparty financial institutions, could expose our customers and us to loss, and significantly harm our business, financial condition, and reputation.
Cross-border trade may be negatively impacted by various factors including foreign currency exchange rate fluctuations, tariffs, trade barriers or restrictions, sanctions, import or export controls, and the interpretation and application of laws of multiple jurisdictions in the context of cross-border trade and foreign exchange.
Cross-border trade may be negatively impacted by various factors including foreign exchange rate fluctuations, tariffs, trade barriers or restrictions, sanctions, import or export controls, and the interpretation and application of laws of multiple jurisdictions in the context of cross-border trade and foreign exchange.
There are substantial costs and potential product and operational changes involved in maintaining and renewing licenses, certifications, and approvals, and we could be subject to enforcement actions, fines, and litigation if we are found to violate any of these requirements.
There are substantial costs and potential product and operational changes involved in maintaining and renewing licenses, certifications, and approvals, and we could be subject to enforcement actions, fines, penalties, and litigation if we are found to violate any of these requirements.
While we engage in disaster recovery planning and testing intended to mitigate risks from outages or delays, our planning and testing may not be sufficient for all possible outcomes or events.
While we engage in disaster recovery planning and testing intended to mitigate risks from outages or delays, our planning and testing may not be effective or sufficient for all possible outcomes or events.
If we or the PYUSD Issuer fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, we could face regulatory or other enforcement actions, potential fines, and other consequences.
If we or the PYUSD Issuer fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, we could face regulatory or other enforcement actions, potential fines, penalties, and other consequences.
Cross-border trade (i.e., transactions where the merchant and consumer are in different countries) is an important source of our revenues and profits. Cross-border transactions generally provide higher revenues and operating income than similar transactions that take place within a single country or market. In certain markets, cross-border trade represents our primary (and in some instances our only) presence.
Cross-border trade (i.e., transactions where the merchant and consumer are in different countries) is an important source of our revenues and profits. Cross-border transactions generally provide higher revenues and operating income than similar transactions that take place within a single country or market. In certain markets, cross-border trade represents our primary (and in some instances our only) offerings.
The techniques used to attempt to obtain unauthorized or illegal access to systems and information (including customers’ personal data), disable or degrade service, exploit vulnerabilities, or sabotage systems are constantly evolving. In some circumstances, these attempts may not be recognized or detected until after they have been launched against a target.
The techniques used to attempt to obtain unauthorized or illegal access to systems and information (including customers’ personal data), disable or degrade service, exploit vulnerabilities, or sabotage systems are continuously evolving. In some circumstances, these attempts may not be recognized or detected until after they have been launched against a target.
PayPal (Europe) is also subject to regulation by the ECB under the oversight framework for electronic payment instruments, schemes and arrangements (PISA). Compliance with applicable laws and regulations could become more costly and operationally difficult to manage due to additional supervision, potentially inconsistent interpretations, and domestic regulations by various countries in the region.
PayPal (Europe) is also subject to regulation by the ECB under the oversight framework for electronic payment instruments, schemes and arrangements (“PISA”). Compliance with applicable laws and regulations could become more costly and operationally difficult to manage due to additional supervision, potentially inconsistent interpretations, and domestic regulations by various countries in the region.
Any of the foregoing could, individually or in the aggregate, result in substantial additional costs, delay or preclude planned transactions, product launches or improvements, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, products and services, or prevent or limit us from providing our products or services in a given market.
Any of the foregoing could, individually or in the aggregate, result in substantial additional costs, delay or preclude planned transactions, geographical expansions, or product launches or improvements, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, products and services, or prevent or limit us from providing our products or services in a given market.
Increases in our loss rate, including as a result of changes to the scope of transactions covered by our protection programs, could negatively impact our business. See “Note 13—Commitments and Contingencies— Protection Programs ” to our consolidated financial statements. Failure to effectively monitor and evaluate the financial condition of our merchants may expose PayPal to losses.
Increases in our loss rate, including as a result of changes to the scope of transactions covered by our protection programs, could negatively impact our business and results of operations. See “Note 13—Commitments and Contingencies— Protection Programs ” to our consolidated financial statements. Failure to effectively monitor and evaluate the financial condition of our merchants may expose PayPal to losses.
Our systems and operations and those of our service providers and partners have experienced from time to time, and may experience in the future, business interruptions or degradation of service because of distributed denial-of-service and other cyberattacks, insider threats, hardware and software defects or malfunctions, human error, earthquakes, hurricanes, floods, fires, 16 Table of Contents and other natural disasters, public health crises (including pandemics), power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks, computer viruses or other malware, or other events.
Our systems and operations and those of our service providers and partners have experienced from time to time, and may experience in the future, business interruptions or degradation of service because of distributed denial-of-service and other cyberattacks, insider threats, hardware and software defects or malfunctions, human error, earthquakes, hurricanes, floods, fires, and other natural disasters, public health crises (including pandemics), power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks, computer viruses or other malware, or other events.
Any failure or perceived failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to or expansion of their interpretation) may subject us to significant fines, penalties, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions; result in additional compliance and licensure requirements; cause us to lose existing licenses or prevent or delay us from obtaining additional licenses that may be required for our business; increase regulatory scrutiny of our business; divert management’s time and attention from our business; restrict our operations; lead to increased friction for customers; force us to make changes to our business practices, products, or operations; require us to engage in remediation activities; or delay planned transactions, product launches, or improvements.
Any failure or perceived failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to or expansion of their interpretation) may subject us to significant fines, penalties, monetary damages, injunctive relief, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions; result in additional compliance and licensure requirements; cause us to lose existing licenses or prevent or delay us from obtaining additional licenses that may be required for our business; increase regulatory scrutiny of our business; divert management’s time and attention from our business; restrict our operations; lead to increased friction for customers; force us to make changes to our business practices, products, or operations; require us to engage in remediation activities; or delay planned transactions, product launches, or improvements.
Outside of the U.S., we principally provide our services to customers in the European Economic Area (“EEA”) through PayPal (Europe) S.à.r.l. et Cie, S.C.A. (“PayPal (Europe)”), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg and PayPal U.K.
We principally provide our services to customers in the European Economic Area (“EEA”) through PayPal (Europe) S.à.r.l. et Cie, S.C.A. (“PayPal (Europe)”), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg and PayPal U.K.
We have significant amounts of cash, cash equivalents, receivables outstanding, and other investments on deposit or in accounts with banks or other financial institutions in the U.S. and international jurisdictions. As part of our foreign currency hedging activities, we regularly enter into transactions involving derivative financial instruments with various financial institutions.
We have significant amounts of cash, cash equivalents, receivables outstanding, and other investments on deposit or in accounts with banks or other financial institutions in the U.S. and international jurisdictions. As part of our foreign exchange hedging activities, we regularly enter into transactions involving derivative financial instruments with various financial institutions.
Cybersecurity breaches and other exploited security vulnerabilities could subject us to significant costs and third-party liabilities, result in improper disclosure of data and violations of applicable privacy and other laws, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, damage our reputation and brands, divert the attention of management from the operation of our business, result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses to or claims by them, or expose us to litigation, regulatory investigations, and significant fines and penalties.
These or other cybersecurity breaches and other exploited security vulnerabilities have subjected us and could further subject us to significant costs and third-party liabilities, result in improper disclosure of data and violations of applicable privacy and other laws, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, damage our reputation and brands, divert the attention of management from the operation of our business, result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses to or claims by them, or expose us to litigation, regulatory investigations, and significant fines and penalties.
We often partner with other businesses, and the ability to continue establishing these partnerships is important to our business. Competition for relationships with these partners is intense, and there can be no assurance that we will be able to continue to establish, grow, or maintain these partner relationships.
We often partner with other businesses, and the ability to continue developing these partnerships is important to our business. Competition for relationships with these partners is intense, and there can be no assurance that we will be able to continue to establish, grow, or maintain these partner relationships.
We may experience scrutiny or criticism from customers, partners, employees, government entities, media, advocacy groups, and other influencers or stakeholders that disagree with, among other things, our product offering decisions or public policy positions.
We may experience scrutiny or criticism from customers, partners, employees, government entities, media, advocacy groups, and other influencers or stakeholders that disagree with, among other things, our product offering decisions, internal policies, or public policy positions.
If we are unable to comply with new laws and regulations or changes to legal or regulatory requirements concerning ESG matters, or fail to meet investor, industry or stakeholder expectations and standards, our reputation may be harmed, customers may choose to refrain from using our products and services, we may be subject to fines, penalties, regulatory or other enforcement actions, and our business or financial condition may be adversely affected.
If we are unable to comply with new laws and regulations concerning ESG matters or fail to meet investor, industry or stakeholder expectations and standards, our reputation may be harmed, customers may choose to refrain from using our products and services, we may be subject to fines, penalties, regulatory or other enforcement actions, and our business or financial condition may be adversely affected.
Unauthorized parties will continue to attempt to gain access to our systems or facilities through various means, including through hacking into our systems or facilities or those of our customers, partners, or vendors, and attempting to fraudulently induce users of our systems (including employees, vendor and partner personnel and customers) into disclosing user names, passwords, payment card information, multi-factor authentication application access or other sensitive information used to gain access to such systems or facilities.
Unauthorized parties continuously attempt to gain access to our systems or facilities through various means, including through hacking into our systems or facilities or those of our customers, partners, or vendors, and attempting to fraudulently induce users of our systems (including employees, vendor and partner personnel and customers) into disclosing user names, passwords, payment card information, multi-factor authentication application access or other sensitive information used to gain access to such systems or facilities.
Ltd. or by local branches or subsidiaries subject to local regulatory supervision or oversight, as the case may be, there may be uncertainty whether our Singapore-based service is subject only to Singapore law or also to other local laws, and whether such local laws might require a payment processor like us to be licensed as a payments service, bank, financial institution, or otherwise.
Ltd. or local branches or subsidiaries subject to local regulatory supervision or oversight, as the case may be, are located, there may be uncertainty whether our Singapore-based service is subject only to Singapore law or also to other local laws, and whether such local laws might require a payment processor like us to be licensed as a payments service, bank, financial institution, or otherwise.
A prolonged interruption of, or reduction in, the availability, speed, or functionality of our products and services could materially harm our business. Frequent or persistent interruptions in our services could permanently harm our relationship with our customers and partners and our reputation.
A prolonged interruption of, or reduction in, the availability, speed, or functionality of our products and services could materially harm our business and financial condition. Frequent or persistent interruptions in our services could permanently harm our relationship with our customers and partners and our reputation.
In June 2020, the Federal Deposit Insurance Corporation (“FDIC”) approved a final rule clarifying that loans validly originated by state-chartered banks or insured branches of foreign banks remain valid throughout the lifetime of the loan, reflecting a similar rule finalized by the Office of the Comptroller of Currency (“OCC”) in May 2020 for nationally chartered banks.
In June 2020, the Federal 22 Table of Contents Deposit Insurance Corporation (“FDIC”) approved a final rule clarifying that loans validly originated by state-chartered banks or insured branches of foreign banks remain valid throughout the lifetime of the loan, reflecting a similar rule finalized by the Office of the Comptroller of Currency (“OCC”) in May 2020 for nationally chartered banks.
Measures to detect and reduce the risk of fraud and abusive 25 Table of Contents behavior are complex, require continuous improvement, and may not be effective in detecting and preventing fraud, particularly new and continually evolving forms of fraud or in connection with new or expanded product offerings. If these measures are not effective, our business could be negatively impacted.
Measures to detect and reduce the risk of fraud and abusive behavior are complex, require continuous improvement, and may not be effective in detecting and preventing fraud, particularly new and continually evolving forms of fraud or in connection with new or expanded product offerings. If these measures are not effective, our business could be negatively impacted.
We rely on third parties in many aspects of our business, including networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions; unaffiliated third-party lenders to originate our U.S. credit products to consumers, U.S. merchant financing, and branded credit card products; branded debit card and savings products issued by unaffiliated banks; cryptocurrency custodial service providers; and external business partners and contractors who provide key functions (e.g., outsourced customer support and product development functions; facilities; information technology, data center facilities and cloud computing).
We rely on third parties in many aspects of our business, including, but not limited to, networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions; unaffiliated third-party lenders to originate our U.S. credit products to consumers, U.S. merchant financing, and branded credit card products; branded debit card and savings products issued by unaffiliated banks; cryptocurrency custodial service providers; and external business partners and contractors who provide key functions (including, but not limited to, data center facilities and cloud computing, information technology, and outsourced customer support and product development functions).
Rapid, significant, and disruptive technological changes impact the industries in which we operate, including payment technologies (including real-time payments, payment card tokenization, virtual currencies, distributed ledger and blockchain technologies, and proximity payment technology such as Near Field Communication and other contactless payments); internet browser technologies, that enable users to easily store their payment card information for use on any retail or e-commerce website; artificial intelligence and machine learning; developments in technologies supporting our regulatory and compliance obligations; and in-store, digital, and social commerce.
Rapid, significant, and disruptive technological changes impact the industries in which we operate, including payment technologies (including real-time payments, payment card tokenization, virtual currencies, distributed ledger and blockchain technologies, and proximity payment technology such as Near Field Communication and other contactless payments); internet browser technologies that enable users to easily store their payment card information for use on any retail or e-commerce website; artificial intelligence (“AI”) and machine learning; developments in technologies supporting our regulatory and 15 Table of Contents compliance obligations; and in-store, digital, and social commerce.
Any failure to adequately protect or enforce our 22 Table of Contents proprietary rights, or significant costs incurred in doing so, could diminish the value of our intangible assets and materially harm our business. BUSINESS AND OPERATIONS RISKS We face substantial and increasingly intense competition worldwide in the global payments industry.
Any failure to adequately protect or enforce our proprietary rights, or significant costs incurred in doing so, could diminish the value of our intangible assets and materially harm our business. BUSINESS AND OPERATIONS RISKS We face substantial and increasingly intense competition worldwide in the global payments industry.
We pay transaction fees when consumers fund payment transactions using credit cards, lower fees when consumers fund payments with debit cards, and nominal fees when consumers fund payment transactions by electronic transfer of funds from bank accounts, from an existing PayPal account balance or Venmo account balance, or through our PayPal branded consumer 23 Table of Contents credit products.
We pay transaction fees when consumers fund payment transactions using credit cards, lower fees when consumers fund payments with debit cards, and nominal fees when consumers fund payment transactions by electronic transfer of funds from bank accounts, from an existing PayPal account balance or Venmo account balance, or through our PayPal branded consumer credit products.
While we maintain insurance policies intended to help offset the financial impact we may experience from these risks, our coverage may be insufficient to compensate us for all losses caused by security breaches and other damage to or unavailability of our systems.
While we maintain insurance policies intended to help offset the financial impact we may experience from these risks, our coverage may be insufficient to compensate us for all losses caused by security breaches and other damage to or 14 Table of Contents unavailability of our systems.
Due to the nature of PayPal’s digital payments services, third parties may seek to engage in abusive schemes or fraud attacks that are often difficult to detect and may be deployed at a scale that would otherwise not be possible in physical transactions.
Due to the nature of PayPal’s digital payments services, third parties may seek to engage in abusive schemes or fraud attacks that are often difficult to detect and may be deployed at a scale that would otherwise not be possible in physical 23 Table of Contents transactions.
We expect to continue to consider and evaluate a wide array of potential strategic transactions as part of our overall business strategy, including business combinations, acquisitions, and dispositions of certain businesses, technologies, services, products, and other assets; strategic investments; and commercial and strategic partnerships (collectively, “strategic transactions”).
We expect to continue to consider and evaluate a wide array of potential strategic transactions as part of our overall business 24 Table of Contents strategy, including business combinations, acquisitions, and dispositions of certain businesses, technologies, services, products, and other assets; strategic investments; and commercial and strategic partnerships (collectively, “strategic transactions”).
Competition also may intensify as new competitors emerge, businesses enter into business combinations and partnerships, and established companies in other segments expand to become competitive with various aspects of our business. We compete with a wide range of businesses in every aspect of our business.
Competition also may intensify as new competitors emerge, businesses combine or enter into new partnerships, and established companies in other segments expand to become competitive with various aspects of our business. We compete with a wide range of businesses in every aspect of our business.
Global and regional economic conditions could harm our business. 27 Table of Contents Adverse global and regional economic conditions such as turmoil affecting the banking system or financial markets, including, but not limited to, tightening in the credit markets, extreme volatility or distress in the financial markets (including the fixed income, credit, currency, equity, and commodity markets), higher unemployment, high consumer debt levels, recessionary or inflationary pressures, supply chain issues, reduced consumer confidence or economic activity, government fiscal, monetary and tax policies, U.S. and international trade relationships, agreements, treaties, tariffs and restrictive actions, the inability of a government to enact a budget in a fiscal year, government shutdowns, government austerity programs, and other negative financial news or macroeconomic developments could have a material adverse impact on the demand for our products and services, including a reduction in the volume and size of transactions on our payments platform.
Adverse global and regional economic conditions such as turmoil affecting the banking system or financial markets, including, but not limited to, tightening in the credit markets, extreme volatility or distress in the financial markets (including the fixed 25 Table of Contents income, credit, currency, equity, and commodity markets), unemployment, consumer debt levels, recessionary or inflationary pressures, supply chain issues, reduced consumer confidence or economic activity, government fiscal, monetary and tax policies, U.S. and international trade relationships, agreements, treaties, tariffs and restrictive actions, the inability of a government to enact a budget in a fiscal year, government shutdowns, government austerity programs, geopolitical conditions or events, and other negative financial news or macroeconomic developments could have a material adverse impact on the demand for our products and services, including a reduction in the volume and size of transactions on our payments platform.
We rely in part on 17 Table of Contents third parties, including some of our competitors, for the development of and access to new or evolving technologies. These third parties may restrict or prevent our access to, or utilization of, those technologies, as well as their platforms or products.
We rely in part on third parties, including some of our competitors, for the development of and access to new or evolving technologies. These third parties may restrict or prevent our access to, or utilization of, those technologies, as well as their platforms or products.
Companies and government agencies have in the past alleged, and may in the future allege, that our actions violate the antitrust or competition laws in the U.S. or other jurisdictions in which we operate or otherwise constitute unfair competition, or that our products and services are used so broadly that otherwise uncontroversial business practices could be deemed anticompetitive.
Companies and government agencies have in the past alleged, and may in the future allege, that our actions (or actions of companies with which we have commercial agreements) violate the antitrust or competition laws in the U.S. or other jurisdictions in which we operate or otherwise constitute unfair competition, or that our products and services are used so broadly that otherwise uncontroversial business practices could be deemed anticompetitive.
Although we have generally taken measures to protect our intellectual property, there can be no assurance that we will be successful in protecting or enforcing our rights in every jurisdiction, that our contractual arrangements will prevent or deter third parties from infringing or misappropriating our intellectual property, or that third parties will not independently develop equivalent or superior intellectual property rights.
Although we have generally taken measures to protect our intellectual 20 Table of Contents property, there can be no assurance that we will be successful in protecting or enforcing our rights in every jurisdiction, that our contractual arrangements will prevent or deter third parties from infringing or misappropriating our intellectual property, or that third parties will not independently develop equivalent or superior intellectual property rights.
We expect that third parties will continue to attempt to abuse access to and misuse our payments services to commit fraud by, among other things, creating fictitious PayPal accounts using stolen or synthetic identities or personal information, making transactions with stolen financial instruments, abusing or misusing our services for financial gain, or fraudulently inducing users of our systems into engaging in fraudulent transactions.
We expect that third parties will continue to attempt to abuse access to and misuse our payments services to commit fraud by, among other things, creating fictitious PayPal accounts using stolen or synthetic identities or personal information, taking over customer accounts or creating fraudulent accounts, making transactions with stolen financial instruments, abusing or misusing our services for financial gain, or fraudulently inducing users of our products and services into engaging in fraudulent transactions.
If we are unable to develop and incorporate new technologies and adapt to technological changes and evolving industry standards in a timely or cost-effective manner, our business could be harmed. LEGAL, REGULATORY AND COMPLIANCE RISKS Our business is subject to extensive government regulation and oversight.
If we are unable to develop and incorporate new technologies and adapt to technological changes and evolving industry standards in a timely or cost-effective manner, our business, results of operations, or reputation could be harmed. LEGAL, REGULATORY AND COMPLIANCE RISKS Our business is subject to extensive government regulation and oversight.
While we have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, there can be no assurance that our employees, contractors, and agents will not violate such laws and regulations. Payments Regulation In the U.S., PayPal, Inc.
While we have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, there can be no assurance that our employees, contractors, and agents will not violate such laws and regulations. Payments Regulation 16 Table of Contents In the U.S., PayPal, Inc.
The networks could adopt new operating rules or interpret or re-interpret existing rules that we or our payment processors might find difficult or impractical to follow, or costly to implement, which could require us to make significant changes to our products, increase our operational costs, and negatively impact our business.
The networks could adopt new operating rules or interpret or re-interpret existing rules that 21 Table of Contents we or our payment processors might find difficult or impractical to follow, or costly to implement, which could require us to make significant changes to our products, increase our operational costs, and negatively impact our business.
Any changes in interchange fee rates or limitations, or their applicability to PayPal, could adversely affect our competitive position against payment card service providers and the revenue we earn from our branded card programs, require us to change our business practices, and harm our business.
Any changes in interchange fee rates or limitations, or their applicability to PayPal’s products and services, could adversely affect our competitive position against payment card service providers and the revenue we earn from our branded card programs, require us to change our business practices, and harm our business.
We seek to recover losses from our protection programs from the merchant, but may not be able to fully recover our losses (for example, if the merchant is unwilling or unable to pay, the transaction involves a fraudulent merchant, or the merchant provides sufficient evidence that the item was delivered).
While we may seek to recover losses from our protection programs from the merchant, we ultimately may not be able to fully recover such losses (for example, if the merchant is unwilling or unable to pay, the transaction involves a fraudulent merchant, or the merchant provides sufficient evidence that the item was delivered).
Privacy and Protection of Customer Data The legal and regulatory environment relating to privacy and data protection laws continues to develop and evolve in ways we cannot predict, including with respect to technologies such as cloud computing, artificial intelligence, machine learning, cryptocurrency, and blockchain technology.
Privacy and Protection of Customer Data The legal and regulatory environment relating to privacy and data protection laws continues to develop and evolve in ways we cannot predict, including with respect to technologies such as cloud computing, (generative) AI, machine learning, cryptocurrency, and blockchain technology.
In June 2023, we entered into a multi-year agreement to sell up to €40 billion of U.K. and European buy now, pay later (“BNPL”) loan receivables originated by PayPal (Europe) and PayPal U.K., consisting of the sale of a substantial majority of the U.K. and European BNPL loan portfolio held on PayPal (Europe)’s balance sheet at the closing of the transaction and a forward-flow arrangement for the sale of future originations of eligible loans, and in October 2023, we began selling those receivables.
In June 2023, we entered into a multi-year agreement to sell U.K. and European buy now, pay later (“BNPL”) loan receivables originated by PayPal (Europe) and PayPal U.K., consisting of the sale of a substantial majority of the U.K. and European BNPL loan portfolio held on PayPal (Europe)’s balance sheet at the closing of the transaction and a forward-flow arrangement for the sale of future originations of eligible loans.
We invest in measures intended to detect and block activities that may occur on our payments platform in violation of our policies and applicable laws. These measures require continuous improvement and may not be sufficiently effective in detecting and preventing the exchange of information in violation of our policies and applicable laws.
We invest in measures intended to detect and block activities that may occur on our payments platform in violation of our policies and applicable laws. These measures require continuous improvement and may not be sufficiently effective in detecting and preventing the exchange of information in violation of our policies and applicable laws, which could negatively impact our business.
Such events may disrupt our business and may cause us to experience additional costs to maintain or resume operations and higher attrition. If one or more of our counterparty financial institutions default on their financial or performance obligations to us or fail, we may incur significant losses.
Such events may disrupt our business and may cause us to experience additional costs to maintain or resume operations. 26 Table of Contents If one or more of our counterparty financial institutions default on their financial or performance obligations to us or fail,we may incur significant losses.
We are also required to comply with economic and trade sanctions administered by the U.S., the EU and its member states, the U.K., and other jurisdictions in which we operate.
We are also required to comply with economic and trade sanctions administered by the U.S., the European Union (“EU”) and its member states, the U.K., and other jurisdictions in which we operate.
The rapidly evolving regulatory landscape with respect to cryptocurrency may subject us to additional licensing and regulatory obligations or to additional inquiries or investigations from the SEC or other regulators and governmental authorities, and require us to make product changes, restrict or discontinue product offerings in certain markets, implement additional and potentially costly controls, or take other actions.
The rapidly evolving 17 Table of Contents legislative and regulatory landscapes with respect to cryptocurrency may subject us to additional licensing and regulatory obligations or to additional inquiries or investigations from the SEC or other regulators and governmental authorities, and require us to make product changes, restrict or discontinue product offerings in certain markets, implement additional and potentially costly controls, or take other actions.
In August 2023, a third-party issuer with which we have partnered commercially (the “PYUSD Issuer”) launched a U.S. dollar-denominated stablecoin named PayPal USD (“PYUSD”), which was initially available to PayPal U.S. customers and subsequently made available to Venmo customers in September 2023.
In August 2023, a third-party issuer with which we have partnered commercially (the “PYUSD Issuer”) launched a U.S. dollar-denominated stablecoin named PayPal USD (“PYUSD”), which is available to PayPal U.S. customers and Venmo customers.
For example, numerous U.S. states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and retention of their residents’ personal information.
For example, numerous U.S. states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and retention of their residents’ personal information as well as specific privacy obligations around youth.
The number and significance of these disputes and inquiries is expected to continue to increase as our products, services, and business expand in complexity, scale, scope, and geographic reach, including through acquisitions of businesses and technology.
We expect that the number and significance of these disputes and inquiries will continue to increase as our products, services, and business expand in complexity, scale, scope, and geographic reach, including through acquisitions of businesses and technology.
We expect that new technologies applicable to the industries in which we operate will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services.
We expect that new technologies applicable to the industries in which we operate, including the development, adoption, and use of generative AI technologies, will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services.
If our reputation or our brands are damaged, our business and operating results may be harmed. Our reputation and brands are globally recognized, important to our business, and affect our ability to attract and retain our customers. There are numerous ways our reputation or brands could be damaged.
Our reputation and brands are globally recognized, important to our business, and affect our ability to attract and retain our customers. There are numerous ways our reputation or brands could be damaged.
We may be subject to claims relating to information disseminated through our online services, including claims alleging defamation, libel, harassment, hate speech, breach of contract, invasion of privacy, negligence, copyright or trademark infringement, or other theories based on the nature and content of the materials disseminated through the services, among other things.
We may be subject to claims relating to information disseminated through our online services by our customers and other third parties, including, but not limited to, claims alleging defamation, libel, harassment, hate speech, breach of contract, invasion of privacy, negligence, copyright or trademark infringement, or other theories based on the nature and content of the materials disseminated through the services.
Ltd. has been issued a Major Payment Institution license by the MAS under the Payment Services Act 2019 to continue providing payments services.
Ltd. has been issued a Major Payment Institution license by the MAS under the Payment Services Act 2019.
Consumer Protection Violations of federal and state consumer protection laws and regulations, including the Electronic Fund Transfer Act (“EFTA”) and Regulation E as implemented by the Consumer Financial Protection Bureau (“CFPB”), could result in the assessment of significant actual damages or statutory damages or penalties (including treble damages in some instances) and plaintiffs’ attorneys’ fees.
Consumer Protection 18 Table of Contents Violations of consumer protection law in applicable jurisdictions, including both federal and state laws and regulations in the U.S., such as the Electronic Fund Transfer Act (“EFTA”) and Regulation E as implemented by the Consumer Financial Protection Bureau (“CFPB”), could result in the assessment of significant actual damages or statutory damages or penalties (including treble damages in some instances) and plaintiffs’ attorneys’ fees.
Limited (“PayPal U.K.”), a wholly-owned subsidiary that is subject to 18 Table of Contents regulation as an electronic money institution in the United Kingdom (“U.K.”) by the Financial Conduct Authority (“FCA”). PayPal (Europe) or PayPal U.K. may be subject to enforcement actions and significant fines if either violates applicable requirements.
Limited (“PayPal U.K.”), a wholly-owned subsidiary that is subject to regulation as an electronic money institution and a consumer credit firm (and registration as a crypto asset business) in the United Kingdom (“U.K.”) by the Financial Conduct Authority (“FCA”). PayPal (Europe) or PayPal U.K. may be subject to enforcement actions and significant fines and penalties if either violates applicable requirements.
If we are unable to effectively manage our third-party relationships, these third parties are unable to meet their obligations to us, or we experience substantial disruptions in these relationships, our operations, results of operations, and financial results could be adversely impacted.
If we are unable to effectively manage our third-party relationships, these third parties are unable to meet their obligations to us, we are overly reliant on certain relationships, or we experience substantial disruptions in these relationships (including interruptions to the availability of our products and services), our operations, results of operations, and financial results could be adversely impacted.
In addition, our future income taxes could be adversely affected by the incurrence of losses or earnings being lower than anticipated in jurisdictions that have lower statutory tax rates, and earnings being higher than anticipated in jurisdictions that have higher statutory tax rates; by changes in the valuation of our deferred tax assets and liabilities, including as a result of gains on our foreign currency exchange risk management program; by changes in tax laws, regulations, or accounting principles; or by certain discrete items.
In addition, our future income taxes could be adversely affected by changes in our geographical mix of income and impacts of statutory tax rates; by changes in the valuation of our deferred tax assets and liabilities, including as a result of gains on our foreign exchange risk management program; by changes in tax laws, regulations, or accounting principles; or by certain discrete items.
In order to maintain this license and certain other licenses or registrations we hold in certain markets, we are required to comply with applicable regulatory requirements, which will result in increased operational complexity and costs for our Singapore and international operations. In many of the markets outside the U.S. (other than Singapore) served by PayPal Pte.
In order to maintain this license and certain other licenses or registrations we hold in certain markets, we are required to comply with applicable regulatory requirements, which have imposed and will continue to impose increasing operational complexity and costs for our Singapore and international operations. Moreover, in many non-U.S. markets (other than Singapore) where customers of PayPal Pte.
If we are unable to differentiate our products and services from those of our competitors, drive value for our customers, or effectively and efficiently align our resources with our goals and objectives, we may not be able to compete effectively. See “Item 1.
If we are unable to differentiate our products and services from those of our competitors, drive value for our customers and adoption of our products and services, or effectively and efficiently align our resources with our goals and objectives, we may not be able to compete effectively, which could negatively impact our results of operations and financial condition.
In addition, we could face 19 Table of Contents reputational harm through our relationship with the PYUSD Issuer if the PYUSD Issuer were to face regulatory scrutiny, PYUSD is deemed to be a security, or PYUSD is alleged to be used for transactions in connection with illicit or illegal activities.
In addition, we could face reputational harm through our relationship with the PYUSD Issuer if the PYUSD Issuer were to face regulatory scrutiny, PYUSD is deemed to be a security, or PYUSD is alleged to be used for transactions in connection with illicit or illegal activities. We hold our customers’ cryptocurrency assets through one or more third-party custodians.
Many jurisdictions in which we operate globally have enacted, or are in the process of enacting, data privacy legislation or regulations aimed at creating and enhancing individual privacy rights.
Many jurisdictions in which we operate globally have enacted, or are in the process of enacting, data privacy legislation or regulations aimed at creating and enhancing individual privacy rights, including with respect to the use of personal data for personalization and cross-contextual advertising.
In many of the other markets outside the U.S. in which we do business, we serve our customers through PayPal Pte. Ltd., our wholly-owned subsidiary based in Singapore. PayPal Pte. Ltd. is supervised by the Monetary Authority of Singapore (“MAS”). As of July 1, 2023, PayPal Pte.
For many of the other markets outside the U.S., we provide services on a cross-border basis through PayPal Pte. Ltd., our wholly-owned subsidiary based in Singapore. PayPal Pte. Ltd. is supervised by the Monetary Authority of Singapore (“MAS”). As of July 1, 2023, PayPal Pte.
We currently purchase receivables related to our U.S. PayPal-branded merchant financing offerings and certain U.S. consumer installment loan products and extend credit for our consumer and merchant products outside the U.S. through our international 24 Table of Contents subsidiaries.
PayPal-branded merchant financing offerings and certain U.S. consumer installment loan products and extend credit for our consumer and merchant products outside the U.S. through our international subsidiaries.
If our credit ratings are downgraded or other negative action is taken, the interest rates payable by us under our indebtedness may increase, and our ability to obtain additional financing in the future on favorable terms or at all could be adversely affected. 29 Table of Contents Changes in tax laws, exposure to unanticipated additional tax liabilities, or implementation of reporting or record-keeping obligations could have a material adverse effect on our business.
If our credit ratings are downgraded or other negative action is taken, the interest rates payable by us under our indebtedness may increase, and our ability to obtain additional financing in the future on favorable terms or at all could be adversely affected.
If the laws or regulations that provide protections for online dissemination of information are invalidated or are modified to reduce protections available to us and we become liable for information provided by our customers and carried on our products and services, we could be directly harmed and we may be forced to implement new measures to reduce our exposure, including expending substantial resources or discontinuing certain product or service offerings, which could harm our business.
If the laws or regulations that provide protections for online dissemination of information are invalidated, modified, or supplemented to reduce protections available to us, or to increase requirements on us to remove certain information or implement other processes, we could be harmed and may be forced to implement new measures to reduce our potential liability for information provided by our customers and carried on our products and services.