Biggest changeCryptocurrency Regulation and Related Risks Our customer cryptocurrency offerings could subject us to additional regulations, licensing requirements, or other obligations or liabilities. Within the U.S., we are regulated by the New York State Department of Financial Services as a virtual currency business, which does not qualify us to engage in securities brokerage or dealing activities.
Biggest changeWithin the U.S., we are regulated by the New York State Department of Financial Services as a virtual currency FY 2025 FORM 10-K 17 Table of Contents business, which does not permit us to engage in securities brokerage or dealing activities. Additionally, we are a digital asset service provider under the Guiding and Establishing National Innovation for U.S.
Unauthorized parties continuously attempt to gain access to our systems or facilities through various means, including through hacking into our systems or facilities or those of our customers, partners, or vendors, and attempting to fraudulently induce users of our systems (including employees, vendor and partner personnel and customers) into disclosing user names, passwords, payment card information, multi-factor authentication application access or other sensitive information used to gain access to such systems or facilities.
Unauthorized parties continuously attempt to gain access to our systems or facilities through various means, including through hacking into our systems or facilities or those of our customers, partners, or vendors, and attempting to fraudulently induce users of our systems (including customers, employees, and partner and vendor personnel) into disclosing user names, passwords, payment card information, multi-factor authentication application access or other sensitive information used to gain access to such systems or facilities.
In addition, any failure to successfully implement new information systems and technologies or improvements or upgrades to existing information systems and technologies in a timely manner could lead to regulatory scrutiny, significant fines and penalties, and mandatory and costly changes to our business, adversely impact our business, internal controls, results of operations, and financial condition, and ultimately could cause us to lose existing licenses that we need to operate or prevent or delay us from obtaining additional licenses that may be required for our business.
In addition, any failure to successfully implement new information systems and technologies or improvements or upgrades to existing information systems and technologies in a timely manner could lead to regulatory scrutiny, significant fines and penalties, and mandatory and costly changes to our business, adversely impact our business, internal controls, results of operations, and financial condition, and ultimately cause us to lose existing licenses that we need to operate or prevent or delay us from obtaining additional licenses that may be required for our business.
The continued proliferation of privacy laws in the jurisdictions in which we operate is likely to result in a disparate array of privacy rules with unaligned or conflicting provisions, accountability requirements, individual rights, and national or local enforcement powers, which may subject us to increased regulatory scrutiny and business costs and could lead to unintended consumer confusion.
The continued proliferation of privacy laws in the jurisdictions in which we operate is likely to result in a disparate array of privacy rules with unaligned or conflicting provisions, accountability requirements, individual rights, and national or local enforcement powers, which could lead to unintended consumer confusion and may subject us to increased regulatory scrutiny and business costs.
We may also be subject to fines and other penalties assessed by networks resulting from any rule violations by us or our merchants. The networks set and interpret their rules, and have alleged from time to time that various aspects of our business model violate these rules, or our agreements with the networks.
We may also be subject to fines and other penalties assessed by networks resulting from any rule violations by us or our merchants. The networks set and interpret their rules, and from time to time have alleged that various aspects of our business model violate these rules, or our agreements with the networks.
Such allegations may result in significant fines, penalties, damages, or other liabilities, adversely impact benefits to us under the agreements, or require changes in our business practices that may be costly and adversely affect our business, results of operations and financial condition.
Such allegations may result in significant fines, penalties, damages, or other liabilities, adversely impact benefits to us under the agreements, or require changes to our business practices that may be costly and adversely affect our business, results of operations, and financial condition.
We pay transaction fees when consumers fund payment transactions using credit cards, lower fees when consumers fund payments with debit cards, and nominal fees when consumers fund payment transactions by electronic transfer of funds from bank accounts, from an existing PayPal account balance or Venmo account balance, or through our PayPal branded consumer credit products.
We pay transaction fees when consumers fund payment transactions using credit cards, lower fees when consumers fund payments with debit cards, and nominal fees when consumers fund payment transactions by electronic transfer of funds from bank accounts, from an existing PayPal or Venmo account balance, or through our PayPal branded consumer credit products.
The credit decision-making process for our consumer credit products uses proprietary methodologies and credit algorithms and other analytical techniques designed to analyze the credit risk of specific consumers based on, among other factors, their past purchase and transaction history with PayPal or Venmo and their credit scores.
The credit decision-making process for our consumer credit products uses proprietary methodologies, credit algorithms and other analytical techniques designed to analyze the credit risk of specific consumers based on, among other factors, their past purchase and transaction history with PayPal or Venmo and their credit scores.
These risk models may not accurately predict the creditworthiness of a consumer or merchant due to inaccurate assumptions, including those related to the particular consumer or merchant, market conditions, economic environment, or limited transaction history or other data.
These risk models may not accurately predict the creditworthiness of a consumer or merchant due to inaccurate assumptions, including those related to the particular consumer or merchant, market conditions or economic environment, or limited transaction history or other data.
The accuracy of these risk models and the ability to manage credit risk related to our credit products may also be affected by legal or regulatory requirements, changes in consumer behavior, changes in the economic environment, issuing bank policies, and other factors.
The accuracy of these risk models and our ability to manage credit risk related to our credit products may also be affected by legal or regulatory requirements or consumer behavior, changes in the economic environment, issuing bank policies, and other factors.
Failure to deal effectively with fraud, abusive behaviors, bad transactions, and negative customer experiences may increase our loss rate and could negatively impact our business and severely diminish merchant and consumer confidence in and use of our services.
Failure to deal effectively with fraud, abusive behaviors, bad transactions, and negative customer experiences may increase our loss rate and could severely diminish merchant and consumer confidence in and use of our services and negatively impact our business.
We expect that third parties will continue to attempt to abuse access to and misuse our payments services to commit fraud by, among other things, creating fictitious PayPal accounts using stolen or synthetic identities or personal information, taking over customer accounts or creating fraudulent accounts, making transactions with stolen financial instruments, abusing or misusing our services for financial gain, or fraudulently inducing users of our products and services into engaging in fraudulent transactions.
We expect that third parties will continue to attempt to abuse access to and misuse our payments services to commit fraud by, among other things, creating fictitious accounts using stolen or synthetic identities or personal information, taking over customer accounts or creating fraudulent accounts, making transactions with stolen financial instruments, abusing or misusing our services for financial gain, or fraudulently inducing users of our products and services into engaging in fraudulent transactions.
At any given time, we may be engaged in discussions or negotiations with respect to one or more strategic transactions, any of which could, individually or in the aggregate, be material to our financial condition and results of operations. There can be no assurance that we will be successful in identifying, negotiating, consummating and integrating transaction opportunities.
At any given time, we may be engaged in discussions or negotiations with respect to one or more strategic transactions, any of which could, individually or in the aggregate, be material to our financial condition and results of operations. There can be no assurance that we will be successful in identifying, negotiating, consummating, or integrating suitable transaction opportunities.
While we continue to undertake system upgrades and re-platforming efforts designed to improve the availability, reliability, resiliency, and speed of our payments platform, these efforts are costly and time-consuming, involve significant technical complexity and risk, may divert our resources from new features and products, and may ultimately not be effective.
While we continue to undertake system upgrades and re-platforming efforts designed to improve the availability, reliability, resiliency, and speed of our platform, these efforts are costly and time-consuming, involve significant technical complexity and risk, may divert our resources from new features and products, and may ultimately not be effective.
Our ability to develop, provide or incorporate new technologies and adapt our existing products and services or develop future and new products and services using new technologies may be limited or restricted by industry-wide standards, platform providers, payments networks, changes to laws and regulations, changing customer expectations, third-party intellectual property rights, and other factors.
Our ability to adapt our existing products and services to incorporate new technologies or develop future and new products and services using new technologies may be limited or restricted by industry-wide standards, platform providers, payments networks, changes to laws and regulations, changing customer expectations, third-party intellectual property rights, and other factors.
In addition, because we facilitate sales of goods and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws, which may impose different, more specific, or conflicting obligations on us, as well as broader liability.
In addition, because we facilitate sales of goods and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws and regulations, which may impose different, more specific, and/or conflicting obligations on us, as well as broader liability.
Regulators regularly re-examine the transaction volume thresholds at which we must obtain and keep applicable records or the circumstances in which we must verify identities of customers, and any change to such obligations could result in greater compliance costs and impact our business.
Regulators regularly re-examine the transaction volume thresholds at which we must obtain and keep applicable records or the circumstances in which we must verify identities of customers, and any change to such obligations could result in greater compliance costs and negatively impact our business.
Any increase in interchange fees, special fees, or assessments for transactions that we pay to the networks or our payment processors could make our pricing less competitive, increase our operating costs, and reduce our operating income, which could materially harm our business, financial condition, and results of operations.
Any increase in interchange fees, special fees, or assessments for transactions that we pay to networks or payment processors could make our pricing less competitive, increase our operating costs, and reduce our operating income, which could materially harm our business, financial condition, and results of operations.
Although we provide consumers in certain markets with the opportunity to use their existing PayPal account balance or Venmo account balance to fund payment transactions, some of our consumers may prefer to use payment cards, which may offer features and benefits not provided as part of their PayPal accounts.
Although we provide consumers in certain markets with the opportunity to use their existing PayPal or Venmo account balance to fund payment transactions, some consumers may prefer to use payment cards, which may offer features and benefits not provided as part of their PayPal or Venmo accounts.
Applicable regulation relating to payments, anti-money laundering, and digital services, which are key focus areas of regulators and subject to extensive new regulation, could subject us to additional and complex obligations, risks, and associated costs, and impact our ability to expand our business in Europe.
Applicable regulation relating to payments, anti-money laundering, and digital services, which are key focus areas of European regulators and subject to extensive new regulation, could subject us to additional and complex obligations, risks, and associated costs, and impact our ability to expand our business in Europe.
Financial and third-party risks related to our customer cryptocurrency offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodians, insufficient insurance coverage by a custodian to reimburse us for all such losses, a custodian’s failure to maintain effective controls over the custody and settlement services provided to us, a custodian’s inability to purchase or liquidate cryptocurrency holdings, the failure of the PYUSD Issuer to maintain sufficient reserve assets backing PYUSD and defaults on financial or performance obligations by a custodian, banks with which the PYUSD Issuer maintains reserve assets or counterparty financial institutions, could expose our customers and us to loss, and significantly harm our business, financial condition, and reputation.
Financial and third-party risks related to our customer cryptocurrency offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodians, insufficient insurance coverage by a custodian to fully reimburse us for such losses, a custodian’s failure to maintain effective controls over the custody and settlement services provided to us, a custodian’s inability to purchase or liquidate cryptocurrency holdings, the failure of the PYUSD Issuer to maintain sufficient reserve assets backing PYUSD, and defaults on financial or performance obligations by a custodian, banks with which the PYUSD Issuer maintains reserve assets or counterparty financial institutions, could expose us and our customers to loss and significantly harm our business, financial condition, and reputation.
In certain markets, we may need to rely on local banks or other partners to process payments and conduct foreign currency exchange transactions in local currency, and local regulators may use their authority over such local partners to prohibit, restrict, or limit us from doing business.
In certain markets, we may need to rely on local banks or other partners to process payments and conduct foreign currency exchange transactions in local currency, and local regulators may use their authority, including over such local partners, to prohibit, restrict, or limit us from doing business.
An adverse outcome of these or similar challenges, or changes to applicable laws and regulations or regulatory policy, could materially impact our U.S. PPWC and PPBL products, certain installment products, and our business. We currently purchase receivables related to our U.S.
An adverse outcome of these or similar challenges, or changes to applicable laws and regulations or regulatory policy, could materially impact our U.S. PPWC and PPBL products, certain installment loan products, and our business. We currently purchase receivables related to our U.S.
Moreover, any such acceleration and required repayment of, or default in respect of, our indebtedness could, in turn, constitute an event of default under other debt instruments, thereby resulting in the acceleration and required repayment of our indebtedness. Any of these events could materially adversely affect our liquidity and financial condition.
Any such acceleration and required repayment of, or default in respect of, our indebtedness could, in turn, constitute an event of default under other debt instruments, thereby resulting in the acceleration and required repayment of our indebtedness. Any of these events could materially adversely affect our liquidity and financial condition.
Further, some of our systems, including those of companies that we have acquired, are not fully redundant and any failure of these acquired systems, including due to a catastrophic event, may lead to operational outages or delays.
Some of our systems, including those of companies that we have acquired, are not fully redundant and any failure of these systems, including due to a catastrophic event, may lead to operational outages or delays.
Although we contractually require our custodians to segregate our customer assets and not commingle them with proprietary or other assets, we cannot be certain that these contractual obligations, even if duly observed by a custodian, will be effective in preventing such assets from being treated as part of the custodian’s estate under bankruptcy or other insolvency law.
Although we contractually require our custodians to segregate our customer assets and not commingle them with proprietary or other assets, we cannot assure that these contractual obligations, even if duly observed by a custodian, will be effective in preventing such assets from being treated as part of the custodian’s estate under bankruptcy or other insolvency law.
The network rules may also increase the cost of, impose restrictions on, or otherwise impact the development of, our products which may negatively affect product deployment and adoption.
The network rules may also increase the cost of, impose restrictions on, or otherwise impact the development of, our products which may negatively affect product innovation, deployment, and adoption.
Companies and government agencies have in the past alleged, and may in the future allege, that our actions (or actions of companies with which we have commercial agreements) violate the antitrust or competition laws in the U.S. or other jurisdictions in which we operate or otherwise constitute unfair competition, or that our products and services are used so broadly that otherwise uncontroversial business practices could be deemed anticompetitive.
Companies, consumers, and government agencies have alleged, and may in the future allege, that our actions (or actions of companies with which we have commercial agreements) violate the antitrust or competition laws in the U.S. or other jurisdictions in which we operate or otherwise constitute unfair competition, or that our products and services are used so broadly that otherwise uncontroversial business practices could be deemed anticompetitive.
Any of the foregoing could, individually or in the aggregate, result in substantial additional costs, delay or preclude planned transactions, geographical expansions, or product launches or improvements, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, products and services, or prevent or limit us from providing our products or services in a given market.
Any of the foregoing could, individually or in the aggregate, result in substantial additional costs, delay or preclude planned transactions, geographical expansion, or product launches or improvements, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, products and services, or prevent or limit us from providing our products or services in a given market.
PayPal (Europe) is also subject to regulation by the ECB under the oversight framework for electronic payment instruments, schemes and arrangements (“PISA”). Compliance with applicable laws and regulations could become more costly and operationally difficult to manage due to additional supervision, potentially inconsistent interpretations, and domestic regulations by various countries in the region.
PayPal (Europe) is also subject to regulation by the ECB under the oversight framework for electronic payment instruments, schemes and arrangements (“PISA”). Compliance with applicable laws and regulations could become more costly and operationally difficult to manage due to additional supervision, potentially inconsistent interpretations, and domestic regulations by various countries in the EEA.
We expect that users will continue to attempt to use our payments platform for illegal activities or improper uses, including money laundering, terrorist financing, sanctions evasion, illegal online gambling, fraudulent sales of goods or services, illegal telemarketing activities, illegal sales of prescription medications or controlled substances, piracy of software, movies, music, and other copyrighted, trademarked or digital goods, bank fraud, child pornography, human trafficking, prohibited sales of alcoholic beverages or tobacco products, securities fraud, pyramid or Ponzi schemes, or the facilitation of other illegal or improper activity.
We expect that users will continue to attempt to use our platform for illegal activities or improper uses, including money laundering, terrorist financing, sanctions evasion, illegal gambling or gaming, fraudulent sales of goods or services, illegal telemarketing activities, illegal sales of prescription medications or controlled substances, piracy of software, movies, music, and other copyrighted, trademarked or digital goods, bank fraud, child pornography, human trafficking, prohibited sales of alcoholic beverages or tobacco products, securities fraud, pyramid or Ponzi schemes, or the facilitation of other illegal or improper activity.
We are currently undergoing a number of investigations, audits, and reviews by tax authorities in multiple U.S. and foreign tax jurisdictions.
In addition, we are currently undergoing a number of investigations, audits, and reviews by tax authorities in multiple U.S. and foreign tax jurisdictions.
While we invest in measures intended to prevent and detect illegal activities that may occur on our payments platform, these measures may not be effective in detecting and preventing illegal activity or improper uses, and we may be subject to claims, individual and class action lawsuits, and government and regulatory requests, inquiries, or investigations that could result in liability, restrict our operations, impose additional restrictions or limitations on our business or require us to change our business practices, harm our reputation, increase our costs, and negatively impact our business.
While we invest in measures intended to prevent and detect illegal activities that may occur on our platform, these measures require continuous improvement and may not be effective in detecting and preventing illegal activity or improper uses, and we may be subject to claims, individual and class action lawsuits, and government and regulatory requests, inquiries, or investigations that could result in liability, restrict our operations, impose additional restrictions or limitations on our business or require us to change our business practices, harm our reputation, increase our costs, and negatively impact our business.
Our outstanding indebtedness and any additional indebtedness we incur may have significant consequences, including the need to use a significant portion of our cash flow from operations and other available cash to service our indebtedness, thereby reducing the funds available for other purposes, including capital expenditures, acquisitions, strategic investments, and share repurchases; the reduction of our flexibility in planning for or reacting to changes in our business, competitive pressures and market conditions; and limits on our ability to obtain additional financing for working capital, capital expenditures, acquisitions, strategic investments, share repurchases, or other general corporate purposes.
Our outstanding indebtedness and any additional indebtedness we incur may have significant consequences, including the need to use a significant portion of our cash flow from operations and other available cash to service our indebtedness, thereby reducing the funds available for other purposes, including working capital, capital expenditures, acquisitions, strategic investments, share repurchases, dividend payments, or other general corporate purposes; limits on our ability to obtain additional financing for such purposes; and the reduction of our flexibility in planning for or reacting to changes in our business, competitive pressures and market conditions.
The global payments industry is highly competitive, dynamic, and innovative, and increasingly subject to regulatory scrutiny and oversight. Many of the areas in which we compete evolve rapidly with innovative and disruptive technologies, shifting user preferences and needs, price sensitivity of consumers and merchants, and frequent introductions of new products and services.
The global payments industry is highly competitive, dynamic, and innovative, and subject to regulatory scrutiny and oversight. Many of the areas in which we compete evolve rapidly with innovative and disruptive technologies, shifting preferences, needs, and price sensitivity of consumers and merchants, and frequent introductions of new products and services.
Any violations of the complex foreign and U.S. laws, rules and regulations that may apply to our international operations may result in lawsuits, enforcement actions, criminal actions, or sanctions against us and, our directors, officers, and employees; prohibit or require us to change our business practices; and damage our reputation.
Any violations of the complex foreign and U.S. laws, rules and regulations that may apply to our international operations may result in lawsuits, enforcement actions, criminal actions, or sanctions against us and, our directors, officers, and employees; prohibit or require us to change our products, services and business practices; and damage our reputation.
Competition for key and other highly skilled personnel is intense, especially for executive talent, software engineers, and other technology talent. We may be limited in our ability to recruit or hire internationally, including due to restrictive laws or policies on immigration, travel, or availability of visas for skilled workers.
Competition for key and other highly skilled personnel is intense, particularly for executive talent, software engineers, and other technology talent. We may be limited in our ability to recruit or hire internationally, including due to restrictive laws or policies on immigration, travel, or availability of visas for skilled workers.
Each individual jurisdiction will need to enact minimum tax legislation which may result in various interpretations of the OECD model rules and applicable timelines. Certain countries in which we do business have enacted implementing legislation effective January 1, 2024.
Each individual jurisdiction will need to enact minimum tax legislation which may result in various interpretations of the OECD model rules and applicable timelines. Certain countries in which we do business have enacted implementing legislation effective January 1, 2025.
Privacy and Protection of Customer Data The legal and regulatory environment relating to privacy and data protection laws continues to develop and evolve in ways we cannot predict, including with respect to technologies such as cloud computing, (generative) AI, machine learning, cryptocurrency, and blockchain technology.
Privacy and Protection of Customer Data The legal and regulatory environment relating to privacy and data protection laws continues to develop and evolve in ways we cannot predict, including with respect to technologies such as cloud computing, AI (including generative AI), cryptocurrency, and blockchain technology.
We often partner with other businesses, and the ability to continue developing these partnerships is important to our business. Competition for relationships with these partners is intense, and there can be no assurance that we will be able to continue to establish, grow, or maintain these partner relationships.
We regularly partner with other businesses, and the ability to continue developing these partnerships is important to our business. Competition for relationships with these partners is intense, and there can be no assurance that we will be able to continue to establish, grow, or maintain partner relationships.
We expect that new technologies applicable to the industries in which we operate, including the development, adoption, and use of generative AI technologies, will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services.
We expect that new technologies applicable to the industries in which we operate, including the development, adoption, and use of generative AI technologies and autonomous AI agents, will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services.
There are substantial costs and potential product and operational changes involved in maintaining and renewing licenses, certifications, and approvals, and we could be subject to enforcement actions, fines, penalties, and litigation if we are found to violate any of these requirements.
There are substantial costs and potential product and operational considerations involved in maintaining and renewing licenses, certifications, and approvals, and we could be subject to enforcement actions, fines, penalties, and litigation if we are found to violate any of these requirements.
In August 2023, a third-party issuer with which we have partnered commercially (the “PYUSD Issuer”) launched a U.S. dollar-denominated stablecoin named PayPal USD (“PYUSD”), which is available to PayPal U.S. customers and Venmo customers.
In August 2023, a third-party issuer with which we have partnered commercially (the “PYUSD Issuer”) launched a U.S. dollar-denominated stablecoin named PayPal USD (“PYUSD”), which is available to PayPal customers and Venmo customers in certain markets.
We have selected custodian partners and the PYUSD Issuer, and may in the future select additional custodian partners and stablecoin issuing entities, that are subject to regulatory oversight, capital requirements, maintenance of audit and compliance industry certifications, and cybersecurity procedures and policies.
We have selected custodian partners and the PYUSD Issuer, and may in the future select additional custodian partners and stablecoin issuing entities subject to regulatory oversight, capital requirements, maintenance of audit and compliance industry certifications, and cybersecurity procedures and policies.
Any factors that increase the costs of cross-border trade for us or our customers or that restrict, delay, or make cross-border trade more difficult or impractical could reduce our cross-border transactions and volume, negatively impact our revenues and profits, and harm our business.
Any factors that increase the costs or uncertainty of cross-border trade for us or our customers or that restrict, delay, or make cross-border trade more expensive, difficult or impractical could reduce our cross-border transactions and volume, negatively impact our revenues and profits, and harm our business.
Any failure or alleged failure by us to comply with our privacy policies as communicated to customers or with privacy and data protection laws relating to our collection, use, storage, transfer, or sharing of customer data with third parties could result in proceedings or actions against us by data protection authorities, other government agencies, our customers or others, which could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, result in reputational harm, and materially harm our business.
Any failure or alleged failure by us to comply with our privacy policies as communicated to customers or with applicable privacy and data protection laws relating to our collection, use, storage, transfer, or sharing of customer data with third parties could result in proceedings or actions against us by data protection authorities, other government agencies, our customers or others, which could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, damage our reputation, and materially harm our business.
In the ordinary course of business we may identify and voluntarily report, and have reported, potential compliance issues to regulatory authorities, including the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”), and our compliance history may be considered by OFAC and other regulators as part of any potential future investigation of our sanctions regulation.
In the ordinary course of business we may identify and voluntarily report, and have reported, potential compliance issues to regulatory authorities, including the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”), and our compliance history may be considered by OFAC and other regulators as part of any potential future investigation regarding our compliance with sanctions.
We expect to continue to license in the future certain of our proprietary rights, such as trademarks or copyrighted material, to others. These licensees may take actions that diminish the value of our proprietary rights or harm our reputation.
We expect to continue to license certain of our proprietary rights, such as trademarks or copyrighted material, to others. These licensees may take actions that diminish the value of our proprietary rights or harm our reputation.
The non-payment rate among account holders may increase due to, among other factors, changes to underwriting standards, risk models not accurately predicting the creditworthiness of a user, worsening economic conditions, such as a recession or government austerity programs, increases in prevailing interest rates, and high unemployment rates.
The non-payment rate among account holders may increase due to, among other factors, changes to underwriting standards, risk models not accurately predicting the creditworthiness of a user, worsening economic conditions, such as recessions, economic downturns or government austerity programs, increases in prevailing interest rates, and high unemployment rates.
In June 2020, the Federal 22 Table of Contents Deposit Insurance Corporation (“FDIC”) approved a final rule clarifying that loans validly originated by state-chartered banks or insured branches of foreign banks remain valid throughout the lifetime of the loan, reflecting a similar rule finalized by the Office of the Comptroller of Currency (“OCC”) in May 2020 for nationally chartered banks.
In June 2020, the Federal Deposit Insurance Corporation (“FDIC”) approved a final rule clarifying that loans validly originated by state-chartered banks or insured branches of foreign banks remain valid throughout the lifetime of the loan, reflecting a similar rule finalized by the Office of the Comptroller of Currency (“OCC”) in May 2020 for nationally chartered banks.
We principally provide our services to customers in the European Economic Area (“EEA”) through PayPal (Europe) S.à.r.l. et Cie, S.C.A. (“PayPal (Europe)”), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg and PayPal U.K.
We principally provide our services to customers in the European Economic Area (“EEA”) through PayPal (Europe) S.à.r.l. et Cie, S.C.A. (“PayPal (Europe)”), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg, and to our customers in the United Kingdom (“U.K.”) through PayPal U.K.
Moreover, certain activity that may be legal in one jurisdiction may be illegal in another jurisdiction, and a merchant may be found responsible for intentionally or inadvertently importing or exporting illegal goods, resulting in liability for us.
Moreover, certain activity that may be legal in one jurisdiction may be illegal in another jurisdiction, and a customer may be found responsible for intentionally or inadvertently importing or exporting illegal goods, resulting in liability for us.
A catastrophic event that could lead to a disruption or failure of our systems or operations could result in significant losses and require substantial recovery time and significant expenditures to resume or maintain operations.
A catastrophic event that results in a disruption to or failure of our systems or operations could result in significant losses and require substantial recovery time and significant expenditures to resume or maintain operations.
Nevertheless, any operational disruptions at any such custodian or issuer, or such custodians’ or issuer’s failure to safeguard cryptocurrency holdings (or reserve assets), could result in losses of customer assets, expose us to customer claims, reduce consumer confidence and materially impact our cryptocurrency product offerings and our operating results.
Any operational disruptions at any such custodian or issuer, or such custodians’ or issuer’s failure to safeguard cryptocurrency holdings (or reserve assets), could result in losses of customer assets, expose us to customer claims, reduce consumer confidence, harm our reputation, and materially impact our cryptocurrency product offerings and our operating results.
We expect to continue to consider and evaluate a wide array of potential strategic transactions as part of our overall business 24 Table of Contents strategy, including business combinations, acquisitions, and dispositions of certain businesses, technologies, services, products, and other assets; strategic investments; and commercial and strategic partnerships (collectively, “strategic transactions”).
We expect to continue to consider and evaluate a wide array of potential strategic transactions as part of our overall business strategy, including business combinations, acquisitions, and dispositions of certain businesses, technologies, services, products, and other assets; strategic investments; and commercial and strategic partnerships (collectively, “strategic transactions”).
Our business is subject to complex and changing laws, rules, regulations, policies, and legal interpretations in the markets in which we offer services directly or through partners, including, but not limited to, those governing: banking, credit, deposit taking, cross-border and domestic money transmission, prepaid access, foreign currency exchange, privacy, data protection, data governance, cybersecurity, banking secrecy, digital payments, cryptocurrency, payment services (including payment processing and settlement services), lending, fraud detection, consumer protection, antitrust and competition, economic and trade sanctions, anti-money laundering, and counter-terrorist financing.
Our business is subject to complex and changing laws, rules, regulations, policies, licensing schemes, and legal interpretations in the markets where (and relating to the industries and merchants to which) we offer services directly or through partners, including, but not limited to, those governing: banking, credit, deposit taking, cross-border and domestic money transmission, prepaid access, foreign currency exchange, privacy, data protection, data governance, cybersecurity, banking secrecy, digital payments, cryptocurrency, payment services (including payment processing and settlement services), lending, fraud detection, consumer protection, antitrust and competition, economic and trade sanctions, anti-money laundering, and counter-terrorist financing.
Consumer Protection 18 Table of Contents Violations of consumer protection law in applicable jurisdictions, including both federal and state laws and regulations in the U.S., such as the Electronic Fund Transfer Act (“EFTA”) and Regulation E as implemented by the Consumer Financial Protection Bureau (“CFPB”), could result in the assessment of significant actual damages or statutory damages or penalties (including treble damages in some instances) and plaintiffs’ attorneys’ fees.
Consumer Protection Violations of consumer protection law in applicable jurisdictions, including federal and state laws and regulations in the U.S. such as the Electronic Fund Transfer Act (“EFTA”) and Regulation E as implemented by the Consumer Financial Protection Bureau (“CFPB”), could result in the assessment of significant actual damages or statutory damages or penalties (including treble damages in some instances) and plaintiffs’ attorneys’ fees.
We rely on third parties in many aspects of our business, including, but not limited to, networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions; unaffiliated third-party lenders to originate our U.S. credit products to consumers, U.S. merchant financing, and branded credit card products; branded debit card and savings products issued by unaffiliated banks; cryptocurrency custodial service providers; and external business partners and contractors who provide key functions (including, but not limited to, data center facilities and cloud computing, information technology, and outsourced customer support and product development functions).
We rely on third parties in many aspects of our business, including, but not limited to, networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions; unaffiliated third-party lenders to originate U.S. credit products to consumers, U.S. merchant financing, and branded credit card products; branded debit card and savings products issued by unaffiliated banks; cryptocurrency custodial service providers; and external business partners and contractors who provide key functions (including, but not limited to, data center facilities and cloud computing, IT, and outsourced customer support, accounting, human resources, and product development functions).
Further, as our business develops, we may revise or cease reporting metrics if we determine that such metrics are no longer appropriate measures of our performance.
Further, as our business evolves, we may revise or cease reporting metrics if we determine that such metrics are no longer appropriate measures of our performance.
The techniques used to attempt to obtain unauthorized or illegal access to systems and information (including customers’ personal data), disable or degrade service, exploit vulnerabilities, or sabotage systems are continuously evolving. In some circumstances, these attempts may not be recognized or detected until after they have been launched against a target.
Techniques used to attempt to obtain unauthorized or illegal access to systems and information (including customers’ personal data), disable or degrade service, exploit vulnerabilities, or sabotage systems are continuously evolving. These attempts may not be recognized or detected until after they have been launched against a target.
Any cybersecurity incidents, including cyberattacks or data security breaches affecting the information technology or infrastructure of our customers, partners, or vendors (including data center and cloud computing providers) or of companies we acquire, could have similar negative effects.
Any cybersecurity incidents, including cyberattacks or data security breaches affecting the IT or infrastructure of our customers, partners, or vendors (including data center and cloud computing providers) or of companies we acquire, could have similar negative effects.
While we have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, there can be no assurance that our employees, contractors, and agents will not violate such laws and regulations. Payments Regulation 16 Table of Contents In the U.S., PayPal, Inc.
While we have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, there can be no assurance that our employees, contractors, and agents will not violate such laws and regulations. Payments Regulation In the U.S., PayPal, Inc.
The networks could adopt new operating rules or interpret or re-interpret existing rules that 21 Table of Contents we or our payment processors might find difficult or impractical to follow, or costly to implement, which could require us to make significant changes to our products, increase our operational costs, and negatively impact our business.
The networks could adopt new operating rules or interpret or re-interpret existing rules that we or our payment processors might find difficult or impractical to follow, or costly to implement, which could require us to make significant changes to our products, increase our operational costs, and negatively impact our business.
We are subject to the risk that account holders who use our credit products will default on their payment obligations.
We are subject to the risk that account holders who use our credit products may default on their payment obligations.
If we or the PYUSD Issuer fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, we could face regulatory or other enforcement actions, potential fines, penalties, and other consequences.
If we or the PYUSD Issuer fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, or make operational errors, we could face regulatory or other enforcement actions, potential fines, penalties, and other consequences.
Strategic transactions may involve additional significant challenges, uncertainties, and risks, including challenges of obtaining regulatory or other approvals, integrating new employees, products, systems, technologies, operations, and business cultures; challenges associated with operating acquired businesses in markets or business areas in which we may have limited or no experience; disruption of our ongoing operations and diversion of our management’s attention; inadequate data security, cybersecurity, or operational and information technology resilience; failure to identify, or our underestimation of, commitments, liabilities, deficiencies and other risks associated with acquired businesses or assets; potential exposure to new or incremental risks associated with acquired businesses and entities, strategic investments or other strategic transactions, including potential new or increased regulatory oversight and uncertain or evolving legal, regulatory, and compliance requirements, particularly with respect to companies in new or developing businesses or industries; challenges associated with dispositions of business or operations, including disruption to other parts of our business, potential loss of employees or customers, the transfer of technology and/or certain intellectual property rights to third-party purchasers, or exposure to unanticipated liabilities or ongoing obligations to us following any such dispositions; failure of the transaction to advance our business strategy or for its anticipated benefits to materialize; potential impairment of goodwill or other acquisition-related intangible assets; and the potential for our acquisitions to result in dilutive issuances of our equity securities or the incurrence of significant additional debt.
Strategic transactions may involve additional significant challenges, uncertainties, and risks, including challenges of obtaining regulatory or other approvals, integrating new employees, products, systems, technologies, operations, and business cultures; challenges associated with operating acquired businesses in markets or business areas in which we may have limited or no FY 2025 FORM 10-K 24 Table of Contents experience; disruption of our ongoing operations and diversion of our management’s attention; inadequate data security, cybersecurity, or operational and IT resilience; failure to identify or accurately assess commitments, liabilities, deficiencies and other risks associated with acquired businesses or assets; potential exposure to new or incremental risks associated with acquired businesses and entities, strategic investments or other strategic transactions, including potential new or increased regulatory oversight and uncertain or evolving legal, regulatory, and compliance requirements, particularly with respect to companies in new or developing businesses or industries; challenges associated with dispositions of business or operations, including disruption to other parts of our business, potential loss of employees or customers, the transfer of technology and/or certain intellectual property rights to third-party purchasers, or exposure to unanticipated liabilities or ongoing obligations to us following any such dispositions; failure of the transaction to advance our business strategy or for its anticipated benefits to materialize; potential impairment of goodwill or other acquisition-related intangible assets; and the potential for our acquisitions to result in dilutive issuances of our equity securities or the incurrence of significant additional debt.
For example, numerous U.S. states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and retention of their residents’ personal information as well as specific privacy obligations around youth.
For example, numerous U.S. states have enacted or are in the process of enacting state-level data privacy laws and regulations governing the collection, use, and retention of their residents’ personal information as well as specific privacy obligations with respect to youth.
Our purchase protection program also protects consumers who do not receive the item ordered or who receive an item that is significantly different from its description. We incur substantial losses from our protection programs as a result of disputes filed by our customers.
Our purchase protection program also protects eligible transactions where consumers do not receive the item ordered or receive an item that is significantly different from its description. We incur substantial losses from our protection programs as a result of disputes filed by our customers.
Damage to our reputation or our brands may result from, among other things, new features, products, services, operational efforts, or terms of service (or changes to the same), or our decisions regarding user privacy, data practices, or information security. The proliferation of social media may increase and compound the likelihood, speed, magnitude, and unpredictability of negative brand events.
Damage to our reputation or our brands may result from, among other things, change to or new features, products, services, operational efforts, or terms of service, or our decisions regarding user privacy, data practices, or information security. The pervasiveness of social media may increase and compound the likelihood, speed, magnitude, and unpredictability of negative brand events.
Numerous and evolving cybersecurity and related threats, including advanced and persisting cyberattacks, cyberextortion, distributed denial-of-service attacks, ransomware, spear phishing and social engineering schemes, the introduction of computer viruses or other malware, and the physical destruction of all or portions of our information technology and infrastructure and those of third parties with whom we partner or that are part of our information technology supply chain, are becoming increasingly sophisticated and complex, may be difficult to detect, and could compromise the confidentiality, availability, and integrity of the data in our systems, as well as the systems themselves.
Numerous and evolving cybersecurity and related threats, including advanced and persisting cyberattacks, artificial intelligence (“AI”)-enabled threats, cyberextortion, distributed denial-of-service attacks, ransomware, spear phishing and social engineering schemes, the introduction of computer viruses or other malware, and the destruction of all or portions of our IT and infrastructure and those of third parties with whom we partner or that are part of our IT supply chain, are becoming increasingly sophisticated and complex, may be difficult to detect, and could compromise the confidentiality, availability, and integrity of the data in our systems, as well as the systems themselves.
If we are unable to effectively manage our third-party relationships, these third parties are unable to meet their obligations to us, we are overly reliant on certain relationships, or we experience substantial disruptions in these relationships (including interruptions to the availability of our products and services), our operations, results of operations, and financial results could be adversely impacted.
If we are unable to effectively manage our third-party relationships, these third parties are unable to meet their obligations to us, we are overly reliant on certain relationships, we are unable to negotiate favorable contractual terms, or we experience substantial disruptions in these relationships (including interruptions to the availability of our products and services), our operations, liquidity, results of operations, and financial results could be adversely impacted.
Additionally, our relationships with third parties inherently involve a lesser degree of control over business operations, governance, and compliance, which potentially increases our financial, legal, reputational, and operational risk. Any factors that reduce cross-border trade or make such trade more difficult could harm our business.
Additionally, our relationships with third parties inherently involve a lesser degree of control over business operations, governance, and compliance (including anti-money laundering and sanctions compliance), which potentially increases our financial, legal, reputational, and operational risk. Any factors that reduce cross-border trade or make such trade more difficult could harm our business.
Investigations and legal proceedings are inherently uncertain, expensive and disruptive to our operations, and could result in substantial judgments, fines, penalties or settlements, substantial diversion of management’s time and effort, negative publicity, reputational harm, criminal sanctions, or orders that prevent or limit us from offering certain products or services; require us to change our business practices or customer agreement terms in ways that may increase costs or reduce revenues, develop non-infringing or otherwise altered products or technologies, or pay substantial royalty or licensing fees; or delay or preclude planned transactions or product launches or improvements.
Investigations, changes in, or expanded enforcement of federal, state or local laws and regulations, and legal and regulatory proceedings are inherently uncertain, expensive and disruptive to our operations, and could result in substantial judgments, fines, penalties or settlements, substantial diversion of management’s time and effort, negative publicity, reputational harm, criminal sanctions, or orders that prevent or limit us from offering certain products or services; require us to change our business practices or customer agreement terms in ways that may increase costs or reduce revenues, develop non-infringing or otherwise altered products or technologies, or pay substantial royalty or licensing fees; or delay or preclude planned transactions or product launches or improvements.
Any of the foregoing events may subject us to fines, penalties, regulatory or other enforcement actions, and our business, reputation or financial condition may be adversely affected.
Any of the foregoing events may subject us to fines, penalties, regulatory or other enforcement actions, and adversely affect our business, reputation, or financial condition.
If one of our counterparty financial institutions were to become insolvent, placed into receivership, or file for bankruptcy, our ability to recover losses incurred as a result of default or to access or recover our assets that are deposited, held in accounts with, or otherwise due from, such counterparty may be limited due to the insufficiency of the failed institutions’ estate to satisfy all claims in full or the applicable laws or regulations governing the insolvency, bankruptcy, or resolution proceedings.
If one of our counterparty financial institutions were to become insolvent, placed into receivership, or file for bankruptcy, our FY 2025 FORM 10-K 26 Table of Contents ability to recover losses incurred as a result of default or to access or recover our assets that are deposited, held in accounts with, or otherwise due from, such counterparty may be limited due to the insufficiency of the failed institutions’ estate to satisfy all claims in full or the applicable laws or regulations governing the insolvency, bankruptcy, or resolution proceedings.
Due to the nature of PayPal’s digital payments services, third parties may seek to engage in abusive schemes or fraud attacks that are often difficult to detect and may be deployed at a scale that would otherwise not be possible in physical 23 Table of Contents transactions.
Due to the nature of our digital payments services, third parties may seek to engage in abusive schemes or fraud attacks that are often difficult to detect and may be deployed at a scale that would otherwise not be possible in physical transactions.
We are subject to, and have paid amounts in settlement of, lawsuits containing allegations that our business violated the EFTA and Regulation E or otherwise advance claims for relief relating to our business practices (e.g., that we improperly held consumer funds or otherwise improperly limited consumer accounts).
We are subject to, and have paid amounts in settlement of, lawsuits alleging that our business violated the EFTA and Regulation E or otherwise advancing claims for relief relating to our business practices (e.g., that we improperly held consumer funds or otherwise improperly limited consumer accounts).
Numerous and evolving fraud schemes and misuse of our payments services could subject us to significant costs and liabilities, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, damage our reputation and brands, divert the attention of management from the operation of our business, and result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses or claims.
Numerous and evolving fraud schemes and misuse of our FY 2025 FORM 10-K 23 Table of Contents payments services could subject us to significant costs and liabilities, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, damage our reputation and brands, divert the attention of management from the operation of our business, and result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses or claims.
This information may, in turn, be used to access our customers’ confidential personal or proprietary information and financial instrument data that are stored on or accessible through our information technology systems and those of third parties with whom we partner. This information may also be used to execute fraudulent transactions or otherwise engage in fraudulent actions.
This information may, in turn, be used to access our customers’ confidential personal or proprietary information and financial instrument data that are stored on or accessible through our information technology (“IT”) systems and those of third parties with whom we partner. This information may also be used to execute fraudulent transactions or other activity.
In addition, we could face reputational harm through our relationship with the PYUSD Issuer if the PYUSD Issuer were to face regulatory scrutiny, PYUSD is deemed to be a security, or PYUSD is alleged to be used for transactions in connection with illicit or illegal activities. We hold our customers’ cryptocurrency assets through one or more third-party custodians.
In addition, we could face reputational harm through our relationship with the PYUSD Issuer if the PYUSD Issuer were to face regulatory scrutiny or make operational errors or if PYUSD is alleged to be used for transactions in connection with illicit or illegal activities. We hold our customers’ cryptocurrency assets through one or more third-party custodians.