Washington, D.C. 20549
PayPal Holdings, Inc.
| |
• | Brands—we have built well-recognized and trusted brands. Our marketing efforts across multiple demographic groups play an important role in building brand visibility, usage, and overall preference among customers.
|
| |
• | Risk Management—our risk management system and use of tokenization are designed to help keep customer information secure, and to help ensure we process legitimate transactions around the world, while identifying and minimizing illegal, high-risk, or fraudulent transactions.
|
| |
• | Regulatory—we believe that our regulatory licenses, which enable us to operate in markets around the world, are a distinct advantage and help support business growth.
|
TECHNOLOGY
Technology
Our Payments Platformpayments platform utilizes a combination of proprietary and third-party technologies and services intended to facilitate transactions efficiently and securely facilitate transactions between millions of merchants and consumers worldwide across different channels, markets, and networks. Our Payments Platformpayments platform connects with financial service providers around the world and allows consumers to make purchases using a wide range of payment methods, regardless of where a merchant is located. Consumers who use our Payments Platformpayments platform can send payments in more than 200 markets around the world and in more than 100nearly 150 currencies, withdraw funds to their bank accounts in 56 currencies, and hold balances in their PayPal accounts in 25 currencies.
A transaction on our Payments Platform can involve multiple participants in addition to us, including a merchant, a consumer, and the consumer’s funding source provider. We have developed intuitive user interfaces, customer tools, transaction completion database,management databases, and payment network applicationsintegrations on our Payments Platform that helpplatform designed to enable our customers to utilize our suite of products and services. Our Payments Platform,payments platform, open application programming interfaces, and developer tools are designed to enable developers to innovate with ease and offer robust applicationssolutions to our global ecosystem of merchants and consumers, while at the same time maintaininghelping to maintain the security of our customers’ financial information.
The technology infrastructure supporting our Payments Platform simplifiespayments platform is designed to simplify the storage and processing of large amounts of data and facilitatesfacilitate the deployment and operation of large-scale global products and services in both our own data centers and when hosted by third-party cloud computing.service providers. Our technology infrastructure is designed around industry best practices intended to reduce downtime and help ensure the resiliency of our payments platform in the event of outages or catastrophic occurrences. Our Payments Platformpayments platform incorporates multiple layers of protection for business continuity and system redundancy purposes and to help addressmitigate cybersecurity risks. We have a comprehensive cybersecurity program designed to protect our technology infrastructure and Payments Platformpayments platform against these challenges, includingcybersecurity threats, which includes regularly testing our systems to identify and address potential vulnerabilities. We strive to continually improve our technology infrastructure and Payments Platformpayments platform to enhance the customer experience and to increase efficiency, scalability, and security.
Merchant and Consumer Payment Solutions
Merchant Value Proposition
We partner with our merchants to help grow and expand their businesses by providing global reach and powering all aspects of digital checkout. We offer alternative payment methods, including access to credit solutions, provide fraud prevention and risk management solutions, reducing losses through proprietary protection programs, and offer tools and insights for leveraging data analytics to attract new customers and improve sales conversion. We employ a technology and platform agnostic approach intended to enable merchants of all sizes to provide digital checkout online, on mobile, and in-store (at the point of sale) across all platforms and devices and to securely and simply receive payments from their customers. Merchants can onboard quickly with PayPal and are generally not required to invest in new or specialized hardware. PayPal is also a popular form of payment solution for mobile commerce, and our business has grown with the increased adoption of mobile devices. We believe our Braintree products strengthen our position in digital and mobile payments and extend our coverage to a new class of retailers and service providers that offer their services primarily through mobile applications. Through a single Braintree integration, a merchant can begin accepting payments with credit or debit cards, PayPal, PayPal Credit, Google Pay, Apple Pay, Samsung Pay, and other payment solutions. iZettle offers a card acceptance service that enables small businesses to accept credit and debit card payments, as well as a software solution to record, manage, and analyze sales. iZettle provides in-store capabilities in twelve countries. During 2019, we launched PayPal for Marketplaces, our global, end-to-end solution designed to satisfy the unique payment needs of platforms, marketplaces, and crowdfunding sites, which provides payment solutions for accepting and disbursing funds between consumers and businesses. We also offer gateway services which provide the payment gateway technology that links a merchant’s website to its processing network and enable merchants to accept payments online with credit or debit cards. Our acquisition of a controlling equity interest in Guofubao Information Technology Co. (GoPay), Ltd (“GoPay”), a holder of payment business licenses in China, enables us to partner with Chinese financial institutions and technology platforms to provide a more comprehensive set of payment solutions to merchants and consumers, both in China and globally.
We offer access to credit products for certain small and medium-sized merchants through our PayPal Working Capital and PayPal Business Loan products, which we collectively refer to as our business financing offerings. Our PayPal Working Capital product allows businesses to borrow a certain percentage of their annual payment volume processed by PayPal for a fixed fee. Our PayPal Business Loan product provides businesses with short-term financing for a fixed fee based on an evaluation of both the applying business as well as the business owner. We believe that our business financing offerings allow us to deepen our engagement with our existing small and medium-sized merchants and expand services to new merchants by providing access to capital that may not be available effectively or efficiently from traditional banks or other lending providers.
We generate revenues from merchants primarily by charging fees for completing their payment transactions and other payment-related services.
Consumer Value Proposition
We focus on providing affordable consumer products intended to democratize the management and movement of money. We provide consumers with a digital wallet which enables them to send payments to merchants more safely using a variety of funding sources, which may include a bank account, a PayPal account balance, a Venmo account balance, a PayPal Credit account, a credit or debit card, or other stored value products such as coupons, gift cards, and eligible credit card rewards.
We also offer consumers person-to-person (“P2P”) payment solutions through our PayPal, Venmo, and Xoom products. PayPal continues to be a key driver of our total P2P volumes, enabling both domestic and international P2P transfers across our Payments Platform. Our Venmo app in the U.S. is a leading mobile application used to move money between our customers and to make purchases at approved merchants. Xoom is an international money transfer service that enables our customers to send money and prepaid mobile phone reloads to, and pay bills for, people around the world in a secure, fast, and cost-effective way. P2P is a significant customer acquisition channel that facilitates organic growth by enabling potential PayPal users to establish active accounts with us at the time they make or receive a P2P payment.
We offer our PayPal Credit product to consumers in certain markets as a potential funding source at checkout. Once a consumer is approved for credit, PayPal Credit is made available as a funding source for that account holder. Our U.S. PayPal branded consumer credit program is offered exclusively through Synchrony Bank. We believe that our consumer credit products allow us to increase engagement with consumers and merchants on our two-sided network and differentiate us from other payment processors by helping merchants drive incremental sales.
We generate revenue from consumers on fees charged for foreign currency exchange, optional instant transfers from their PayPal or Venmo account to their debit card or bank account, and on interest and fees from our PayPal Credit product.
Protecting Merchants and Consumers
Protecting merchants and consumers on our Payments Platform from financial and fraud loss is imperative to successfully competing in the payments industry and sustainably growing our business. Fraudulent activities, such as account takeover, identity theft (including stolen financial information), and counterparty malicious activities, represent a significant risk to merchants and consumers, as well as their payment partners. We provide merchants and consumers with protection programs on most purchase transactions completed on our Payments Platform, excluding gateway-exclusive transactions or situations where our customer agreements specifically do not provide for protections. We believe that these programs, which protect both merchants and consumers from financial loss resulting from fraud and counterparty non-performance, are generally much broader than similar protections provided by other participants in the payments industry. As a result, merchants may incur losses for chargebacks and other claims on certain transactions when using other payments providers that the merchants would not incur if they used our payments services. We also provide consumer protection against losses on qualifying purchases and accept claims for review up to 180 days post-transaction. We believe that this protection is generally consistent with, or better than, that offered by other payments providers. These programs are designed to promote confidence on both the part of consumers, who will only be required to pay if they receive their purchased item or service in the condition significantly as described, and merchants, who will receive payment for the product or service they deliver to the customer.
Our ability to protect both merchants and consumers is based largely on our proprietary, end-to-end Payments Platform and our ability to leverage the data from both sides of transactions on our two-sided network specifically from buyers and sellers and from senders and receivers of payments. We believe mobile devices will continue to play a significant and increasing role in commerce, including by creating the opportunities to make our ecosystem safer. For example, PayPal uses data from mobile devices and growing protection for the mobile operating environment to reduce financial and fraud risk to merchants and consumers. Our ongoing investment in systems and processes designed to enhance the safety and security of our products reflects our goal of having PayPal recognized as one of the world’s most trusted payments brands.
Competition
The global payments industry is highly competitive, rapidly changing, highly innovative, and increasingly subject to regulatory scrutiny and oversight. We compete against a wide range of businesses, including those that are larger than we are, have greater name recognition, longer operating histories, or a dominant or more secure position, or offer other products and services to consumers and merchants that we do not offer, as well as smaller or younger companies that may be more agile in responding quickly to regulatory and technological changes. Many of the areas in which we compete evolve rapidly with changing and disruptive technologies, shifting user needs, and frequent introductions of new products and services. Competition also may intensify as businesses enter into business combinations and partnerships, and established companies in other segments expand to become competitive with different aspects of our business.
We compete primarily on the basis of the following:
ability to attract, retain, and engage both merchants and consumers on our Payments Platform;
ability to demonstrate to merchants that they may achieve incremental sales by using and offering our services to consumers;
consumer confidence in the safety and security of transactions on our Payments Platform, including the ability for consumers to use our products and services without sharing their financial information with the merchant or any other party they are paying;
simplicity and transparency of our fee structure;
ability to develop products and services across multiple commerce channels, including e-commerce, mobile, and payments at the point of sale;
trust in our dispute resolution and buyer and seller protection programs;
customer service experience;
brand recognition and preference;
website, mobile platform, and application onboarding, ease-of-use, speed, availability, and dependability;
ability of our Payments Platform to support across technologies and payment methods;
system reliability and data security;
ability to assist merchants in complying with payments-related laws and regulations;
ease and quality of integration into third-party mobile applications and operating systems; and
quality of developer tools, such as our application programming interfaces and software development kits.
In additionFor additional information regarding risks relating to our technology infrastructure and cybersecurity, see the discussioninformation in this section, see “Item 1A. Risk Factors” under the captioncaptions “We face substantialCyberattacks and increasingly intense competition worldwidesecurity vulnerabilities could result in serious harm to our reputation, business, and financial condition” and “Business interruptions or systems failures may impair the global payments industry”availability of our websites, applications, products or services, or otherwise harm our business for further discussion of the potential impact of competition on our business..”
Research and DevelopmentRESEARCH AND DEVELOPMENT
TotalOur total research and development expense was $1.1$1.7 billion, $1.1$1.6 billion, and $953 million$1.4 billion in 2019, 20182022, 2021, and 2017,2020, respectively.
Intellectual PropertyINTELLECTUAL PROPERTY
The protection of our intellectual property, including our trademarks, patents, copyrights, domain names, trade dress, patents, and trade secrets, is important to the success of our business. We seek to protect our intellectual property rights by relying on applicable laws, regulations, and regulationsadministrative procedures in the U.S. and internationally, as well as a variety of administrative procedures.internationally. We have registered our core brands as domain names and as trademarks in the U.S. and a large number of othermany international jurisdictions. We also have in place an active program to continue to secure and enforce trademarks and domain names that correspondscorrespond to our brands in markets of interest. We have filed and continue to file patent applications in the U.S. and in international jurisdictions covering certain aspects of our proprietary technology and new innovations. We also rely on contractual restrictions to protect our proprietary rights when offering or procuring products and services. We have routinely enteredenter into confidentiality and invention assignment agreements with our employees and contractors, and non-disclosure agreements with parties with whom we conduct business to control access to, and use and disclosure of, our proprietary information.
For additional information regarding some of the risks relating to our intellectual property, including costs of protecting our intellectual property, see the information in “Item 1A. Risk Factors” under the captions “WeThird parties may allege that we are subject to patent litigationinfringing their patents and other intellectual property rights” and “We may be unable to adequately protect or enforce our intellectual property rights, or third parties may allege that we are infringing their intellectual property rights.”
GOVERNMENT REGULATION
We operate globally and in a rapidly evolving regulatory environment characterized by a heightened regulatory focus by regulators globally on all aspects of the payments industry. That focus continues to become even more heightened as regulators on a global basis focus on such important issues asindustry, including countering terrorist financing, anti-money laundering, privacy, cybersecurity, and consumer protection. Some of the laws and regulations to which we are subject were enacted recently, and theThe laws and regulations applicable to us, including those enacted prior to the advent of digital and mobile payments, are continuingcontinue to evolve through legislative and regulatory action and judicial interpretation. New or changing laws and regulations, including how such lawschanges to their interpretation and regulations are interpreted and implemented,implementation, as well as increased penalties and enforcement actions related to non-compliance, could have a material adverse impact on our business, results of operations, and financial condition. Therefore, weWe monitor these areas closely to designand are focused on designing compliant solutions for our customers who depend on us.customers.
Government regulation impacts key aspects of our business. We are subject to the laws and regulations that affectapplicable to the payments industry in the markets we operate.operate, which are subject to interpretation and change.
Payments Regulation.regulation. Various laws and regulations govern the payments industry in the U.S. and internationally. In the U.S., PayPal, Inc. (a wholly-owned subsidiary) holds licenses to operate as a money transmitter (or its equivalent), which, in the states where such licenses are required, as well as in the District of Columbia and certain territories. These licenses include not only the PayPal-branded products and services offered in these locations, but also our Venmo, Hyperwallet, and Xoom products and services to the extent offered in these locations. As a licensed money transmitter, PayPal is subject to, among other things, subjects PayPal, Inc.requirements, restrictions with respect to reporting requirements, bonding requirements, limitations on the investment of customer funds, reporting requirements, bonding requirements, and inspection by state regulatory agencies. In certain cases, these licenses also generally cover PayPal’s service enabling customers to buy, hold, transfer, and sell cryptocurrency directly from their PayPal or Venmo account. In the State of New York, PayPal holds a full Bitlicense issued by the New York Department of Financial Services to offer cryptocurrency services in the state.
Outside the U.S., we provide similar services customized for various countries and foreign jurisdictions through our foreign subsidiaries. The activities of those non-U.S. entities are, or may be, supervised by a financial regulatory authority in the jurisdictions in which they operate. Among other regulatory authorities, the Luxembourg Commission de Surveillance du Secteur Financier (the “CSSF”), the U.K. Financial Conduct Authority (“FCA”), the Australian Prudential Regulation Authority, the People’s Bank of China, the Monetary Authority of Singapore, the Reserve Bank of India, the Central Bank of Russia, and the Central Bank of Brazil and the People's Bank of China have asserted jurisdiction over some or all of our activities in their respective jurisdictions. This list is not exhaustive, and there are numerous other regulatory agencies thatwhich have asserted or may assert jurisdiction over our activities. The laws
In addition, financial services regulators in various jurisdictions, including the U.S. and regulations applicablethe European Union (“EU”), have implemented authentication requirements for banks and payment processors intended to reduce online fraud, which could impose significant costs, make it more difficult for new customers to open PayPal accounts, and reduce the payments industry in any given jurisdiction are subject to interpretation and change.ease of use of our products.
Banking Agency Supervisionagency supervision.We serve our customers in the European Union (“EU”)EU and U.K. through PayPal (Europe) S.à.r.l. et Cie, SCA,S.C.A. (“PayPal (Europe)”), a wholly-owned subsidiary that is licensed and subject to regulation as a bankcredit institution in Luxembourg by the CSSF. Under the U.K.’s Temporary Permissions Regime, PayPal is deemed to be authorized and regulated by the U.K. FCA as a result of Brexit. Consequently, we must comply with rules and regulations of the European banking industry, including those related to capitalization, funds management, corporate governance, anti-money laundering, disclosure, reporting, and inspection. We are, or may be, subject to banking-related regulations in other countries now or in the future related to our role in the financial industry. In addition, based on our relationships with our partner financial institutions, we are, or may be, subject to indirect regulation and examination by the regulators of these partner financial institutions’ regulators.institutions.
Lending regulation. Our U.S. consumer short-term, interest-free, installment product is subject to federal and state laws governing consumer credit and debt collection. PayPal holds multiple state licenses as the lender of this product. Paidy, Inc. holds multiple licenses for the issuance of its consumer installment products in Japan and is registered with the Ministry of Economy, Trade and Industry as a Comprehensive Credit Purchase Intermediary. In Australia, PayPal Credit Pty Limited offers a consumer short-term, interest-free, installment product that is exempt from regulation by the primary consumer credit legislation, but is subject to other laws which cover the provision of financial services, credit reporting, debt collection, and privacy. PayPal’s consumer short-term, interest-free, installment products in the U.K., France, Germany, Spain, and Italy are generally exempt from primary consumer credit legislation; however, certain consumer lending laws, consumer protection, and banking transparency regulations apply to this activity.
Our U.S. consumer interest-bearing installment product is subject to federal and state laws and is offered by an independent chartered financial institution. PayPal’s interest-bearing installment product for consumers in Germany is subject to applicable local laws such as consumer (lending) laws, consumer protection, or banking transparency regulations. These loans are originated by PayPal (Europe).
PayPal and Venmo co-branded consumer credit cards and the PayPal Credit revolving consumer credit product are issued by an independent chartered financial institution in the U.S., and are subject to laws and regulations governing these programs. PayPal Credit in the U.K. is a regulated, revolving consumer credit product subject to applicable local laws and regulations.
Our U.S. merchant lending products are subject to federal and state regulations and are offered by an independent chartered financial institution. Our merchant lending products offered in Germany, France and the Netherlands are subject to the laws of Luxembourg and certain local laws, and our merchant lending product offered in the U.K. is subject to U.K. regulation. The loans offered to European and U.K. merchants are originated by PayPal (Europe). Our merchant lending product in Australia is subject to the laws of Australia and originated by PayPal Credit Pty Limited.
Consumer Financial Protection Bureau (“CFPB”).. The Consumer Financial Protection Bureau (the “CFPB”)CFPB has significant authority to regulate consumer financial products in the U.S., including consumer credit, deposits, payments, and similar products. As a large market participant of remittance transfers, the CFPB has direct supervisory authority over our business. The CFPB and other similar regulatory agencies in other jurisdictions may have broad consumer protection mandates that could result in the promulgation and interpretation of rules and regulations that may affect our business.
Anti-Money LaunderingAnti-money laundering, counter-terrorist financing, and Counter-Terrorist Financing.sanctions. PayPal is subject to anti-money laundering (“AML”) laws and regulations in the U.S. and other jurisdictions, as well as laws designed to prevent the use of the financial systems to facilitate terrorist activities. Our AML program is designed to prevent our payment networkpayments platform from being used to facilitate money laundering, terrorist financing, and other illicit activities, or to do business in countries or with persons and entities included on designated country or person lists promulgated by the U.S. Department of the Treasury’s Office of Foreign Assets Controls (“OFAC”) and equivalent authorities in other countries. Our AML and sanctions compliance programs, overseen by our AML/Bank Secrecy Act Officer, isare composed of policies, procedures, and internal controls, and isare designed to address these legal and regulatory requirements and assist in managing money laundering and terrorist financing risks.
Interchange Fees.fees. Interchange fees associated with four-party payments systems are being reviewed or challenged in various jurisdictions. For example, in the EU, the Multilateral Interchange Fee (“MIF”) Regulation caps interchange fees for credit and debit card payments and provides for business rules to be complied with by any company dealing with payment card transactions, including PayPal. As a result, the fees that we collect in certain jurisdictions may become the subject of regulatory challenge.
Data Protectionprotection and Information Security.privacy. Aspects of our operations or businessWe are subject to a number of laws, rules, directives, and regulations (“privacy and data protection regulationlaws”) relating to the collection, use, retention, security, processing, and transfer (collectively, “processing”) of personally identifiable information about our customers, our merchants’ customers, and employees (“personal data”) in the U.S.,countries where we operate. Our business relies on the EU, Asia Pacific,processing of personal data in many jurisdictions and elsewhere. For example, the EU adoptedmovement of data across national borders. As a comprehensive General Data Protection Regulation (the “GDPR”), which came into effect in May 2018. GDPR expanded the scoperesult, much of the EUpersonal data that we process, which may include certain financial information associated with individuals, is subject to one or more privacy and data protection lawlaws in one or more jurisdictions. In many cases, these laws apply not only to foreign companiesthird-party transactions, but also to transfers of information between or among us, our subsidiaries, and other parties with which we have commercial relationships.
Regulatory scrutiny of privacy, data protection, cybersecurity practices, and the processing of personal data of European Economic Area (“EEA”) individuals and imposed a stricter data protection compliance regime. Inis increasing around the U.S., we are subject to privacy and information safeguarding requirements under the Gramm-Leach-Bliley Act and the California Consumer Privacy Act that require similar privacy protections afforded by the GDPR, as well as the maintenance of a written, comprehensive information security program. In Europe, the operations of our Luxembourg bank are subject to confidentiality and information safeguarding requirements under the Luxembourg Banking Act.world. Regulatory authorities around the world are continuously considering numerous legislative and regulatory proposals concerning privacy and data protectioninterpretive guidelines that may contain additional privacy and data protection obligations. Many jurisdictions in which we operate have adopted, or are in the process of adopting, or amending data privacy legislation or regulation aimed at creating and enhancing individual privacy rights. In addition, the interpretation and application of these privacy and data protection laws in the U.S., Europe, and elsewhere are often uncertainsubject to change and in a state of flux.may subject us to increased regulatory scrutiny and business costs.
Anti-Corruption.Anti-corruption. PayPal is subject to applicable anti-corruption laws, such as the U.S. Foreign Corrupt Practices Act and the U.K. Bribery Act, and similar anti-corruption laws in the jurisdictions in which we operate. Anti-corruption laws generally prohibit offering, promising, giving, accepting, or authorizing others to provide anything of value, either directly or indirectly, to or from a government official or private party in order to influence official action or otherwise gain an unfair business advantage, such as to obtain or retain business. We have implemented policies, procedures, and internal controls that are designed to comply with these laws and regulations.
Additional Regulatory Developments.regulatory developments. Various regulatory agencies continue to examine and implement laws governing a wide variety of issues, including virtual currencies, identity theft, account management guidelines, privacy, disclosure rules, cybersecurity, competition, and marketing, thatwhich may impact PayPal’s business. Certain governments around the world are adopting laws and regulations pertaining to ESG performance, transparency, and reporting, including those related to general corporate ESG disclosures (e.g., the EU Corporate Sustainability Reporting Directive) as well as topical reporting and risk management requirements, such as obligations related to the management of climate-related risks.
For an additional discussion on governmental regulation affecting our business, please see the risk factors related to regulation of our payments business and regulation in the areas of consumer privacy, data use, and/or security in “Item 1A. Risk Factors” under the caption “Risk Factors That May Affect Our Business, Results of Operations, and Financial Condition” and “Item 3. Legal Proceedings” included elsewhere in this Annual Report on Form 10-K.
SeasonalityHUMAN CAPITAL
The Company does not experience meaningful seasonality with respectAt PayPal, we consider the management of our global talent (human capital) to net revenues. No individual quarter in 2019, 2018 or 2017 accounted for more than 30%be essential to the ongoing success of annual net revenue.
Employees
our business. As of December 31, 2019,2022, we employed approximately 23,20029,900 people globally, of whomwith 44% in the Americas, 43% in Asia-Pacific, and 13% in Europe and the Middle East. Our global employees work predominantly full-time and represent nearly 150 nationalities, across 27 countries, including approximately 11,200 were11,800 located in the U.S.
Attracting, recruiting, developing, and retaining diverse talent enables us to provide our customers with products and services that help them to thrive in the global economy, and serve our other stakeholders. In 2022, we developed 12 leadership principles based on our four core values that establish a common set of expectations for all employees. We considerbegan integrating these principles across our relationship withglobal talent strategy to help shape our programs throughout the employee lifecycle and achieve key business priorities. We also remain focused on promoting the physical, mental, and financial wellness of our employees, particularly as our workforce continues to be good.navigate changes in where and how we work.
Separation
Employee engagement
We use employee feedback to directly inform the ongoing development of our employee programs. In addition to administering an annual survey to gather input from eBay Inc.
our global workforce, we also conducted specific surveys to gather direct employee feedback on our internal communications approach and evolving workplace preferences. For our 2022 annual employee survey, we heard from 83% of our global employees. Our engagement score, which reflects employees that would recommend PayPal Holdings, Inc.to their peers and/or are happy at PayPal was incorporated in Delaware in January 2015 for the purpose of owning and operating eBay’s Payments business in connection79%. Our score measuring intent to stay was 78%, which reflects an employee’s expectation to remain employed with the separationcompany in two years. Additionally, we observed improvements in employee scores regarding collaboration and distribution described below. eBay completedmanager support. In 2022, we enhanced our survey to incorporate viewpoints on the transferemployee experience, diversity, inclusion, equity, and belonging (“DIE&B”) efforts, and our leadership principles, including specific questions on working style and strategic direction. The detailed scores are shared across the organization and analyzed to understand differences by geography, demographics, business function, and job level, and to help identify opportunities for further improvement.
Talent acquisition, development, and retention
As a leading technology platform that enables digital payments and simplifies commerce experiences, we compete for top global talent around the world. We believe that a strong culture focused on employee experiences that enables advancement, learning, and individual career insights is essential to the successful acquisition, development, and retention of substantiallydiverse talent. Accordingly, we have implemented programs focused on inclusive hiring practices and extending our talent pipeline through targeted partnerships, reimagined our career development program for individuals and managers, extended individual coaching and mentorship programs (particularly for underrepresented and technical talent), and advanced efforts for employees to grow through self-paced and community learning experiences.
Employee wellness
We remain focused on promoting the holistic well-being of our employees, including resources, programs, and services to support our employees’ physical, mental, and financial wellness. In 2022, our initiatives included extending our Global Wellness Days for all employees to take time to rest and recharge, providing resources, trainings, and workshops to foster emotional well-being, preserving workplace flexibility through Crisis Leave and other programs, and strategically extending employee benefits to additional global markets. We also continued our efforts to strengthen employee financial wellness, including offering individual employee financial coaching, promoting the prioritization of employee financial health across the private sector through the Worker Financial Wellness Initiative, and improving our internal measurement and evaluation approaches to identify targeted opportunities for further enhancements. Through our global community impact program, we support our employees’ individual passions and communities by matching eligible employee donations and volunteer time with non-profit organizations up to $2,500 annually per employee.
Diversity, inclusion, equity, and belonging
We believe that fostering DIE&B is critical to our global talent strategy and pivotal to building a culture that embraces individual characteristics, values diversity, minimizes barriers, and enhances feelings of security and support across the workplace. We are committed to equal pay for equal work, promoting enterprise-wide inclusive learning opportunities, and partnering with leading organizations to embed DIE&B considerations into our talent strategy. We believe that our strong commitment to DIE&B is evident at all levels of the assets, liabilities,organization from our Board of Directors to our executive leadership team to our global workforce. As of December 31, 2022, 50% of our Board and operations64% of eBay’s Payments businessour senior leadership team identified as women and/or from a diverse ethnic group. Across our workforce, we reached 56% overall diverse workforce representation, including 44% global gender diversity (inclusive of self-identified women and non-binary employees), and 54% U.S. ethnic diversity, as of December 31, 2022. Additional U.S. workforce diversity metrics can be found in our public EEO-1 reports and annual Global Impact Report available at https://about.pypl.com/values-in-action/reporting/default.aspx.
Workforce representation is only one aspect of our broader DIE&B strategy. Through the leadership of our Global Head of DIE&B and dedicated DIE&B team, along with functional collaboration and accountability, we are focused on strengthening existing efforts and piloting new initiatives to PayPal in June 2015. Priorpromote an inclusive culture. In 2022, we continued our support for underrepresented communities and employees through activities such as enhanced strategic partnerships, new learning modules to promote effective sponsorship and inclusive performance management, and new tools and resources to incorporate DIE&B considerations across the contributionbusiness. We continue to evaluate DIE&B progress across the company and as part of the Paymentsindividual performance assessment under our 2022 annual incentive plan for our senior executives. In addition, we empower eight employee resource groups to promote community and belonging for employees that identify as Black, Latinx/Hispanic, women, interfaith, veterans, LGBTQ+, Asian, and disabled persons and their allies. These groups drive ongoing employee engagement around the world for all employees, regardless of background, to support and champion their peers and related causes.
Our evolving workplace
We remain focused on creating a culture of flexibility and community by designing ways to collaborate across diverse workplace models, whether working virtually, on-site, or using a hybrid approach. We empower functional leadership to determine the most appropriate workplace strategy for their teams to optimize employee productivity and engagement and deliver on business priorities. Across PayPal, Holdings, Inc. had no operations. On July 17, 2015 (the “distribution date”), PayPal became an independent publicly traded company through the pro rata distribution by eBaywe are focused on providing tools and resources to support our diverse and distributed teams. We believe this flexible approach has broadened our potential global talent pools.
As part of 100% of the outstanding common stock of PayPal to eBay stockholders (whichour annual ESG reporting, we refer to as the “separation” or the “distribution”). Each eBay stockholder of record as of the close of businessprovide additional information on July 8, 2015 received one share of PayPal common stock for every share of eBay common stock held on the record date. Approximately 1.2 billion shares of PayPal common stock were distributed on July 17, 2015 to eBay stockholders. PayPal’s common stock began “regular way” trading under the ticker symbol “PYPL” on the NASDAQour global talent strategy, including detailed representation metrics, in our Global Select Market on July 20, 2015.Impact Report.
Available InformationAVAILABLE INFORMATION
The address of our principal executive offices is PayPal Holdings, Inc., 2211 North First Street, San Jose, California 95131. Our website is located at www.paypal.com, and our investor relations website is located at http:https://investor.paypal-corp.com.investor.pypl.com. From time to time, we may use our investor relations site and other online and social media channels, including ourthe PayPal Stories BlogNewsroom (https://www.paypal.com/stories/us)newsroom.paypal-corp.com/), Twitter handles (@PayPal and @PayPalNews), LinkedIn page (https://www.linkedin.com/company/paypal), Facebook page (https://www.facebook.com/PayPalUSA/), YouTube channel (https://www.youtube.com/paypal), Dan Schulman’s LinkedIn profile (https://www.linkedin.com/in/dan-schulman/), John Rainey’sGabrielle Rabinovitch’s LinkedIn profile (www.linkedin.com/(https://www.linkedin.com/in/john-rainey-pypl)gabriellerabinovitch/), and Dan Schulman’s Facebook page (https://www.facebook.com/DanSchulmanPayPal/), and Dan Schulman’s Instagram page (https://www.instagram.com/dan_schulman/) as a means of disclosing information about the Company, including information which could be deemed to disclosebe material non-public information and comply with our disclosure obligations under Regulation Fair Disclosure (“FD”).to investors. Our Annual Report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and amendments to those reports are available free of charge on our investor relations website as soon as reasonably practicable after they are electronically filed with, or furnished to, the SEC. The SEC maintains an internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at http://www.sec.gov. The content of our websites and information we may post on, or provide to, or accessible through online and social media channels, including those mentioned above, and information that can be accessed through our websites or these online and social media channels isare not incorporated by reference into this Annual Report on Form 10-K or in any other report or document we file with the SEC, and any references to our websites or these online and social media channels are intended to be inactive textual references only.
ITEM 1A. RISK FACTORS
The following discussion is divided into three sections. The first section, which begins immediately following this paragraph, discusses some of the risks that may adversely affect our business, results of operations, and financial condition. The second section, captioned “Risks Related to Our Separation from eBay” discusses some of the risks relating to our separation from eBay in July 2015 into an independent publicly traded company. The third section, captioned “Risks Related to Our Common Stock,” discusses some of the risks relating to an investment in our Common Stock. You should carefully review all of these sectionsconsider the risks and uncertainties described below, in addition to the other information appearing in this Annual Report on Form 10-K, including our consolidated financial statements and related notes, for important information regarding risks and uncertainties that could affect us. TheThese risk factors do not identify all risks we face, and uncertainties described below are not the only ones we face. Additionaladditional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that adversely affect our business. If any of the following risks actually occur, our business, financial condition, results of operations, and future prospects, and the trading price of our common stock could be materially and adversely affected.
Risk Factors That May Affect Our Business, Results of Operations, and Financial Condition
We face substantial and increasingly intense competition worldwide in the global payments industry.
The global payments industry is highly competitive, rapidly changing, highly innovative, and increasingly subject to regulatory scrutiny and oversight. We compete against a wide range of businesses, including those that are larger than we are, have greater name recognition, longer operating histories, or a dominant or more secure position, or offer other products and services to consumers and merchants that we do not offer, as well as smaller or younger companies that may be more agile in responding quickly to regulatory and technological changes. Many of the areas in which we compete evolve rapidly with changing and disruptive technologies, shifting user needs, and frequent introductions of new products and services. Competition also may intensify as businesses enter into business combinations and partnerships, and established companies in other segments expand to become competitive with different aspects of our business.
We compete primarily on the basis of the following:
ability to attract, retain, and engage both merchants and consumers on our Payments Platform;
ability to demonstrate to merchants that they may achieve incremental sales by using and offering our services to consumers;
consumer confidence in the safety and security of transactions on our Payments Platform, including the ability for consumers to use our products and services without sharing their financial information with the merchant or any other party they are paying;
simplicity and transparency of our fee structure;
ability to develop products and services across multiple commerce channels, including e-commerce, mobile, and payments at the point of sale;
trust in our dispute resolution and buyer and seller protection programs;
customer service experience;
brand recognition and preference;
website, mobile platform, and application onboarding, ease-of-use, speed, availability, and dependability;
ability of our Payments Platform to support across technologies and payment methods;
system reliability and data security;
ability to assist merchants in complying with payments-related laws and regulations;
ease and quality of integration into third-party mobile applications and operating systems; and
quality of developer tools, such as our application programming interfaces and software development kits.
We compete against a wide range of businesses with varying roles in all forms of payments, including:
paper-based transactions (principally cash and checks);
banks and financial institutions providing traditional payment methods, particularly credit and debit cards (collectively, “payment cards”) and electronic bank transfers;
payment networks which facilitate payments for credit card users;
providers of “digital wallets” which offer customers the ability to pay online and/or in-store through a variety of payment methods, including with mobile applications, through contactless payments, and with a variety of payment cards;
providers of mobile payments solutions that use tokenized card data approaches and contactless payments (e.g., near field communication (“NFC”) or host card emulation functionality) to eliminate the need to swipe or insert a card or enter a personal identification number or password;
payment-card processors that offer their services to merchants, including for “card on file” payments where the merchant invites the consumer to select a payment method for their first transaction and to use the same payment method for subsequent transactions;
providers of person-to-person (“P2P”) payments that facilitate individuals sending money with an email address or mobile phone number;
merchants and merchant associations that may provide proprietary payment networks to facilitate payments within their own retail network;
providers of money remittance services for transferring money abroad, including those that may provide proprietary payment networks;
providers of card readers for mobile devices and of other point-of-sale and multi-channel technologies; and
providers of virtual currencies and distributed ledger technologies.
We often partner with many of these businesses and we consider the ability to continue establishing these partnerships as important to our business. Competition for relationships with these partners is intense, and there can be no assurance that we will be able to continue to establish, grow, or maintain these partner relationships.
We also face competition and potential competition from:
services that provide online merchants the option of paying for purchases from their bank account or paying on credit;
issuers of stored value products targeted at online payments;
other online and mobile payment-services providers globally;
services targeting users of social networks and online gaming, including those offering social commerce and P2P payments;
payment services enabling banking customers to send and receive payments through their bank account, including through immediate or real-time payments systems;
e-commerce services that provide special offers linked to a specific payment provider;
services that help merchants and consumers use, accept, buy, sell, and manage virtual currencies; and
electronic funds transfer services as a method of payment for both online and offline transactions.
Some of our current and potential competitors have larger customer bases, broader geographic scope, volume, scale, resources, and market share than we do, which may provide them significant competitive advantages. Some competitors may also be subject to less burdensome licensing, anti-money laundering, counter-terrorist financing, and other regulatory requirements. They may devote greater resources to the development, promotion, and sale of products and services, and offer lower prices or more effectively offer their own innovative programs, products, and services.
If we are not able to differentiate our products and services from those of our competitors, drive value for our customers, or effectively and efficiently align our resources with our goals and objectives, we may not be able to compete effectively in the market.
Substantially all of our net revenues each quarter come primarily from transactions involving payments during that quarter, which may result in significant fluctuations in our operating results that could adversely affect our business, financial condition, results of operations, and cash flows, as well as the trading price of our common stock.
Substantially all of our net revenues each quarter come primarily from transactions involving payments during that quarter. As a result, our operating and financial results have varied on a quarterly basis during our operating history and may continue to fluctuate significantly as a result of a variety of factors, including the risks set forth in this “Risk Factors” section. It is difficult for us to forecast accurately the level or source of our revenues or earnings. In view of the rapidly evolving nature of our business, period-to-period comparisons of our operating results may not be meaningful, and you should not rely upon them as an indication of future performance. Due to the inherent difficulty in forecasting revenues, it is also difficult to forecast expenses. Quarterly and annual expenses reflected in our financial statements may be significantly different from historical or projected rates. Our operating results in one or more future quarters may fall below the expectations of securities analysts and investors. The trading price of our common stock may decline significantly as a result of the factors described in this paragraph.
Global and regional economic conditions could harm our business.
Our operations and performance depend significantly on global and regional economic conditions. Uncertainty about global and regional economic events and conditions may result in consumers and businesses postponing or lowering spending in response to, among other factors:
tighter credit,
higher unemployment,
consumer debt levels or reduced consumer confidence,
financial market volatility,
fluctuations in foreign currency exchange rates and interest rates,
changes and uncertainties related to government fiscal and tax policies,
changes and uncertainties about U.S and international trade relationships, agreements, policies, treaties and restrictive actions, as well as the possibility of significant increases in tariffs on imported goods, and other restrictive actions,
the inability of the U.S. Congress to enact a budget in a fiscal year, a sequestration, and/or another shutdown of the U.S. government,
government austerity programs, and
other negative financial news or macroeconomic developments.
CYBERSECURITY AND TECHNOLOGY RISKS
These and other global and regional economic events and conditions, including Brexit, could have a material adverse impact on the demand for our products and services, including a reduction in the volume and size of transactions on our Payments Platform. In addition, any financial turmoil affecting the banking system or financial markets could cause additional consolidation of the financial services industry, significant failures of financial service institutions, new or incremental tightening in the credit markets, low liquidity, and extreme volatility or distress in the fixed income, credit, currency, and equity markets, which could have a material adverse impact on our business. See also the risk factor captioned, “
The United Kingdom's departure from the EU could adversely affect us.”
If we cannot keep pace with rapid technological developments to provide new and innovative products and services, the use of our products and services and, consequently, our revenues could decline.
Rapid, significant, and disruptive technological changes impact the industries in which we operate, including developments in:
technologies supporting our regulatory and compliance obligations (e.g., in relation to our know your customer (“KYC”) and customer identification program (“CIP”) obligations under anti-money laundering regulations);
artificial intelligence and machine learning (e.g., in relation to fraud and risk decisioning);
payment technologies (e.g., real time payments, payment card tokenization, virtual currencies, including distributed ledger and blockchain technologies, and proximity payment technology, such as NFC and other contactless payments);
technologies (e.g., internet browser technology, that enable users to easily store their payment card information for use on any retail or e-commerce website; and
commerce technologies, including in-store, online, mobile, virtual, and social commerce (i.e., ecommerce through social networks).
As a result, we expect new services and technologies to continue to emerge and evolve, and we cannot predict the effects of technological changes on our business. In addition to our own initiatives and innovations, we rely in part on third parties, including some of our competitors, for the development of and access to new or evolving technologies. These third parties may restrict or prevent our access to, or utilization of, those technologies, as well as their platforms or products. In addition, we may not be able to accurately predict which technological developments or innovations will become widely adopted and how those technologies may be regulated. We expect that new services and technologies applicable to the industries in which we operate will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services. Developing and incorporating new technologies into our products and services may require substantial expenditures, take considerable time, and ultimately may not be successful. In addition, our ability to adopt new products and services and to develop new technologies may be inhibited by industry-wide standards, platform providers, payments networks, changes to laws and regulations, the extent of changing expectations of consumers or merchants, third-party intellectual property rights, or other factors. Our success will depend on our ability to develop and incorporate new technologies and adapt to technological changes and evolving industry standards; if we are unable to do so in a timely or cost-effective manner, our business could be harmed.
Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition.
Our business involves the collection, storage, processing, and transmission of confidential information and customers’ personal data, including financial information and information about how they interact with our Payments Platform. We have built our reputation on the premise that our Payments Platform offers customers a more secure way to make payments. An increasing number of organizations, including large merchants, businesses, technology companies, and financial institutions, as well as government institutions, have disclosed breaches of their information security systems, some of which have involved sophisticated and highly targeted attacks, including on their websites, mobile applications, and infrastructure.
The techniques used to attempt to obtain unauthorized improper, or illegal access to systems and information (including customers’ personal data), disable or degrade service, exploit vulnerabilities, or sabotage systems are constantly evolving and have become increasingly complex and sophisticated,evolving. In some circumstances, these attempts may not be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. Unauthorized parties have attempted, and we expect that they will continue to attempt to gain access to our systems or facilities through various means, including but not limited to,through hacking into our systems or facilities or those of our customers, partners, or vendors, and attempting to fraudulently induce users of our systems (including employees, vendor and ourpartner personnel and customers) into disclosing user names, passwords, payment card information, multi-factor authentication application access or other sensitive information whichused to gain access to such systems or facilities. This information may, in turn, be used to access our customers’ confidential personal or proprietary information and financial instrument data that are stored on or accessible through our information technology systems. Threats can come from a varietysystems and those of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insider threats. Certain effortsthird parties with whom we partner. This information may also be supported by significant financial and technological resources, making them even more sophisticated and difficultused to detect.execute fraudulent transactions or otherwise engage in fraudulent actions. Numerous and evolving cybersecurity threats, including advanced and persisting cyberattacks, cyberextortion, distributed denial-of-service attacks, ransomware, spear phishing and social engineering schemes, the introduction of computer viruses or other malware, and the physical destruction of all or portions of our information technology and infrastructure and those of third parties with whom we partner, are becoming increasingly sophisticated and complex, may be difficult to detect, and could compromise the confidentiality, availability, and integrity of the data in our systems. systems, as well as the systems themselves.
We believe that PayPal is a particularly attractivecybercriminals may target for such breaches and attacksPayPal due to our name, and brand recognition, types of data (including sensitive payments- and identity-related data) that customers provide to us, and the widespread adoption and use of our products and services. Although we have developed systems and processes designed to protect data we manage, prevent data loss and other security breaches and effectively respond to known and potential risks, and expect to continue to expend significant resources to bolster these protections, there can be no assurance that these security measures will provide absolute security or prevent breaches or attacks.
Our information technology and infrastructure may be vulnerable to cyberattacks or security breaches, and third parties may be able to access our customers’ personal or proprietary information and payment card data that are stored on or accessible through those systems. We have experienced from time to time, and may experience in the future, breaches of our security measures due to human error, deception, malfeasance, insider threats, system errors, ordefects, vulnerabilities, or other irregularities. Actual or perceived breachesFor example, in November 2017, we suspended the operations of ourTIO Networks (“TIO”) (acquired in July 2017) as part of an investigation of security could, among other things:
interrupt our operations,
resultvulnerabilities of the TIO platform, and in our systems or services being unavailable,
result in improper disclosureDecember 2017, we announced that we had identified evidence of dataunauthorized access to TIO’s network and violationsthe potential compromise of applicable privacy and other laws,
materially harm our reputation and brands,
result in significant regulatory scrutiny, investigations, fines, penalties and other legal and financial exposure,
cause us to incur significant remediation costs,
lead to loss of customer confidence in, or decreased use of, our products and services,
divert the attention of management from the operation of our business,
result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses to them or claims by them, and
adversely affect our business and results of operations.
personally identifiable information for approximately 1.6 million TIO customers.
In addition, any
Any cyberattacks or data security breaches affecting the information technology or infrastructure of companies we acquire or of our customers, partners, or vendors (including data center and cloud computing providers) could have similar negative effects. See Note 4—“Business Combinations,
” Note 5—“Goodwill and Intangible Assets” and Note 13—“Commitments and Contingencies” to our consolidated financial statements for disclosure relating to the suspension of operations of TIO Networks (“TIO”) (which we acquired in July 2017) as part of an investigation of security vulnerabilities of the TIO platform. Actual or perceived vulnerabilities or data breaches have led and may lead to claims against us.
In addition, underUnder payment card network rules and our contracts with our cardpayment processors, if there is a breach of payment card information that we store, or that is stored by us or our direct payment card processing vendors, we could be liable to the payment card issuing banks, including for their cost of issuing new cards and related expenses. We also expect to expend significant additional resources to protect against security or privacyCybersecurity breaches and may be requiredother exploited security vulnerabilities could subject us to redress problems caused by breaches. Financial services regulatorssignificant costs and third-party liabilities, result in various jurisdictions, including the U.S.improper disclosure of data and the EU, have implemented authentication requirements for banksviolations of applicable privacy and payment processors intended to reduce online fraud, which could impose significant costs,other laws, require us to change our business practices, make it more difficult for new customerscause us to join PayPal, and reduce the easeincur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products which could harmand services, damage our business.reputation and brands, divert the attention of management from the operation of our business, result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses to or claims by them, or expose us to litigation, regulatory investigations, and significant fines and penalties. While we maintain insurance policies theyintended to help offset the financial impact we may notexperience from these risks, our coverage may be adequateinsufficient to reimbursecompensate us for all losses caused by security breaches.breaches and other damage to or unavailability of our systems.
SystemsBusiness interruptions or systems failures and resulting interruptions inmay impair the availability of our websites, applications, products or services, couldor otherwise harm our business.
Our systems and operations and those of our service providers and partners have experienced from time to time, and may experience in the future, servicebusiness interruptions or degradation of service because of distributed denial-of-service and other
cyberattacks, insider threats, hardware and software defects or malfunctions, distributed denial-of-service and other cyberattacks, insider threats, human error, earthquakes, hurricanes, floods, fires, and other natural disasters, public health crises (including pandemics), power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks, computer viruses or other malware, or other events. We have experienced from timeThe frequency and intensity of weather events related to climate change are increasing, which could increase the likelihood and severity of such disasters as well as related damage and business interruption. Our corporate headquarters are located in the San Francisco Bay Area, a seismically active region in California. A catastrophic event that could lead to a disruption or failure of our systems or operations could result in significant losses and require substantial recovery time and may experience in the future, disruptions in our systems duesignificant expenditures to break-ins, sabotage, and intentional acts of vandalism. Someresume or maintain operations. Further, some of our systems, including systemsthose of companies that we have acquired, are not fully redundant and ourany failure of these acquired systems, including due to a catastrophic event, may lead to operational outages or delays.While we engage in disaster recovery planning and testing intended to mitigate risks from outages or delays, our planning and testing may not be sufficient for all possible outcomes or events. In addition, asAs a provider of payments solutions, we are also subject to heightened scrutiny by regulators that may require specific business continuity, resiliency and disaster recovery plans, and more rigorous testing of such plans, which may be costly and time-consuming to implement, and may divert our resources from other business priorities.
Any of the foregoing risks could have a material adverse impact on our business, financial condition, and results of operations.
We have experienced, and expect to continue to experience, system failures, denial-of-service attacks,cyberattacks, unplanned outages, and other events or conditions from time to time that have and may interrupt the availability, or reduce or adversely affect the speed or functionality, of our products and services. These events have resultedservices and likely will result in loss of revenue. A prolonged interruption in the availabilityof, or reduction in, the availability, speed, or functionality of our products and services could materially harm our business. Frequent or persistent interruptions in our services could cause current or potential customers or partners to believe that our systems are unreliable, leading them to switch to our competitors or to avoid or reduce the use of our products and services, and could permanently harm our reputationrelationship with our customers and brands. Moreover, ifpartners and our reputation. If any system failure or similar event results in damagesdamage to our customers or their business partners, these customers or partnersthey could seek significant compensation or contractual penalties from us for their losses, and thoselosses. These claims, even if unsuccessful, would likely be time-consuming and costly for us to address, and could have other consequences described in this “Risk Factors” section under the caption “address.
Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition.”
Our Payments Platform has experienced and may in the future experience intermittent unavailability. The full-time availability and expeditious delivery of our products and services is critical to our goal of gaining widespread acceptance among consumers and merchants for digital payments. We have undertaken and continue to undertake certain system upgrades and re-platforming efforts designed to improve the availability, reliability, resiliency, and speed of our reliability and speed.payments platform. These efforts are costly and time-consuming, involve significant technical complexity and risk, and may divert our resources from new features and products, and there canmay ultimately not be no guarantee that these efforts will succeed. Because we are a regulated financial institution in certain jurisdictions, frequenteffective. Frequent or persistent site interruptions could lead to regulatory scrutiny, significant fines and penalties, and mandatory and costly changes to our business practices, and ultimately could cause us to lose existing licenses that we need to operate or prevent or delay us from obtaining additional licenses that may be required for our business.
We also rely on facilities, components, applications, software, and services supplied by third parties, including data center facilities and cloud data storage services, which subjects us to risks in the nature of those discussed in this “Risk Factors” section under the captions “We rely on third parties in many aspects of our business, which creates additional risk.”and processing services. From time to time, such third partieswe have ceased to provide us withexperienced interruptions in the provision of such facilities and services. Additionally, ifservices provided by these third parties. If these third parties experience operational interference or disruptions breach their agreements with us,(including a cybersecurity incident), fail to perform their obligations, and meet our expectations, or experience a cybersecurity incident,breach their agreements with us, our operations could be disrupted or otherwise negatively affected, which could result in customer dissatisfaction, regulatory scrutiny, and damage to our reputation and brands, and materially and adversely affect our business. While we maintain business interruption insurance policies intended to help offset the financial impact we may experience from these risks, our coverage may be insufficient to compensate us for all losses that may result fromcaused by interruptions in our service as a result ofdue to systems failures and similar events.
In addition, we are continually improving and upgrading our information systems and technologies. Implementation of new systems and technologies is complex, expensive, and time-consuming. If we failany failure to timely and successfully implement new information systems and technologies, or improvements or upgrades to existing information systems and technologies or if such systems and technologies do not operate as intended, thisin a timely manner could have an adverseadversely impact on our business, internal controls, (including internal controls over financial reporting), results of operations, and financial condition.
ChangesIf we cannot keep pace with rapid technological developments to provide new and innovative products and services, the use of our products and services and, consequently, our revenues, could decline.
Rapid, significant, and disruptive technological changes impact the industries in which we operate, including payment technologies (including real-time payments, payment card networkstokenization, virtual currencies, distributed ledger and blockchain technologies, and proximity payment technology such as Near Field Communication and other contactless payments); internet browser technologies, that enable users to easily store their payment card information for use on any retail or bank fees, rules, or practices could harme-commerce website; artificial intelligence and machine learning; developments in technologies supporting our business.regulatory and compliance obligations; and in-store, digital, and social commerce.
We rely on banks or other payment processorsexpect that new technologies applicable to process transactions and pay fees for their services. From timethe industries in which we operate will continue to time, payment card networks have increased,emerge and may continuebe superior to, increaseor render obsolete, the technologies we currently use in our products and services. We cannot predict the future, the interchange feeseffects of technological changes on our business, which technological developments or innovations will become widely adopted, and assessments that they charge for transactions that access their networks. Payment card networks have imposed,how
those technologies may be regulated. Developing and incorporating new technologies into new and existing products and services may require significant investment, take considerable time, and may imposenot ultimately be successful. We rely in part on third parties, including some of our competitors, for the future, special feesdevelopment of and access to new or assessments for transactions that are executed through a digital wallet such as PayPal’s, which could negatively impact us and significantly increaseevolving technologies. These third parties may restrict or prevent our costs. Our payment card processors may have the rightaccess to, pass any increases in interchange fees and assessments on to usor utilization of, those technologies, as well as increase their own fees for processing, which could increaseplatforms or products. Our ability to develop, provide or incorporate new technologies and adapt our operating costsexisting products and reduce our operating income. We have entered into strategic partnerships with Visa, Mastercardservices or develop future and new products and services using new technologies may be limited or restricted by industry-wide standards, platform providers, payments networks, changes to laws and regulations, changing customer expectations, third-party intellectual property rights, and other credit card networks to further expand our relationships in a way that will make it easier for merchants to accept and consumers to choose to pay with their respective credit cards and debit cards. During the terms of these agreements, Visa and Mastercard have each agreed to not enact or impose any fees or rules that solely target PayPal. Upon termination of the agreements, PayPal could become subject to special digital wallet fees or other special assessments.
In addition, in some jurisdictions, government regulations have required payment card networks to reduce or cap interchange fees. Any material change in credit card or debit card interchange rates in the U.S. or other markets, including as a result of changes in interchange fee limitations, could adversely affect our competitive position against traditional payment card service providers and our business, as well as the revenue we earn from our card programs.
We are required to comply with payment card network operating rules, including special operating rules for payment service providers to merchants. We have agreed to reimburse our processors for any fines they are assessed by payment card networks resulting from any rule violations by us or our merchants. We may also be directly liable to the payment card networks for rule violations. The payment card networks set and interpret the card operating rules and have alleged from time to time that various aspects of our business model violate these operating rules. If such allegations are not resolved favorably, they may result in significant fines and penalties or require changes in our business practices that may be costly and adversely affect our business. The payment card networks could adopt new operating rules or interpret or re-interpret existing rules that we or our processors might find difficult or even impossible to follow, or costly to implement. As a result, we could lose our ability to give consumers the option of using payment cards to fund their payments or the choice of currency in which they would like their payment card to be charged.factors. If we are unable to accept payment cards or are limited in our abilitydevelop and incorporate new technologies and adapt to do so, our business would be adversely affected.
Wetechnological changes and our payment card processors have implemented specific business processes for merchants to comply with payment card network operating rules for providing services to merchants. Any failure to comply with these rules could result in fines. We are also subject to fines from payment card networks if we fail to detect that merchants are engaging in activities that are illegal or considered “high risk” under their network operating rules, including the sale of certain types of digital content. For “high risk” merchants, we must either prevent such merchants from using PayPal services or register such merchants with the payment card networks and conduct additional monitoring with respect to such merchants. Although the amount of these fines has not been material to date, we could be subject to significant additional fines in the future, which could resultevolving industry standards in a termination of our ability to accept payment cardstimely or require changes in our process for registering new customers, which would adversely affect our business. Payment card network rules may also increase the cost of, impose restrictions on, or otherwise negatively impact the development of, our retail point-of-sale solutions, which may negatively impact their deployment and adoption.
Failure to deal effectively with fraud, fictitious transactions, bad transactions, and negative customer experiences would increase our loss rate and could negatively impact our business and severely diminish merchant and consumer confidence in and use of our services.
Our operations process a significant volume and dollar value of transactions on a daily basis. In the event that merchants do not fulfill their obligations to consumers or a merchant's goods or services do not match the merchant’s description, we may incur substantial losses as a result of claims from consumers. We seek to recover such losses from the merchant but we may not fully recover them if the merchant is unwilling or unable to pay. In addition, in the event of the bankruptcy or other business interruption of a merchant that sells goods or services in advance of the date of their delivery or use (e.g., airline, cruise or concert tickets, custom-made goods, and subscriptions), we could be liable to the buyers of such goods or services, either through our buyer protection program or through chargebacks on payment cards used by customers to fund their payments. While we have established allowances for transaction losses based on assumptions and estimates that we believe are reasonable to cover such losses incurred as of the reporting date, these reserves may be insufficient.
We also incur substantial losses from claims that the consumer did not authorize the purchase, fraud, erroneous transactions, and customers who have closed bank accounts or have insufficient funds in their bank accounts to satisfy payments. In addition, if losses incurred by us related to payment card transactions become excessive, they could potentially result in our losing the right to accept payment cards for payment, which would negatively impact our business. We have taken measures to detect and reduce the risk of fraud, but these measures require continuous improvement and may not be effective in detecting and preventing fraud, particularly new and continually evolving forms of fraud or in connection with new or expanded product offerings. If these measures do not succeed,cost-effective manner, our business could be negatively impacted.
We are exposed to fluctuations in foreign currency exchange rates that could materially and adversely affect our financial results.
We have significant operations internationally that are denominated in foreign currencies, including the British Pound, Euro, Australian Dollar, and Canadian Dollar, which subject us to foreign currency exchange risk. The strengthening or weakening of the U.S. dollar versus these foreign currencies impacts the translation of our net revenues generated and expenses incurred in these foreign currencies into the U.S. dollar. In connection with providing our services in multiple currencies, we may face financial exposure if we incorrectly set our foreign currency exchange rates or as a result of fluctuations in foreign currency exchange rates between the times that we set them. We also hold a portion of our corporate and customer funds in non-U.S. currencies, and our financial results are affected by the remeasurement of these non-U.S. currencies into U.S. dollars. We also have foreign currency exchange risk on our assets and liabilities denominated in currencies other than the functional currency of our subsidiaries. While we regularly enter into transactions to hedge foreign currency exchange risk for portions of our foreign currency translation and balance sheet exposure, it is impossible to predict or entirely eliminate the effects of this exposure.
Any factors that reduce cross-border trade or make such trade more difficult could harm our business.
harmed.
Cross-border trade (i.e., transactions where the merchant and consumer are in different countries) is an important source of our revenue and profits. Cross-border transactions generally provide higher revenues and operating income than similar transactions that take place within a single country or market. Cross-border trade also represents our primary (and in some cases, our only) presence in certain important markets.
LEGAL, REGULATORY AND COMPLIANCE RISKS
Cross-border trade is subject to, and may be negatively impacted by, foreign currency exchange rate fluctuations. In addition, the interpretation and application of laws of multiple jurisdictions (e.g., the jurisdiction of the merchant and of the consumer) are often extremely complicated in the context of cross-border trade and foreign exchange. Changes to or the interpretation and/or application of laws and regulations applicable to cross-border trade and foreign exchange could impose additional requirements and restrictions, increase costs, and impose conflicting obligations. Any factors that increase the costs of cross-border trade for us or our customers or that restrict, delay, or make cross-border trade more difficult or impractical, such as trade policy or higher tariffs, could reduce our cross-border transactions and volume, negatively impact our revenues and profits and harm our business. See also the risk factor captioned, “
Global and regional economic conditions could harm our business.”
Changes in how consumers fund their PayPal transactions could harm our business.
We pay transaction fees when consumers fund payment transactions using credit cards, lower fees when consumers fund payments with debit cards, and nominal fees when consumers fund payment transactions by electronic transfer of funds from bank accounts, or from an existing PayPal account balance or through our PayPal branded consumer credit products. Our financial success is sensitive to changes in the rate at which our consumers fund payments using payment cards, which can significantly increase our costs. Although we provide consumers in certain markets with the opportunity to use their existing PayPal account balance to fund payment transactions, some of our consumers may prefer to use payment cards, especially if these payment cards offer features and benefits that are not provided as part of their PayPal accounts. An increase in the portion of our payment volume funded using payment cards or in fees associated with our funding mix, or other events or developments that make it more difficult or costly for us to fund transactions with lower-cost funding options, could materially and adversely affect our financial performance and significantly harm our business.
We have entered into strategic partnerships with major payment card networks and/or issuing banks to promote greater consumer choice and make it easier for merchants to accept and consumers to pay with these partners’ credit cards and/or debit cards and to allow us to gain access to these partners’ tokenization services for in-store point of sale PayPal transactions. These arrangements may have an uncertain impact on our business. While we anticipate that these and similar strategic partnerships we may enter into in the future will result in an increase in the number of transactions and transaction volume that we process, we also anticipate that a greater percentage of customer transactions will be executed using a payment card, which would likely increase the transaction costs associated with our funding mix, which could adversely affect our business, results of operations, and profitability.
The United Kingdom’s departure from the EU could adversely affect us.
The United Kingdom (“U.K.”) held a referendum in June 2016 in which a majority of voters approved an exit from the European Union (“EU”) (commonly referred to as “Brexit”). The U.K. formally exited the EU on January 31, 2020 and a transition period is in place until December 31, 2020 during which time the U.K. will remain in both the EU customs union and single market and follow EU rules. There is a significant lack of clarity over the terms of the U.K.'s future relationship with the EU after this date.
Brexit could therefore adversely affect U.K., regional (including European), and worldwide economic and market conditions and could contribute to instability in global financial and foreign currency exchange markets, including volatility in the value of the British Pound and Euro, which in turn could adversely affect us or our customers and companies with which we do business, particularly in the U.K. Brexit could lead to greater restrictions on the supply and availability of goods and services between the U.K. and the EEA region, with the potential inability of U.K. companies to fulfill orders which could lead to a risk of increased merchant defaults and buyer protection claims. Brexit could also trigger a general deterioration in credit conditions, a downturn in consumer sentiment, and overall negative economic growth. Any of these scenarios could have an adverse effect on our business or our customers.
In addition, Brexit could lead to legal uncertainty and increased complexity for financial services firms as national laws and regulations in the U.K. start to diverge from EU laws and regulations. In particular, depending on the terms of Brexit, we may face new regulatory costs and challenges, including the following:
if we are unable to utilize appropriate authorizations and regulatory permissions, our European operations could lose their ability to offer services into the U.K. market on a cross-border basis and for our U.K. based operations to offer services on a cross-border basis in the European markets. For example, our ability to work primarily with the Luxembourg regulator as the lead authority for various aspects of the U.K. operations of PayPal (Europe) S.à.r.l. et Cie., SCA (“PayPal (Europe)”) and with the Swedish regulator for various aspects of the U.K. operations of iZettle AB (“iZettle”) may be impacted;
we could be required to obtain additional regulatory permissions to operate in the U.K. market, adding costs and potential inconsistency to our business. Depending on the capacity of the U.K. authorities, the criteria for obtaining permission, and any possible transitional arrangements, our business in the U.K. could be materially affected or disrupted;
we could be required to comply with legal and regulatory requirements in the U.K. that are in addition to, or inconsistent with, those of the EU, leading to increased complexity and costs for our European and U.K. operations; and
our ability to attract and retain the necessary human resources in appropriate locations to support our U.K. and European business could be adversely impacted.
These and other factors related to Brexit could, individually or in the aggregate, have a material adverse impact on our business, financial condition, and results of operations.
Our business is subject to extensive government regulation and oversight. Our failure to comply with extensive, complex, overlapping, and frequently changing rules, regulations, and legal interpretations could materially harm our business.
Our business is subject to complex and changing laws, rules, regulations, policies, and legal interpretations in the markets in which we operate,offer services directly or through partners, including but not limited to, those governing:
•banking,
•credit,
•deposit taking,
•cross-border and domestic money transmission,
•prepaid access,
•foreign currency exchange,
•privacy,
• data protection, data governance,
•data protection,
•cybersecurity,
•banking secrecy,
•fraud detection,
• digital payments, cryptocurrency, payment services (including payment processing and settlement services),
• fraud detection, consumer protection,
•antitrust and competition,
•economic and trade sanctions,
•anti-money laundering, and counter-terrorist financing.
•counter-terrorist financing.
Our success and increased visibility may result in increasedRegulators globally are increasingly exercising regulatory authority, oversight, and enforcement and more restrictive rules and regulationsin a manner that apply toimpacts our business.
As Further, as we introduce new products and services and expand into new markets (including through acquisitions) and expand and localize our international activities, we haveexpect to become increasingly obligatedsubject to comply with the laws of the markets in which we operate.additional regulations, restrictions, and licensing requirements. In addition, because our services are accessible worldwide and we facilitate sales of goods and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws. Laws regulating the internet, mobile, and related technologies outside of the U.S. oftenlaws, which may impose different, more specific, or even conflicting obligations on us, as well as broader liability. For example, certain transactions that may be permissible in a local jurisdiction may be prohibited by regulations of U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”) or U.S. anti-money laundering or counter-terrorist financing regulations.
Any failure or perceivedalleged failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to or expansion of the interpretation of those laws, regulations, or orders), including those discussed in this risk factor,their interpretation) may subject us to significant fines and penalties, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions;actions; result in additional compliance and licensure requirements; cause us to lose existing licenses or prevent or delay us from obtaining additional licenses that may be required for our business; increase regulatory scrutiny of our business; restrict or cease our operations; and force us to changemake changes to our business practices, make productproducts or operational changes, oroperations; lead to increased friction for customers; require us to engage in remediation activities; delay planned transactions, product launches or improvements.other activities, or divert management’s time and attention from our business. The complexity of United States (“U.S.”) federal and state and international regulatory and enforcement regimes, coupled with the global scope of our operations and the evolving global regulatory environment, could result in one or more events prompting a large number of overlapping investigations and legal and regulatory proceedings by multiple government authorities in different jurisdictions. While we have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, there can be no assurance that our employees, contractors, and agents will not violate such laws and regulations. Any of the foregoing could, individually or in the aggregate, harm our reputation, damage our brands and business, and adversely affect our results of operations and financial condition. The complexity of U.S. federal and state and international regulatory and enforcement regimes, coupled with the global scope of our operations and the evolving global regulatory environment, could result in a single event prompting a large number of overlapping investigations and legal and regulatory proceedings by multiple government authorities in different jurisdictions. We have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, but there can be no assurance that our employees, contractors, and agents will not violate such laws and regulations.
Payments Regulation
In the U.S., PayPal, Inc. has obtained(a wholly-owned subsidiary) holds licenses to operate as a money transmitter (or its equivalent) in the states where such licenses are required, as well as in the District of Columbia the U.S. Virgin Islands, and Puerto Rico. These licenses include not only the PayPal branded products and services in these states, but also our Braintree, Venmo, and Xoom products and services. We may also maintain such licenses for certain companies thatterritories. If we have acquired, such as Hyperwallet. As a licensed money transmitter, PayPal is subjectfail to among other requirements, restrictionscomply with respect to the investment of customer funds, reporting requirements, bonding requirements, and inspection by state regulatory agencies. Accordingly, if we violate theseapplicable laws or regulations required to maintain our licenses, we could be subject to liability and/or additional restrictions, forced to cease doing business with residents of certain states or territories, forced to change our business practices, or required to obtain additional licenses or regulatory approvals, which could impose substantial costs.costs and harm our business.
While we currently allow our customers with payment cards to send payments from approximately 200 markets, we allow customers in only approximately half of those markets (including the U.S.) to also receive payments, in some cases with significant restrictions on the manner in which customers can hold balances or withdraw funds. These limitationsrestrictions may adversely affectlimit our ability to grow our business in these markets.business.
WeOutside of the U.S., we principally provide our services to customers in the EUEuropean Economic Area (“EEA”) and the United Kingdom (“U.K.”) through PayPal (Europe), our wholly-owned subsidiary that is licensed and subject to regulation as a credit
institution in Luxembourg. Accordingly, PayPal (Europe) is potentiallymay be subject to enforcement actions and significant fines or other enforcement action if it violates the disclosure, reporting, anti-money laundering, capitalization, corporate governance, privacy, data protection, data governance, information security, banking secrecy, taxation, risk management, sanctions, or other requirements imposed on Luxembourg credit institutions. In addition, EUapplicable requirements. Additionally, compliance with applicable laws and regulations are subject to potentially inconsistent interpretations by the countries that are members of the EU, which can make compliancecould become more costly and operationally difficult to manage. Moreover, the countries that are EU members may each have different andmanage due to potentially inconsistent interpretations and domestic regulations implementing European Directives,by various countries in the region. Applicable regulation relating to payments, anti-money laundering and digital services, which could make compliance more costlyare key focus areas of regulators and operationally difficultsubject to manage. The Revised Payment Services Directive (“PSD2”) took effect in Europe in 2018, with certain requirements becoming applicable from 2019 or later. PSD2 enablesextensive new payment and information sharing models whereby regulated payment providers are able to access bank and payment accounts (including PayPal accounts) for the purposes of accessing account information or initiating a payment on behalf of a customer. Such accessregulation, could subject us to data securityadditional and other legal and financialcomplex obligations, risks and could create new competitive forces and new types of competitors in the European payments market. PSD2 also imposes new standards for payment security and strong customer authentication (“SCA”) that may make it more difficult and time consuming to carry out a PayPal transaction, which may adversely impact PayPal’s European customer value proposition. SCA was implemented in 2019. In line with an opinion issued by the European Banking Authority (“EBA”), national competent authorities (including Luxembourg) have announced enforcement deferral periods for migration to SCA requirements for e-commerce card-based transactions. PayPal (Europe) has implemented SCA customer processes covering the majority of payment transactions initiated within the EU and has plans to finalize full compliance with SCA; amending or accelerating these plans may adversely impact PayPal’s European customer value proposition.
associated costs. If the business activities of PayPal (Europe) exceed certain thresholds, or if the European Central Bank (“ECB”) so determines, PayPal (Europe) may be deemed a significant supervised entity such that some activityand certain activities of PayPal (Europe) couldwould become directly regulatedsupervised by the ECB, rather than the CSSF,by the Luxembourg regulator , as its national supervisor,Commission de Surveillance du Secteur Financier, which could subject us to additional requirements and would likely increase compliance costs. PayPal (Europe) is also subject to regulation by the ECB under the oversight framework for electronic payment instruments, schemes and arrangements (PISA), which may also lead to increased compliance obligations and costs.
In many of the other markets outside the U.S. in which we do business, we serve our customers through PayPal Pte. Ltd., our wholly-owned subsidiary based in Singapore. PayPal Pte. Ltd. is supervised by the Monetary Authority of Singapore and designated as a holder of a stored value facility, but does not hold a remittance license. As a result,(“MAS”). The Payment Services Act came into effect in Singapore in January 2020. PayPal Pte. Ltd. has submitted an application for a Major Payment Institution license to the MAS to continue to provide payments services, and is not ableoperating under an exemption from holding a license within a statutory transition period while the application is pending. Upon PayPal Pte. Ltd. obtaining this license, we will be required to offer outbound remittance payments fromcomply with new regulatory requirements, which will result in increased operational complexity and costs for our Singapore and can only offer payments for the purchase of goods and services in Singapore. international operations.
In many of the markets outside the U.S. (other than Singapore) served by PayPal Pte. Ltd., it is unclear and uncertain or by local branches or subsidiaries subject to local regulatory supervision or oversight, as the case may be, there may be uncertainty whether our Singapore-based service is subject only to Singapore law or if it is subjectalso to the application ofother local laws, and whether such local laws wouldmight require a payment processor like us to be licensed as a payments service, bank, financial institution, or otherwise. The Payment Services Act (“PS Act”) passed into law in Singapore in January 2019 and is expected to come into effect in 2020. Under the PS Act, PayPal Pte. Ltd. will be required to apply for a license to continue to provide payments services in Singapore. Furthermore, once the PS Act comes into force and is fully implemented, we may face new regulatory
There are substantial costs and challenges, including the following:
potential product and operational changes involved in maintaining and renewing licenses, certifications, and approvals, and we could be required to comply with new regulatory requirements, resulting in increased complexity and costs for our Singapore and international operations;
we could be required to make changes to our compliance program, resulting in increased complexity and costs to operate both in Singapore as well as in the cross-border markets which are served by PayPal Pte. Ltd; and
we could be required to comply with additional safeguarding requirements, which could increase our operational costs.
In certain markets outside the U.S. (e.g., Australia), we provide our services to customers through a local subsidiary subject to local regulatory supervision or oversight, which may be the holder of a local payment license, certification, or other authorization. In such markets, we may be subject to significantenforcement actions, fines, or other enforcement actionand litigation if we are found to violate applicable reporting, anti-money laundering, capital requirements, privacy, corporate governance, risk management, or any other applicableof these requirements.
PayPal Australia Pty Limited (“PPAU”) self-reported a potential violation to the Australian Transaction Reports and Analysis Centre (“AUSTRAC”) on May 22, 2019 with respect to the reporting of international funds transfer instructions under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (“AML/CTF Act”). Please see Note 13—Commitments and Contingencies—Litigation and Regulatory Matters—for additional disclosure regarding this matter.
From time to time, we may acquire entities subject to local regulatory supervision or oversight. For example, in December 2019, we completed our acquisition of a 70% equity stake in Guofubao Information Technology Co. (GoPay), Ltd. (“GoPay”), a provider of online payment services in China. GoPay holds a number of payment business licenses in China and is subject to regulatory supervision by the People’s Bank of China and other regulatory bodies. We have been, and expect to continue to be, required to apply for various licenses, certifications, and regulatory approvals in a number of the jurisdictions where we provide our services, including due to changes in applicable laws and regulations or the interpretation of such laws and regulations. There can be no assurance that we will be able to (or decide to) continue to apply for or obtain any such licenses, certifications, and approvals. In addition, there are substantial costs and potential product changes involved in maintaining and renewing such licenses,renewals, certifications, and approvals and we could be subject to fines, other enforcement action, and litigation if we are found to violate disclosure, reporting, anti-money laundering, capitalization, corporate governance, or other requirements of such licenses. These factors could impose substantial additional costs, involve considerable delay to the development or provision of our products or services, require significant and costly operational changes, or prevent us from providing our products or services in a given market.
any jurisdiction. In many countries, it may not be clear whether we are required to be licensed as a payment services provider, bank, financial institution, or otherwise. In suchcertain markets, we may need to rely on local banks or other partners to process payments and conduct foreign currency exchange transactions in local currency. Localcurrency, and local regulators may use their authority over such local partners to slowprohibit, restrict, or halt payments to local merchants conducted through local banks or otherwise prohibit or impedelimit us from doing businessbusiness. Any of the foregoing could, individually or in a jurisdiction. Such regulatory actionsthe aggregate, result in substantial additional costs, delay or the need to obtain licenses, certifications,preclude planned transactions, product launches or other regulatory approvals could impose substantial costs, involve considerable delay to the provision or development of our services,improvements, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, products and services, or prevent or limit us from providing anyour products or services in a given market.
Cryptocurrency Regulation and Related Risks
Our current and planned customer cryptocurrency offerings could subject us to additional regulations, licensing requirements, or other obligations. Within the U.S., we are regulated by the New York Department of Financial Services as a virtual currency business, which does not qualify us to engage in securities brokerage or dealing activities. The regulatory status of particular cryptocurrencies is unclear under existing law. For example, if the SEC were to assert that any of the cryptocurrencies we support are securities, the SEC could assert that our activities involving that cryptocurrency require securities broker-dealer registration or other obligations under the federal securities laws. The rapidly evolving regulatory landscape with respect to cryptocurrency may subject us to additional licensing and regulatory obligations or to inquiries or investigations from the SEC, other regulators and governmental authorities, and require us to make product changes, restrict or discontinue product offerings, implement additional and potentially costly controls, or take other actions. If we fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, we could face regulatory or other enforcement actions, potential fines, and other consequences.
We hold our customers’ cryptocurrency assets through a third-party custodian. Financial and third-party risks related to our customer cryptocurrency offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodian, insufficient insurance coverage by the custodian to reimburse us for all such losses, the custodian’s failure to maintain effective controls over the custody and settlement services provided to us, the custodian’s inability to purchase or liquidate cryptocurrency holdings, and defaults on financial or performance obligations by the custodian, or counterparty financial institutions, could expose our customers and us to loss, and therefore significantly harm our business, financial performance, and reputation.
We have selected a custodian partner, and may in the future select additional custodian partners, that are subject to regulatory oversight, capital requirements, maintenance of audit and compliance industry certifications, and cybersecurity procedures and policies. Nevertheless, operational disruptions at any such custodian, or such custodian’s failure to safeguard cryptocurrency holdings could result in losses of customer assets, expose us to customer claims, reduce consumer confidence and materially impact our operating results and our cryptocurrency product offerings.
Custodial arrangements to safeguard cryptocurrency assets involve unique risks and uncertainties in the event of the custodian’s bankruptcy. While other types of assets and some custodied cryptocurrencies have been deemed not to be part of the custodian’s bankruptcy estate under various regulatory regimes, bankruptcy courts have not yet definitively determined the appropriate treatment of custodial holdings of digital assets in a bankruptcy proceeding. In the event of our custodian’s bankruptcy, the lack of precedent and the highly fact-dependent nature of the determination could delay or preclude the return of custodied cryptocurrency assets to us or to our customers. Although, we contractually require our custodian to segregate our customer assets and not commingle them with proprietary or other assets, we cannot be certain that these contractual obligations, even if duly observed by the custodian, will be effective in preventing such assets from being treated as part of the custodian’s estate under bankruptcy or other insolvency law. In that event, our claim on behalf of such customers against the custodian’s estate for our customers’ cryptocurrency assets could be treated as a general unsecured claim against the custodian, in which case our customers could seek to hold us liable for any resulting losses.
In addition, our cryptocurrency product offerings could have the effect of heightening or exacerbating many of the risk factors described in this “Risk Factors” section.
Lending Regulation
We hold a number of U.S. state lending licenses for our U.S. consumer short-term installment loan product, which is subject to federal and state laws governing consumer credit and debt collection. While the consumer short-term installment loan products that we offer outside the U.S. are generally exempt from primary consumer credit legislation, certain consumer lending laws, consumer protection or banking transparency regulations continue to apply to these products. Increased global regulatory focus on short-term installment products and consumer credit more broadly could result in laws or regulations requiring changes to our policies, procedures, operations, and product offerings, and restrict or limit our ability to offer credit products, and we could be subject to enforcement action, fines, and litigation if we are found to violate any aspects of applicable law or regulations.
Consumer Protection
We are subject to consumer protection, antitrust and competition-related laws and regulations in the countries in which we operate. In the U.S., we are subject toViolations of federal and state consumer protection laws and regulations, applicable to our activities, including the Electronic Fund Transfer Act (“EFTA”) and Regulation E as implemented by the Consumer Financial Protection Bureau (“CFPB”). These regulations require us to provide advance disclosure of changes to our services, follow specified error resolution procedures, and reimburse consumers for losses from certain transactions not authorized by the consumer. Additionally, technical violations of consumer protection laws, could result in the assessment of significant actual damages or statutory damages or penalties of up to $1,000 in individual cases or up to $500,000 per violation in any class action and(including treble damages in some instances; we could also be liable forinstances) and plaintiffs’ attorneys’ fees in such cases.fees. We are subject to, and have paid amounts in settlement of, lawsuits containing allegations that our business violated the EFTA and Regulation E or otherwise advance claims for relief relating to our business practices (e.g., that we improperly held consumer funds or otherwise improperly limited consumer accounts).
The CFPB issued a final rule on prepaid accounts that came into effect on April 1, 2019. The rule’s definition of prepaid account includes certain accounts that are capable of being loaded with funds and whose primary function is to conduct transactions with multiple, unaffiliated merchants, at ATMs and/or for P2P transfers. That definition includes certain digital wallets. The rule’s requirements include, among other things, the disclosure of fees and other information to the consumer prior to the creation of a prepaid account; the extension of Regulation E liability limits and error-resolution requirements to all prepaid accounts; the application of Regulation Z credit card requirements to prepaid accounts with overdraft and credit features; and the submission of prepaid account agreements toIn addition, the CFPB, and their publicationpursuant to the general public. We have implemented certain changes to comply with the final rule and made substantial changes to the design of certain U.S. consumer accounts and their operability, which could lead to unintended customer confusion and dissatisfaction, discourage customers from opening new accounts,its market-monitoring authority, may require us to reallocate resources,provide extensive information on our products and increase our costs, which could negatively affect our business.offerings from time to time. In December 2019,2021, we filed a lawsuit in the U.S. District Court for the District of Columbia againstreceived separate orders from the CFPB challengingpursuant to such market-monitoring authority requiring us to provide, among other items, extensive information on our payment products, including with respect to the validitycollection, use of, the prepaid account ruleand access to data and consumer protections, as applied to PayPal, Inc. As with any litigation, there is no guarantee thatwell as our claims will succeed.Buy Now, Pay Later offerings.
In May 2015, we entered into a Stipulated Final Judgment and Consent Order (“Consent Order”) with the CFPB in which we settled regulatory claims arising from PayPal Credit practices between 2011 and 2015. The Consent Order included obligations of PayPal to pay $15 million in redress to consumers and a $10 million civil monetary penalty, and required PayPal to make various changes to PayPal Credit disclosures and related business practices. We continue to cooperate and engage with the CFPB and work to ensure compliance with the Consent Order, which may result in us incurring additional costs.
PayPal principally offers its services in the EEA countries through a “passport” notification process through thePayPal (Europe)’s Luxembourg regulator (in the case of PayPal (Europe)) or the Swedish regulator (in the case of iZettle AB) to regulators in other EEA member states in accordance with EU regulations.European Union (“EU”) regulations, as well as in the U.K. through the Temporary Permissions Regime. Regulators in these countries could notify us of and seek to enforce local consumer protection laws that apply to our business, in addition to Luxembourg or Swedish consumer protection laws, and could alsoor seek to persuade the local regulator to order PayPal to conduct its activities in the local country directly or through a branch office. Similarly, as a result of Brexit, the U.K. regulators may impose new or different legal requirements on our U.K. business, or require our activities to be conducted locally in the U.K. through a branch office or directly. These or similar actions by these regulators could increase the cost of, or delay,impose additional obligations and costs and impact our plansability to expand our business in EEA countries.Europe and the U.K.
Economic and Trade Sanctions
We are required to comply with economic and trade sanctions administered by the U.S, the EU, relevant EU member states, and other jurisdictions in which we operate. We have self-reported to OFAC certain transactions that were inadvertently processed but subsequently identified as possible violations of U.S. economic and trade sanctions. In March 2015, we reached a settlement with OFAC regarding possible violations arising from our sanctions compliance practices between 2009 and 2013, prior to the implementation of our real-time transaction scanning program. Subsequently, we have self-reported additional transactions as possible violations, and we have received new subpoenas from OFAC seeking additional information about certain of these transactions. Such self-reported transactions could result in claims or actions against us, including litigation, injunctions, damage awards, fines or penalties, or require us to change our business practices in a manner that could result in a material loss, require significant management time, result in the diversion of significant operational resources, or otherwise harm our business.
Anti-Money Laundering and Counter-Terrorist FinancingFinancing; Economic and Trade Sanctions
We are subjectRegulators globally continue to variousincrease standards and expectations regarding anti-money laundering and counter-terrorist financing, and to expand the scope of existing laws and regulations around the world that prohibit, among other things, our involvement in transferring the proceeds of criminal activities. Regulators in the U.S.to emerging products and other regulators globally continue to increase their scrutiny of compliance with these obligations,markets, which may require us to further revise or expand our compliance program globally and/or in specific jurisdictions, including the procedures we use to
verify the identity of our customers and to monitor international and domestic transactions. Many countries in which we operate also have anti-money laundering and counter-terrorist financing laws and regulations, and we have been and will continue to be required to make changes to our compliance program in various jurisdictions in response. Such changes could have the effect of making compliance more costly and operationally difficult to manage, lead to increased friction for customers, and result in a decrease in business. Regulators regularly re-examine the transaction volume thresholds at which we must obtain and keep applicable records or the circumstances in which we must verify identities of customers, and any change into such thresholdsobligations could result in greater compliance costs for compliance.and impact our business. We are also required to comply with economic and trade sanctions administered by the U.S., the EU and its member states, the U.K., and other jurisdictions in which we operate. Non-compliance with anti-money laundering laws and regulations or economic and trade sanctions may subject us to significant fines, penalties, lawsuits, and enforcement actions, result in regulatory sanctions and additional compliance requirements, increase regulatory scrutiny of our business, restrict our operations, orand damage our reputation and brands. In the EU, for example, penalties for non-compliance with anti-money laundering laws could include finesOur compliance history may be considered by OFAC and other regulators as part of up to 10%any potential future investigation of PayPal (Europe)’s total annual turnover.our sanctions regulation.
Privacy and Protection of UserCustomer Data
We are subject to a number of laws, rules, directives, and regulations (which we refer to as “privacy and data protection laws”) relating to the collection, use, retention, security, processing, and transfer (which we collectively refer to as “processing”) of personally identifiable information about our customers and employees (which we refer to as “personal data”) in the countries where we operate. Our business relies on the processing of personal data in many jurisdictions and the movement of data across national borders. As a result, much of the personal data that we process, which may include certain financial information associated with individuals, is regulated by multiple privacy and data protection laws and, in some cases, the privacy and data protection laws of multiple jurisdictions. In many cases, these laws apply not only to third-party transactions, but also to transfers of information between or among us, our subsidiaries, and other parties with which we have commercial relationships.
Regulatory scrutiny of privacy, data protection, cybersecurity practices, and the processing of personal data is increasing around the world. There is uncertainty associated with theThe legal and regulatory environment relating to privacy and data protection laws which continuecontinues to develop and evolve in ways we cannot predict, including with respect to evolving technologies such as cloud computing, artificial intelligence, machine learning, cryptocurrency, and blockchain technology. Any failure or perceived failure to comply with existing or new laws of any government authority (including changes to or expansion of the interpretation of those laws), including those discussed in this risk factor, may subject us to significant fines, penalties, civil lawsuits, and enforcement actions in one or more jurisdictions, result in additional compliance requirements, increase regulatory scrutiny of our business, restrict our operations, and force us to change our business practices, make product or operational changes, or delay planned product launches or improvements.
Any failure, or perceivedalleged failure by us to comply with our privacy policies as communicated to users in onecustomers or more jurisdictionswith privacy and data protection laws could result in proceedings or actions against us by data protection authorities, other government entitiesagencies, or others, including class action privacy litigation in certain jurisdictions. Such proceedings or actionswhich could subject us to significant fines, penalties, judgments, and negative publicity, which may materially harm our business. The foregoing may require us to change our business practices, and would likely increase the costs and complexity of compliance. In addition, compliance, result in reputational harm, and materially harm our business. Compliance with inconsistent privacy and data protection laws may also restrict or limit our ability to provide products and services to our customers.
PayPal relies on a variety of compliance methods to transfer personal data of EEA individuals to the U.S., including reliance on Binding Corporate Rules (“BCRs”) for internal transfers of certain types of personal data and Standard Contractual Clauses (“SCCs”) as approved by the European Commission for transfers to and from third parties. In June 2021, the European Commission imposed new SCC requirements which impose certain contract and operational requirements on PayPal, must alsoits merchants, and vendors to adhere to certain affirmative duties, including requirements related to government access transparency, enhanced data subject rights, and broader third-party assessments to ensure that third parties processingsafeguards necessary to protect personal data ofexported from PayPal’s EEA customers and/or employees to countries outside of the EEA have compliant transfer mechanisms. In October 2015, the European Court of Justice invalidated U.S.-EU Safe Harbor framework clauses that were previously relied upon by some PayPal vendors to lawfully transfer personal data of EU citizens to U.S. companies, and PayPal entered into SCCs with those third parties which had previously relied on the U.S.-EU Safe Harbor framework. In July 2016, the U.S. and EU authorities agreed on a replacement for the Safe Harbor framework known as “Privacy Shield.” Both the Privacy Shield framework and SCCs continue to face legal challenges in the European justice system.EEA. To the extent thatwe rely on SCCs, we will potentially need to enter into new contractual arrangements reflecting the Privacy Shield or SCCs are invalidated,updated SCC requirements to avoid limitations on PayPal’s ability to process EEA personal data with third partiesin countries outside of the EEAEEA.
Many jurisdictions in which we operate globally have enacted, or are in the process of enacting, data privacy legislation or regulations aimed at creating and intra-groupenhancing individual privacy rights. For example, numerous U.S. states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and retention of their residents’ personal information. The continued proliferation of privacy laws in the jurisdictions in which we operate is likely to result in a disparate array of privacy rules with its U.S. affiliatesunaligned or conflicting provisions, accountability requirements, individual rights, and national or local enforcement powers, which may subject us to increased regulatory scrutiny and business costs, and could be jeopardized.lead to unintended consumer confusion.
If one or more of our counterparty financial institutions default on their financial or performance obligations to us or fail, we may incur significant losses.
We have significant amounts of cash, cash equivalents, receivables outstanding,are subject to regulatory scrutiny and other investments on deposit or in accounts with banks or other financial institutionsmay be subject to legal proceedings under antitrust and competition laws.
We are subject to scrutiny by various government agencies regarding antitrust and competition laws and regulations in the U.S. and abroad. As partinternationally, including in connection with proposed or implemented business combinations, acquisitions, investments, partnerships, commercial agreements and business practices. Some jurisdictions also provide private rights of action for competitors or consumers to assert claims of anticompetitive conduct. Companies and government agencies have in the past alleged, and may in the future allege, that our actions violate the antitrust or competition laws in the U.S. or other jurisdictions in which we operate or otherwise constitute unfair competition, or that our products and services are used so broadly that otherwise uncontroversial business practices could be deemed anticompetitive. Any claims or investigations, even if without merit, may be costly to defend or respond to, involve negative publicity, and cause substantial diversion of management’s time and effort, and could result in reputational harm, significant judgments, fines and other remedial actions against us, require us to change our business practices, make product or operational changes, or delay or preclude planned transactions, product launches or improvements.
We are regularly subject to general litigation, regulatory scrutiny, and government inquiries.
We are regularly subject to claims, individual and class action lawsuits, arbitration proceedings, government and regulatory investigations, inquiries, actions or requests, and other proceedings alleging violations of laws, rules, and regulations with
respect to competition, antitrust, intellectual property, privacy, data protection, information security, anti-money laundering, counter-terrorist financing, sanctions, anti-bribery, anti-corruption, consumer protection (including unfair, deceptive, or abusive acts or practices), fraud, accessibility, securities, tax, labor and employment, commercial disputes, services, charitable fundraising, contract disputes, escheatment of unclaimed or abandoned property, product liability, use of our currency hedging activities, we enter intoservices for illegal purposes, the matters described in “Note 13—Commitments and Contingencies—Litigation and Regulatory Matters—General Matters” to our consolidated financial statements, and other matters. The number and significance of these disputes and inquiries is expected to continue to increase as our products, services, and business expand in complexity, scale, scope, and geographic reach, including through acquisitions of businesses and technology. Investigations and legal proceedings are inherently uncertain, expensive and disruptive to our operations, and could result in substantial judgments, fines, penalties or settlements, negative publicity, substantial diversion of management’s time and effort, reputational harm, criminal sanctions, or orders that prevent or limit us from offering certain products or services; require us to change our business practices in costly ways, develop non-infringing or otherwise altered products or technologies, or pay substantial royalty or licensing fees; or delay or preclude planned transactions involving derivative financial instruments with various financial institutions. Certain banksor product launches or improvements. Determining legal reserves or possible losses from such matters involves significant estimates and financial institutions are also lenders under our credit facilities.judgments and may not reflect the full range of uncertainties and unpredictable outcomes. We regularly monitor our exposure to counterparty credit risk, and actively manage this exposure to mitigate the associated risk. Despite these efforts, we may be exposed to losses in excess of the riskamount recorded, and such amounts could be material. If any of default by,our estimates and assumptions change or deterioratingprove to have been incorrect, this could have a material adverse effect on our business, financial position, results of operations, or cash flows.
Third parties may allege that we are infringing their patents and other intellectual property rights.
We are frequently subject to litigation based on allegations of infringement or other violations of intellectual property rights. Intellectual property infringement claims against us may result from, among other things, our expansion into new business areas, including through acquisitions of businesses and technology, or new or expanded products and services and their convergence with technologies not previously associated with areas related to our business, products, and services. The ultimate outcome of any allegation or claim is often uncertain and any such claim, with or without merit, may be time-consuming to defend, result in costly litigation, divert management’s time and attention from our business, result in reputational harm, and require us to, among other things, redesign or stop providing our products or services, pay substantial amounts to settle claims or lawsuits, satisfy judgments, or pay substantial royalty or licensing fees.
We may be unable to protect or enforce our intellectual property.
The protection of our proprietary rights, including our trademarks, copyrights, domain names, trade dress, patents and trade secrets, is important to the success of our business. Effective protection of our proprietary rights may not be available in every jurisdiction in which we offer our products and services. Although we have generally taken measures to protect our intellectual property, there can be no assurance that we will be successful in protecting or enforcing our rights in every jurisdiction, that our contractual arrangements will prevent or deter third parties from infringing or misappropriating our intellectual property, or that third parties will not independently develop equivalent or superior intellectual property rights. We may be required to expend significant time and resources to prevent infringement and enforce our rights, and we may be unable to discover or determine the extent of any unauthorized use of our proprietary rights. If we are unable to prevent third parties from infringing or otherwise violating our proprietary rights, the uniqueness and value of our products and services could be adversely affected, the value of our brands could be diminished, and our business could be adversely affected. We expect to continue to license in the future certain of our proprietary rights, such as trademarks or copyrighted material, to others. These licensees may take actions that diminish the value of our proprietary rights or harm our reputation. Any failure to adequately protect or enforce our proprietary rights, or significant costs incurred in doing so, could diminish the value of our intangible assets and materially harm our business.
BUSINESS AND OPERATIONS RISKS
We face substantial and increasingly intense competition worldwide in the global payments industry.
The global payments industry is highly competitive, dynamic, highly innovative, and increasingly subject to regulatory scrutiny and oversight. Many of the areas in which we compete evolve rapidly with innovative and disruptive technologies, shifting user preferences and needs, price sensitivity of merchants and consumers, and frequent introductions of new products and services. Competition also may intensify as new competitors emerge, businesses enter into business combinations and partnerships, and established companies in other segments expand to become competitive with various aspects of our business.
We compete with a wide range of businesses in every aspect of our business. Some of our current and potential competitors are or may be larger than we are, have larger customer bases, greater brand recognition, longer operating resultshistories, a dominant or more secure position, broader geographic scope, volume, scale, resources, and market share than we do, or offer products and
services that we do not offer. Other competitors are or may be smaller or younger companies that may be more agile in responding to regulatory and technological changes and customer preferences. Our competitors may devote greater resources to the development, promotion, and sale of products and services, and/or offer lower prices or more effectively offer their own innovative programs, products, and services. We often partner with other businesses, and the ability to continue establishing these partnerships is important to our business. Competition for relationships with these partners is intense, and there can be no assurance that we will be able to continue to establish, grow, or maintain these partner relationships. If we are unable to differentiate our products and services from those of our competitors, drive value for our customers, or effectively and efficiently align our resources with our goals and objectives, we may not be able to compete effectively. See “Item 1. Business—Competition” of this Form 10-K for further discussion of the competitive environment in the markets where we operate.
Changes to payment card networks or bank fees, rules, or practices could harm our business.
To process certain transactions, we must comply with applicable payment card, bank or other network (collectively, “network”) rules. The rules govern all aspects of a transaction on the networks, including fees and other practices. From time to time, the networks have increased the fees and assessments that they charge for transactions that access their networks. Certain networks have also imposed special fees or assessments for transactions that are executed through a digital wallet such as the one that PayPal offers. Our payment processors may have the right to pass any increases in fees and assessments on to us and to increase their own fees for processing. Any increase in interchange fees, special fees, or assessments for transactions that we pay to the networks or our payment processors could make our pricing less competitive, increase our operating costs, and reduce our operating income, which could materially harm our business, financial condition, and results of operations.
In some jurisdictions, government regulations have required payment card networks to reduce or failurecap interchange fees. Any changes in interchange fee rates or limitations, or their applicability to PayPal, could adversely affect our competitive position against payment card service providers and the revenue we earn from our branded card programs, require us to change our business practices, and harm our business.
We may also be subject to fines and other penalties assessed by networks resulting from any rule violations by us or our merchants. The networks set and interpret their rules and have alleged from time to time that various aspects of our business model violate these counterparty financial institutions. The risk of counterparty default, deterioration,rules. Such allegations may result in significant fines, penalties, damages, or failureother liabilities or require changes in our business practices that may be heightened during economic downturnscostly and periods of uncertainty in the financial markets. If one ofadversely affect our counterparties were to become insolvent or file for bankruptcy, our ability to recover losses incurred as a result of default or to access or recover our assets that are deposited, held in accounts with, or otherwise due from, such counterparty may be limited by the counterparty’s liquidity or the applicable laws governing the insolvency or bankruptcy proceedings. In the event of default or failure of one or more of our counterparties, we could incur significant losses, which could negatively impact ourbusiness, results of operations and financial condition. The network rules may also increase the cost of, impose restrictions on, or otherwise impact the development of, our products which may negatively affect product deployment and adoption. The networks could adopt new operating rules or interpret or re-interpret existing rules that we or our payment processors might find difficult or impractical to follow, or costly to implement, which could require us to make significant changes to our products, increase our operational costs, and negatively impact our business. If we become unable or limited in our ability to accept certain payment types such as debit or credit cards, our business would be materially and adversely affected.
Changes in how consumers fund their PayPal transactions could harm our business.
We pay transaction fees when consumers fund payment transactions using credit cards, lower fees when consumers fund payments with debit cards, and nominal fees when consumers fund payment transactions by electronic transfer of funds from bank accounts, from an existing PayPal account balance or Venmo account balance, or through our PayPal branded consumer credit products. Our financial performance is sensitive to changes in the rate at which our consumers fund payments using payment cards, which can significantly increase our costs. Although we provide consumers in certain markets with the opportunity to use their existing PayPal account balance or Venmo account balance to fund payment transactions, some of our consumers may prefer to use payment cards, which may offer features and benefits not provided as part of their PayPal accounts. Any increase in the portion of our payment volume funded using payment cards or in fees associated with our funding mix, or other events or developments that make it more difficult or costly for us to fund transactions with lower-cost funding options, could materially and adversely affect our financial performance and significantly harm our business.
Our ability to receive the benefit of U.S. merchant financing offerings and certain U.S. installment loan products may be subject to challenge.
Merchant loans under our U.S. PayPal Working Capital (“PPWC”) and PayPal Business Loan (“PPBL”) products and certain U.S. installment loan products are provided by a state-chartered industrial bank under a program agreement with us, and we acquire the receivables generated by those loans from the state-chartered bank after origination. In June 2020, the Federal Deposit Insurance Corporation (“FDIC”) approved a final rule clarifying that loans validly originated by state-chartered banks or licensed lenderinsured branches of foreign banks remain valid throughout the lifetime of the loan, reflecting a similar rule finalized by the Office of the Comptroller of Currency (“OCC”) in May 2020 for nationally chartered banks. The final rule reaffirms and
codifies the so-called “valid-when-made doctrine,” which provides that the permissibility of an interest rate for a loan is determined when the loan is made and will not be affected by subsequent events such as sale, assignment, or other transfer. While a number of state attorneys general have unsuccessfully challenged these FDIC and OCC rules, there remains some uncertainty whether non-bank entities purchasing loan receivables originated by FDIC-insured, state-chartered banks may rely on federal preemption of state usury laws and other state laws. An adverse outcome of these or similar challenges, or changes to applicable laws and regulations or regulatory policy, could materially impact our U.S. PPWC, PPBL, certain installment products, and our business.
Our credit products expose us to additional risks.
We offer credit products to a wide range of consumers and merchants in the U.S. and relies upon third partiesvarious international markets. The financial success of these products depends largely on the effective management of related risk. The credit decision-making process for our consumer credit products uses proprietary methodologies and credit algorithms and other analytical techniques designed to make loansanalyze the credit risk of specific consumers based on, among other factors, their past purchase and providetransaction history with PayPal or Venmo and their credit scores. Similarly, proprietary risk models and other products criticalindicators are applied to assess merchants who desire to use our merchant financing offerings to help predict their ability to repay. These risk models may not accurately predict the creditworthiness of a consumer or merchant due to inaccurate assumptions, including those related to the particular consumer or merchant, market conditions, economic environment, or limited transaction history or other data. The accuracy of these risk models and the ability to manage credit risk related to our business, which raises additional risks.
As PayPal is neither a chartered financial institution, nor licensed to make loanscredit products may also be affected by legal or regulatory requirements, changes in any stateconsumer behavior, changes in the U.S., weeconomic environment, issuing bank policies, and other factors.
We generally rely on third-party charteredthe activities and charters of unaffiliated financial institutions to provide PayPal and Venmo branded consumer credit productsand merchant financing offerings to our customers inU.S. customers. As a service provider to these unaffiliated financial institutions, which are federally supervised U.S. financial institutions, we are subject from time to time to examination by their federal banking regulators. In the U.S., including consumer credit products such as PayPal Credit, PayPal branded credit cards, and merchant credit products such as PayPal Working Capital and PayPal Business Loan products. Anyevent of any termination or interruption in a partner bank’s ability or willingness to lend, could interrupt or limit our ability to offer consumer credit and merchant creditfinancing products could be interrupted or limited, which could materially and adversely affect our business. In the event of a partner bank’s inability or unwillingness to lend, weWe may be unable to reach a similar agreementarrangement with another charterunaffiliated financial institution on favorable terms or at all. Obtaining a bank charter orand maintaining the lending licenses required for us to originate such loans ourselves would be a costly, time-consuming and uncertain process, and would subject us to additional laws and regulatory requirements, which could significantly increase our costs and compliance obligations and require us to change our business practices, which could materially and adversely affect our business. In addition, as a service provider to these bank partners, which are federally supervised U.S. financial institutions, wepractices.
We are subject from time to time to examination by their federal banking regulators.
In July 2018, we completed the sale of our U.S. consumer credit receivables portfolio to Synchrony Bank. As a part of a separate agreement, PayPal earns a revenue share on the portfolio of consumer receivables owned by Synchrony Bank, which includes both the sold and newly generated receivables, and we do not hold an ownership interest in newly generated consumer credit receivables. It may take us longer than expected to realize the anticipated benefits of the transaction, and those benefits may ultimately be smaller than anticipated or may not be realized at all, which could adversely affect our business and operating results. In addition, our increased reliance on, and credit exposure to, Synchrony Bank, including in connection with this agreement, subjects us to risks in the nature of those discussed in this “Risk Factors” section under the captions “We rely on third parties in many aspects of our business, which creates additional risk” and “If one or more of our counterparty financial institutions default on their financial or performance obligations to us or fail, we may incur significant losses.”
Our ability to receive the benefit of our business finance offerings may be subject to challenge.
Merchant loans and advances under our PayPal Working Capital and PayPal Business Loan products are provided by a state chartered industrial bank under a program agreement with us. We acquire the receivables generated by those loans after origination.
A case decided in the U.S. Court of Appeals for the Second Circuit, Madden v. Midland Funding, LLC (786 F.3d 246 (2d Cir. 2015)), resulted in uncertainty as to whether non-bank entities purchasing loans originated by a bank may rely on federal preemption of state usury laws, and may create an increased risk of litigation by plaintiffs challenging our ability to collect interest and fees in accordance with the terms of certain loans. The decision, which specifically addressed preemption under the National Bank Act, could support future challenges to federal preemption for other institutions, including FDIC-insured, state chartered industrial banks like the issuing bank of loans and advances under PayPal Working Capital and PayPal Business Loan products. There continue to be a number of U.S. state and federal court legal actions challenging the viability of business models where a non-bank entity enters into a relationship with a third-party chartered financial institution for the issuance of credit products. While we believe the manner in which PayPal branded credit products are offered can be distinguished from Madden, there can be no assurance as to the outcome of any potential litigation, and an adverse determination could materially impact our PayPal Working Capital and PayPal Business Loan products and our business.
Some of our credit products expose us to additional risks.
We offer our PayPal Credit consumer product and our PayPal Working Capital and PayPal Business Loan products to a wide range of consumers and merchants in various markets, and the financial success of these products depends on the effective management of related risk. The credit decision-making process for the PayPal Credit consumer product uses proprietary segmentation and credit algorithms and other analytical techniques designed to analyze the credit risk of specific consumers based on, among other factors, their past purchasing and payment history with PayPal as well as their credit scores. Similarly, proprietary risk models and other indicators are applied to assess merchants who desire to use our business finance offerings to help predict their ability to repay. These risk models may not accurately predict the creditworthiness of a consumer or merchant due to factors such as inaccurate assumptions, including assumptions related to the particular consumer or merchant, market conditions, economic environment, or limited transaction history or other data, among other factors. The accuracy of these risk models and the ability to manage credit risk related to our credit products may also be affected by legal or regulatory requirements, competitors’ actions, changes in consumer behavior, changes in the economic environment, and other factors. Our international expansion of our credit product offerings expose us to additional risks, including those discussed in the risk factor captioned “Our international operations subject us to increased risks, which could harm our business.”
Like other businesses with significant exposure to losses from merchant credit, we face the risk that account holders who use our credit products will default on their payment obligations, creating the risk of potential charge-offs. We face similar riskscharge-offs or negatively impacting the revenue share arrangement with an independent chartered financial institution with respect to our U.S. consumer credit losses through the profit-sharing arrangement with Synchrony Bank.product. The non-payment rate among account holders may increase due to, among other factors, changes to underwriting standards, risk models not accurately predicting the creditworthiness of a consumer,user, worsening economic conditions, such as a recession or government austerity programs, increases in prevailing interest rates, and high unemployment rates. Account holders who miss payments often fail to repay their loans, and account holders who file for protection under the bankruptcy laws generally do not repay their loans.
We currently purchase receivables related to the PayPal brandedour U.S. PayPal-branded merchant financing offerings and certain U.S. consumer installment loan products and extend credit for our consumer and merchant products inoutside the U.S. through our international subsidiaries. If we are unable to fund our credit products or the purchase of thesethe receivables related to our credit products and offerings adequately or in a cost-effective manner, orthe growth of our credit products could be negatively impacted.
We rely on third parties in many aspects of our business, which creates additional risk.
We rely on third parties in many aspects of our business, including networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions; unaffiliated third-party lenders to originate our U.S. credit products to consumers, U.S. merchant financing, and branded credit card products; branded debit card and savings products issued by unaffiliated banks; cryptocurrency custodial service providers; and external business partners and contractors who provide key functions (e.g., outsourced customer support and product development functions; facilities; information technology, data center facilities and cloud computing). We are subject to additional risks inherent in engaging and relying upon third-party providers, including legal, regulatory, information security, reputational and operational risks. We are undertaking efforts to diversify our reliance on a small number of third-party payment processors in various markets. We are working with our primary payment processor in the U.S. to facilitate the migration of our arrangements to other payment processors over a transition period in connection with the wind-down of our agreement; however, if we are unable to timely and efficiently manage the cash resources utilized for these purposes,migrate our business to other payment processors or experience disruptions in connection with this transition, our business could be harmed. If we are unable to effectively manage our third-party relationships, these third parties are unable to
meet their obligations to us, or geopolitical conditionswe experience substantial disruptions in these relationships, our operations, results of operations, and financial results could be adversely impacted. Additionally, our relationships with third parties inherently involve a lesser degree of control over business operations, governance, and compliance, which potentially increases our financial, legal, reputational, and operational risk.
Any factors that reduce cross-border trade or make such trade more difficult could harm our business.
Cross-border trade (i.e., transactions where the merchant and consumer are in different countries) is an important source of our revenues and profits. Cross-border transactions generally provide higher revenues and operating income than similar transactions that take place within a single country or market. In certain markets, cross-border trade represents our primary (and in some instances our only) presence.
Cross-border trade may disruptbe negatively impacted by various factors including foreign currency exchange rate fluctuations, tariffs, trade barriers or restrictions, sanctions, import or export controls, and the interpretation and application of laws of multiple jurisdictions in the context of cross-border trade and foreign exchange. Any factors that increase the costs of cross-border trade for us or our customers or that restrict, delay, or make cross-border trade more difficult or impractical could reduce our cross-border transactions and volume, negatively impact our revenues and profits, and harm our business.
Failure to deal effectively with fraud, abusive behaviors, bad transactions, and negative customer experiences may increase our loss rate and could negatively impact our business and severely diminish merchant and consumer confidence in and use of our services.
War, terrorism, political events, geopolitical instability, trade barriersWe expect that third parties will continue to attempt to abuse access to and restrictions, public health issues, natural disasters,misuse our payments services to commit fraud by, among other things, creating fictitious PayPal accounts using stolen or other catastrophic events have caused and could cause damagesynthetic identities or disruptionpersonal information, making transactions with stolen financial instruments, abusing or misusing our services for financial gain, or fraudulently inducing users of our systems into engaging in fraudulent transactions. Due to the economynature of PayPal’s digital payments services, third parties may seek to engage in abusive schemes or fraud attacks that are often difficult to detect and commerce onmay be deployed at a global, regional,scale that would otherwise not be possible in physical transactions. Measures to detect and reduce the risk of fraud and abusive behavior are complex, require continuous improvement, and may not be effective in detecting and preventing fraud, particularly new and continually evolving forms of fraud or country-specific basis, which could have a material adverse effect onin connection with new or expanded product offerings. If these measures are not effective, our business could be negatively impacted. We also incur substantial losses from erroneous transactions and situations where funding instruments used for legitimate transactions are closed or have insufficient funds to satisfy payments, or the payment is initiated to an unintended recipient in error. Numerous and evolving fraud schemes and misuse of our customers,payments services could subject us to significant costs and companies with which we do business. Such events could decrease demand forliabilities, require us to change our business practices, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, or make it difficult or impossible for us to deliver productsdamage our reputation and services to our customers. Geopolitical trends, including nationalism, protectionism, and restrictive visa requirements could limitbrands, divert the expansionattention of management from the operation of our business, in those regions. Our corporate headquarters are located in the Silicon Valley, which is a seismically active region in California. Our business operations are subject to interruption by, among others, natural disasters, fire, power shortages, earthquakes, floods, nuclear power plant accidents, and events beyond our control such as other industrial accidents, terrorist attacks and other hostile acts, labor disputes and public health issues. A catastrophic event that results in a disruption or failure of our systems or operations could result in significant losses and require substantial recovery time and significant expenditures in order to resumecompensation or maintain operations, which could have a material adverse impact on our business, financial condition, and results of operations.
Changescontractual penalties from us to our buyercustomers and seller protection programs could increase our loss rate.their business partners as a result of losses or claims.
Our buyerPurchase and seller Seller Protection Programs (“protection programs protectprograms”) are intended to reduce the likelihood of losses for consumers and merchants from unauthorized and fraudulent transactions. The Purchase Protection Program also protects consumers from fraudulent transactions, and protect consumers if theywho do not receive the item ordered or if thewho receive an item receivedthat is significantly different from its description. We incur substantial losses from our protection programs as a result of disputes filed by our customers. We seek to recover losses from our protection programs from the merchant, but may not be able to fully recover our losses (for example, if the merchant is unwilling or unable to pay, the transaction involves a fraudulent merchant, or the merchant provides sufficient evidence that the item was delivered).
In addition, consumers who pay through PayPal or Venmo may have reimbursement rights from their payment card issuer, (usually a bank), which in turn will seek recovery from us. The risk ofIf losses fromincurred by us related to payment card transactions become excessive, we could lose the ability to accept payment cards for payment, which would negatively impact our buyerbusiness. Regulators and seller protection programs are specific to individual buyers, sellers, and transactions, andcard networks may also be impacted by regional variationsadapt error resolution and chargeback requirements to these programs, modificationsaccount for evolving forms of fraud, which could increase PayPal’s exposure to these programs resulting from changes in regulatory requirements, or changes that we decide to implement, such as expandingfraud losses and impact the scope of transactions covered by one or morecoverage of theseour protection programs. Increases in our loss rate, including as a result of changes to the scope of transactions covered by our buyer and seller protection programs, could negatively impact our business. See “Note 13—Commitments and Contingencies—Protection Programs” to our consolidated financial statements.
Failure to effectively monitor and evaluate the financial condition of our merchants may expose PayPal to losses. In the event of the bankruptcy, insolvency, business failure, or other business interruption of a merchant that sells goods or services in advance of the date of their delivery or use (e.g., airline, cruise, or concert tickets, custom-made goods, and subscriptions), we could be liable to the buyers of such goods or services, including through our Purchase Protection Program or through chargebacks on
payment cards used by customers to fund their purchase. Allowances for transaction losses that we have established may be insufficient to cover incurred losses.
Use of our payments services for illegal activities or improper purposes could harm our business.
We expect that users will continue to attempt to use our payments platform for illegal activities or improper uses, including money laundering, terrorist financing, sanctions evasion, illegal online gambling, fraudulent sales of goods or services, illegal telemarketing activities, illegal sales of prescription medications or controlled substances, piracy of software, movies, music, and other copyrighted, trademarked or digital goods, bank fraud, child pornography, human trafficking, prohibited sales of alcoholic beverages or tobacco products, securities fraud, pyramid or Ponzi schemes, or the facilitation of other illegal or improper activity. Moreover, certain activity that may be legal in one jurisdiction may be illegal in another jurisdiction, and a merchant may be found responsible for intentionally or inadvertently importing or exporting illegal goods, resulting in liability for us. Owners of intellectual property rights or government authorities may seek to bring legal action against providers of payments solutions, including PayPal, that are peripherally involved in the sale of infringing or allegedly infringing items by a user. While we invest in measures intended to prevent and detect illegal activities that may occur on our payments platform, these measures require continuous improvement and may not be effective in detecting and preventing illegal activity or improper uses.
Any illegal or improper uses of our payments platform or failure by us to detect or prevent illegal or improper activity by our users may subject us to claims, individual and class action lawsuits, and government and regulatory requests, inquiries, or investigations that could result in liability, restrict our operations, impose additional restrictions or limitations on our business or require us to change our business practices, harm our reputation, increase our costs, and negatively impact our business.
Acquisitions, strategic investments, and other strategic transactions could result in operating difficulties and could harm our business.
We expect to continue to consider and evaluate a wide array of potential strategic transactions as part of our overall business strategy, including business combinations, acquisitions, and dispositions of certain businesses, technologies, services, products, and other assets; strategic investments; and commercial and strategic partnerships (collectively, “strategic transactions”). At any given time, we may be engaged in discussions or negotiations with respect to one or more strategic transactions, any of which could, individually or in the aggregate, be material to our financial condition and results of operations. There can be no assurance that we will be successful in identifying, negotiating, consummating and integrating favorable transaction opportunities. Strategic transactions may involve additional significant challenges, uncertainties, and risks, including challenges of integrating new employees, products, systems, technologies, operations, and business cultures; challenges associated with operating acquired businesses in markets or business areas in which we may have limited or no experience; disruption of our ongoing operations and diversion of our management’s attention; inadequate data security, cybersecurity, or operational and information technology resilience; failure to identify, or our underestimation of, commitments, liabilities, deficiencies and other risks associated with acquired businesses or assets; potential exposure to new or incremental risks associated with acquired businesses and entities, strategic investments and other strategic transactions, including potential new or increased regulatory oversight and uncertain or evolving legal, regulatory, and compliance requirements, particularly with respect to companies in new or developing businesses or industries; failure of the transaction to advance our business strategy or for its anticipated benefits to materialize; potential impairment of goodwill or other acquisition-related intangible assets; and the potential for our acquisitions to result in dilutive issuances of our equity securities or the incurrence of significant additional debt. Strategic transactions are inherently risky, may not be successful, and may harm our business, results of operations, and financial condition.
Strategic investments in which we have a minority ownership stake inherently involve a lesser degree of influence over business operations. The success of our strategic investments may be dependent on controlling shareholders, management, or other persons or entities that may have business interests, strategies, or goals that are inconsistent with ours. Business decisions or other actions or omissions of the controlling shareholders, management, or other persons or entities who control companies in which we invest may adversely affect the value of our investment, result in litigation or regulatory action against us, and damage our reputation.
Our international operations subject us to increased risks, which could harm our business.
Our international operations have generated approximatelygenerate roughly one-half of our net revenues in recent years. There arerevenues. Our international operations subject us to significant challenges, uncertainties, and risks, inherent in doing business internationally on both a domestic (i.e., in-country) and cross-border basis, including but not limited to:
| |
• | foreign currency exchange and cross-border trade risks discussed earlier in this “Risk Factors” section under the captions “We are exposed to fluctuations in foreign currency exchange rates that could materially and adversely affect our financial results” and “Any factors that reduce cross-border trade or make such trade more difficult could harm our business”;
|
risks related to government regulation or required compliance with local laws;
local licensing and reporting obligations;
local regulatory, licensing, reporting, and legal obligations related to privacy, data protection, data localization, and user protections;
obligations; costs and challenges associated with localizing our products and services, including offering customers the ability to transact business in the local currency and adapting our products and services to local preferences (e.g., payment methods),operating in markets in which we may have limited or no experience;
trade barriersexperience, including effectively localizing our products and changes in trade regulations;
services and adapting them to local preferences; difficulties in developing, staffing, and simultaneously managing
a large number of varying foreign operations as a result of distance, language, and cultural differences;
stringent local labordifferences and in light of varying laws, regulations, and regulations;
credit riskcustoms; differing employment practices and higher levelsthe existence of payment fraud;
works councils; difficulties in recruiting and retaining qualified employees and maintaining our company culture; fluctuations in foreign currency exchange rates; exchange control regulations; profit repatriation restrictions;
political potential tariffs, sanctions, fines, or social unrest, economic instability, repression,other trade barriers or human rights issues;
geopolitical instability, natural disasters, public health issues, acts of war, and terrorism;
restrictions; import or export regulations;
compliance with U.S. laws and foreign laws prohibiting corrupt payments to government officials, such as the Foreign Corrupt Practices Act and the U.K. Bribery Act, and other local anticorruption laws;
compliance with U.S. and foreign laws designed to combat moneyanti-bribery, anti-corruption, sanctions, anti-money laundering and counter-terrorist financing laws and regulations; the financinginterpretation and application of terrorist activities;
antitrustlaws of multiple jurisdictions; and competition regulations;
potentially adverse tax developments and consequences;
economic uncertainties relating to sovereign and other debt;
national or regional differencespolitical, economic, or social instability.
Our international operations also may heighten many of the other risks described in macroeconomic growth rates; and
increased difficulties in collecting accounts receivable.
Violationsthis “Risk Factors” section. Any violations of the complex foreign and U.S. laws, rules and regulations that may apply to our international operations may result in fines,lawsuits, enforcement actions, criminal actions, or sanctions against us and, our directors, officers, and employees; prohibit or require us to change our employees; prohibitions on the conduct of our business;business practices; and damage to our reputation. Although we have implemented policies and procedures designed to promote compliance with these laws, there can be no assurance that our employees, contractors, or agents will not violate our policies. These risks are inherent in our international operations, and expansion, may increase our costs of doing business internationally, and could materially and adversely affect our business.
Global and regional economic conditions could harm our business.
We are exposedAdverse global and regional economic conditions such as turmoil affecting the banking system or financial markets, including, but not limited to, tightening in the credit markets, extreme volatility or distress in the financial markets (including the fixed income, credit, currency, equity, and commodity markets), higher unemployment, high consumer debt levels, recessionary or inflationary pressures, supply chain issues, reduced consumer confidence or economic activity, government fiscal and tax policies, U.S. and international trade relationships, agreements, treaties, tariffs and restrictive actions, the inability of a government to enact a budget in a fiscal year, government shutdowns, government austerity programs, and other negative financial news or macroeconomic developments could have a material adverse impact on the demand for our products and services, including a reduction in the volume and size of transactions on our payments platform. Additionally, any inability to access the capital markets when needed due to volatility or illiquidity in the markets or increased regulatory liquidity and capital requirements may strain our liquidity position. Such conditions may also expose us to fluctuations in foreign currency exchange rates or interest rates.rates that could materially and adversely affect our financial results.
If our reputation or our brands are damaged, our business and operating results may be harmed.
Our reputation and brands are globally recognized, important to our business, and affect our ability to attract and retain our customers. There are numerous ways our reputation or brands could be damaged. We may experience scrutiny or backlash from customers, partners, employees, government entities, media, advocacy groups, and other influencers or stakeholders that disagree with, among other things, our product offering decisions or public policy positions. Damage to our reputation or our brands may result from, among other things, new features, products, services, operational efforts, or terms of service (or changes to the same), or our decisions regarding user privacy, data practices, or information security. The proliferation of social media may increase and compound the likelihood, speed, magnitude, and unpredictability of negative brand events. If our brands or reputation are damaged, our business and operating results may be adversely impacted.
Brexit: The U.K.’s departure from the EU could harm our business, financial condition, and results of operations.
Following the departure of the U.K. from the EU and the EEA on January 31, 2020 (commonly referred to as “Brexit”) and the expiration of the transition period on December 31, 2020, there continues to be uncertainty over the practical consequences of Brexit, including the potential for greater restrictions on the supply and availability of goods and services between the U.K. and EEA region, and a general deterioration in consumer sentiment and credit conditions leading to overall negative economic growth and increased risk of merchant default.
The consequences of Brexit have brought legal uncertainty and increased complexity for financial services firms, which could continue as national laws and regulations in the U.K. differ from EU laws and regulations and additional authorization requirements come into effect. These developments have led and could lead in the future to additional regulatory costs and challenges for us. Specifically, PayPal (Europe) currently operates in the U.K. within the scope of its passport permissions (as they existed at the end of the transition period) pursuant to the Temporary Permissions Regime pending the grant of new authorizations by the U.K. financial regulators. If we are unable to obtain the required authorizations before the expiry of the longstop dates set by the U.K. regulators under the Temporary Permissions Regime, our European operations could lose their ability to offer services within the U.K. market, or into the U.K. market on a cross-border basis.Our European operations may
also be required to comply with legal and regulatory requirements in the U.K. that may be in addition to, or inconsistent with, those of the EEA, in each case, leading to increased complexity and costs.
Real or perceived inaccuracies in our key metrics may harm our reputation and negatively affect our business.
Our key metrics are calculated using internal company data based on the activity we measure on our payments platform and compiled from multiple systems, including systems that are internally developed or acquired through business combinations. While the measurement of our key metrics is based on what we believe to be reasonable methodologies and estimates, there are inherent challenges and limitations in measuring our key metrics globally at scale. The methodologies used to calculate our key metrics require judgment.
We are exposedregularly review our processes for calculating these key metrics, and from time to interest rate risktime we may make adjustments to improve the accuracy or relevance of our metrics. For example, we continuously apply models, processes and practices designed to detect and prevent fraudulent account creation on our platforms, and work to improve and enhance those capabilities. When we detect a significant volume of illegitimate activity, we generally remove the activity identified from our investment portfoliokey metrics. Although such adjustments may impact key metrics reported in prior periods, we generally do not update previously reported key metrics to reflect these subsequent adjustments unless the retrospective impact of process improvements or enhancements is determined by management to be material. Further, as our business develops, we may revise or cease reporting metrics if we determine that such metrics are no longer appropriate measures of our performance. If investors, analysts, or customers do not consider our reported measures to be sufficient or to accurately reflect our business, we may receive negative publicity, our reputation may be harmed, and from interest-rate sensitive assets, including assets underlying the customer balances we hold on our balance sheet as customer accounts. A low or negative interest rate environment or reductions in interest ratesbusiness may negatively impact our net income. In addition, fluctuations in interest ratesbe adversely impacted.
Environmental, social and governance (“ESG”) issues may adversely impact our customers’ spending levels and ability and willingness to pay outstanding amounts owed to us. Higher interest rates often lead to higher payment obligations by customers to us and other lenders under mortgage, credit card, and other consumer and merchant loans, which may reduce our customers’ ability to remain current on their obligations to us and therefore lead to increased delinquencies, charge-offs, and allowances for loan and interest receivables, which could have an adverse effect on our net income.business, financial condition and results of operations and damage our reputation.
Customers, investors, employees and other stakeholders are increasingly focused on ESG practices, including with respect to global talent, cybersecurity, data privacy and protection and climate change. If we do not adapt to and comply with new laws and regulations or changes to legal or regulatory requirements concerning ESG matters, or fail to meet rapidly evolving investor, industry or stakeholder expectations and standards, our reputation may be harmed, customers may choose to refrain from using our products and services, and our business or financial condition may be adversely affected. Further, we may experience additional scrutiny or backlash from customers, partners, media, government entities, and other stakeholders that disagree if they perceive PayPal to not have responded appropriately with respect to ESG matters.
We specifically recognize the inherent physical climate-related risks wherever business is conducted. Our primary locations may be vulnerable to the adverse effects of climate change. For example, California, where our headquarters are located, has historically experienced, and is projected to continue to experience, climate-related events more frequently, including drought, water scarcity, flooding, heat waves, wildfires and resultant air quality impacts, and power shutoffs associated with wildfire prevention. These extreme weather conditions may disrupt our business and may cause us to experience additional costs to maintain or resume operations and higher attrition. In addition, current and emerging legal and regulatory requirements with respect to climate change (e.g., carbon pricing) and other aspects of ESG (e.g., disclosure requirements) may result in increased compliance requirements on our business and supply chain, which may increase our operating costs and cause disruptions in our operations.
If one or more of our counterparty financial institutions default on their financial or performance obligations to us or fail, we may incur significant losses.
We have entered into a five-year revolving credit facility and a 364-day revolving credit facility as well as other committed and uncommitted credit facilities around the world. We have borrowed under our credit facilities from time to time, and any borrowings under these credit facilities that bear interest at a floating rate would expose us to interest rate fluctuations.
Usesignificant amounts of our payments services for illegal purposes could harm our business.
Our payment system is susceptible to potentially illegal or improper uses, including money laundering, terrorist financing, illegal online gambling, fraudulent sales of goods or services, illegal sales of prescription medications or controlled substances, piracy of software, movies, music,cash, cash equivalents, receivables outstanding, and other copyrightedinvestments on deposit or trademarked goods (in particular, digital goods), bank fraud, child pornography, human trafficking, prohibited sales of alcoholic beveragesin accounts with banks or tobacco products, securities fraud, pyramid or ponzi schemes, or the facilitation of other illegal activity. The use of our payment system for illegal or improper uses has subjected us, and may subject us in the future, to claims, individual and class action lawsuits, and government and regulatory investigations, inquiries, or requests that could result in liability and reputational harm for us. Moreover, certain activity that may be legal in one jurisdiction may be illegal in another jurisdiction, and a merchant may be found responsible for intentionally or inadvertently importing or exporting illegal goods, resulting in liability for us. Changes in law have increased the penalties for intermediaries providing payment services for certain illegal activities, and government authorities may consider additional payments-related proposals from time to time. Owners of intellectual property rights or government authorities may seek to bring legal action against providers of payments solutions, including PayPal, that are peripherally involved in the sale of infringing or allegedly infringing items. Any threatened or resulting claims could result in reputational harm, and any resulting liabilities, loss of transaction volume, or increased costs could harm our business.
Our failure to manage our customer funds and the assets underlying our customer funds properly could harm our business.
We hold a substantial amount of funds belonging to our customers, including balances in customer accounts and funds being remitted to sellers of goods and services or recipients of P2P transactions. In certain jurisdictions where we operate, we are required to hold eligible liquid assets (as defined by the relevant regulator in such jurisdiction) equal to at least 100% of the aggregate amount of all customer balances. Our ability to manage and accurately account for the assets underlying our customer funds and comply with applicable liquid asset requirements requires a high level of internal controls. As our business continues to grow and we expand our product offerings, we must continue to strengthen our associated internal controls. PayPal (Europe), with the permission of the CSSF, utilizes certain European customer balances held by our Luxembourg banking subsidiary to fund credit balances relating to certain customers. Our success requires significant public confidence in our ability to properly manage our customers’ balances and handle large and growing transaction volumes and amounts of customer funds. Any failure to maintain the necessary controls or to manage our customer funds and the assets underlying our customer funds accurately and in compliance with applicable regulatory requirements could result in reputational harm, lead customers to discontinue or reduce their use of our products, and result in significant penalties and fines and additional restrictions, which could materially harm our business.
We are subject to regulatory activity and legal proceedings under antitrust and competition laws.
We are subject to scrutiny by various government agencies regarding antitrust and competition laws and regulationsfinancial institutions in the U.S. and internationally, including in connectioninternational jurisdictions. As part of our foreign currency hedging activities, we regularly enter into transactions involving derivative financial instruments with proposed business combinations, acquisitions,various financial institutions. Certain banks and investments. Some jurisdictionsother financial institutions are also provide private rights of action for competitors or consumerslenders under our credit facilities. We regularly monitor our exposure to assert claims of anticompetitive conduct. Other companiescounterparty credit risk, and government agencies have inactively manage this exposure to mitigate the past and may in the future allege that our actions violate the antitrust or competition laws of the U.S., individual states, other countries, or the EU, or otherwise constitute unfair competition. Some regulators and legislators, particularly those outside of the U.S., may perceive that our products and services are used so broadly that otherwise uncontroversial business practices could be deemed anticompetitive. Any claims or investigations, even if without merit,associated risk. Despite these efforts, we may be very expensive to defend or respond to, involve negative publicity, and substantial diversion of management time and effort, and could result in reputational harm, significant judgments, fines or remedial actions against us, or require us to change our business practices, make product or operational changes, or delay or preclude planned transactions, product launches or improvements.
We are subject to patent litigation.
We have been sued repeatedly for allegedly infringing other parties’ patents. At any given time, we are typically a defendant in a number of patent lawsuits. We expect that we will continue to be subject to patent infringement claims because, among other reasons:
our products and services continue to expand in scope and complexity and to converge with technologies not previously associated with the payments space;
we continue to expand into new business areas, including through acquisitions; and
the number of patent owners who may claim that we, any of the companies that we have acquired, or our customers infringe their patents, and the aggregate number of patents controlled by such patent owners, continues to increase.
Such claims may be brought directly against us or against our users, whom we may indemnify due to contractual obligations or as a business matter. We believe that many of the claims against us and other technology companies have been, and continue to be, initiated by third parties whose sole or primary business is to assert such claims. We vigorously defend against patent infringement claims. In addition, we have seen significant patent disputes between operating companies in some technology industries. Patent claims, whether meritorious or not, could be time-consuming, divert management’s resources, be costly to manage, defend, and resolve and lead to attempts by other parties to pursue similar claims. Additionally, patent claims could require us to make expensive changes in our methods of doing business, enter into costly royalty or licensing agreements, make substantial payments to satisfy adverse judgments or settle claims or proceedings, or cease conducting certain operations, which would harm our business.
We may be unable to adequately protect or enforce our intellectual property rights, or third parties may allege that we are infringing their intellectual property rights.
The protection of our intellectual property, including our trademarks, patents, copyrights, domain names, trade dress, and trade secrets, is importantexposed to the successrisk of our business. We seek to protect our intellectual property rightsdefault on obligations by, relying on applicable laws and regulations in the U.S. and internationally, as well as a variety of administrative procedures. We also rely on contractual restrictions to protect our proprietary rights when offering or procuring products and services, including confidentiality and invention assignment agreements entered into with our employees and contractors and confidentiality agreements with parties with whom we conduct business.
Effective intellectual property protection may not be available in every country in which we offer our products and services. We may be required to expend significant time and expense in order to prevent infringement or to enforce our rights.
Although we have generally taken measures to protect our intellectual property rights, there can be no assurance that we will be successful in protecting or enforcing our rights in every jurisdiction, or that contractual arrangements and other steps that we have taken to protect our intellectual property will prevent third parties from infringing or misappropriating our intellectual property or deter independent development of equivalent or superior intellectual property rights by others. If we are unable to prevent third parties from adopting, registering, or using trademarks and trade dress that infringe, dilute, or otherwise violate our trademark rights, the value of our brands could be diminished and our business could be adversely affected. We may not be able to discover or determine the extent of any unauthorized use of our proprietary rights. We have licensed in the past, and expect to license in the future, certain of our proprietary rights, such as trademarks or copyrighted material, to others. These licensees may take actions that diminish the value of our proprietary rights or harm our reputation. Any failure to adequately protect or enforce our intellectual property rights, or significant costs incurred in doing so, could diminish the value of our intangible assets and materially harm our business.
As the number of products in the technology and payments industries increases and the functionality of these products further overlaps, and as we acquire technology through acquisitions or licenses, we may become increasingly subject to intellectual property infringement and other claims. Litigation may be necessary to determine the validity and scope of the patent and other intellectual property rights of others. The ultimate outcome of any allegation is often uncertain and, regardless of the outcome, any such claim, with or without merit, may be time-consuming, result in costly litigation, divert management’s time and attention from our business, and require us to, among other things, redesign or stop providing our products or services, pay substantial amounts to satisfy judgments or settle claims or lawsuits, pay substantial royalty or licensing fees, or satisfy indemnification obligations that we have with certain parties with whom we have commercial relationships. Our failure to obtain necessary license or other rights, or litigation or claims arising out of intellectual property matters, may harm or restrict our business.
We are regularly subject to general litigation, regulatory actions, and government inquiries.
We are regularly subject to claims, individual and class action lawsuits, government and regulatory investigations, inquiries, actions or requests, and other proceedings alleging violations of laws, rules, and regulations with respect to competition, antitrust, intellectual property, privacy, data protection, information security, anti-money laundering, counter-terrorist financing, sanctions, anti-corruption, consumer protection, fraud, accessibility, securities, tax, labor and employment, commercial disputes, services, charitable fundraising, contract disputes, escheatment of unclaimed or abandoned property, the matters described in Note 13—“Commitments and Contingencies—Litigation and Regulatory Matters—General Matters” to our consolidated financial statements, and other matters. In particular, our business faces ongoing consumer protection and intellectual property litigation, as discussed above. The number and significance of these disputes and inquiries may increase as our business expands in scale, scope and geographic reach, and our products and services increase in scale and complexity. In addition, the laws, rules and regulations affecting our business, including those pertaining to internet and mobile commerce, data protection, payments services, and credit, are subject to ongoing interpretation by the courts and government authorities, and the resulting uncertainty in their scope and application increases the risk that we will be subject to private claims and government actions alleging violations.
The scope, outcome, and impact of claims, lawsuits, government investigations, disputes, and proceedings to which we are subject cannot be predicted with certainty. Regardless of the outcome, such matters can have an adverse impact, which may be material, on our business,deteriorating operating results of operations, or financial condition becauseor failure of, legal costs, diversionthese counterparty financial institutions. If one of management resources, reputational damage, and other factors. Determining reservesour counterparty financial institutions were to become insolvent, placed into receivership, or file for bankruptcy, our pending litigation and regulatory proceedings isability to recover losses incurred as a complex, fact-intensive processresult of default or to access or recover our assets that involves a high degreeare deposited, held in accounts with, or otherwise due from, such counterparty may be limited due to the insufficiency of judgment. Resolvingthe failed institutions’ estate to satisfy all claims in full or the applicable laws or regulations governing the insolvency, bankruptcy, or resolution proceedings. In the event of default on obligations by, or the failure of, one or more of such legal and regulatory proceedings or other mattersthese counterparties, we could potentially require us to make substantial payments to satisfy judgments, fines, or penalties or to settle claims or proceedings, any ofincur significant losses, which could materially and adversely affectnegatively impact our business, results of operations, or financial condition. These proceedings could also result in reputational harm, criminal sanctions, consent decrees, or orders that prevent us from offering certain products or services, require us to change our business practices in costly ways, or develop non-infringing or otherwise altered products or technologies. Any of these consequences could materially and adversely affect our business, results of operations and financial condition.
There are risks associated with our indebtedness.
We have incurred indebtedness, and we may incur additional indebtedness in the future. Our ability to pay interest and repay the principal for our indebtedness is dependent upon our ability to manage our business operations and generate sufficient cash flows to service such debt. Our outstanding indebtedness and any additional indebtedness we incur may have significant consequences, including the need to use a significant portion of our cash flow from operations and other available cash to service our indebtedness, thereby reducing the funds available for other purposes, including capital expenditures, acquisitions, strategic investments, and share repurchases; the reduction of our flexibility in planning for or reacting to changes in our business, competitive pressures and market conditions; and limits on our ability to obtain additional financing for working capital, capital expenditures, acquisitions, strategic investments, share repurchases, or other general corporate purposes.
Our revolving credit facilities and the indentures for our senior unsecured notes pursuant to which certain of our customer agreementsoutstanding debt securities were issued contain arbitration provisions with classfinancial and other covenants that restrict or could restrict, among other things, our business and operations. If we fail to pay amounts due under a debt instrument or breach any of its covenants, the lenders or noteholders would typically have the right to demand immediate repayment of all borrowings thereunder (subject in certain cases to a grace or cure period). Moreover, any such acceleration and required repayment of, or default in respect of, our indebtedness could, in turn, constitute an event of default under other debt instruments, thereby resulting in the acceleration and required repayment of our indebtedness. Any of these events could materially adversely affect our liquidity and financial condition.
Changes by any rating agency to our outlook or credit rating could negatively affect the value of both our debt and equity securities and increase our borrowing costs. If our credit ratings are downgraded or other negative action waiver provisions thatis taken, the interest rates payable by us under our indebtedness may limitincrease, and our exposureability to consumer class action litigation, there can be no assurance that we will be successful in enforcing these arbitration provisions, including the class action waiver provisions,obtain additional financing in the future on favorable terms or in any given case. Legislative, administrative, or regulatory developments may directly or indirectly prohibit or limit the use of pre-dispute arbitration clauses and class action waiver provisions. Any such prohibitions or limitations on or discontinuation of the use of, such arbitration or class action waiver provisionsat all could subject us to additional lawsuits, including additional consumer class action litigation, and significantly limit our ability to avoid exposure from consumer class action litigation.be adversely affected.
Changes in U.S. tax laws, exposure to unanticipated additional tax liabilities, or implementation of reporting or record-keeping obligations could have a material adverse effect on our business, cash flow, resultsbusiness.
An increasing number of operations, and financial conditions.
In December 2017,U.S. states, the U.S. federal government, enacted comprehensive Federal tax legislation commonly referred toand governments of foreign jurisdictions, such as the Tax CutsEU Commission, as well as international organizations, such as the Organization for Economic Co-operation and Jobs Act of 2017 (the “Tax Act”). The Tax Act made changesDevelopment, are focused on tax reform and other legislative or regulatory action to the corporateincrease tax rate, business-related deductions, and taxation of foreign earnings, among others, that are generally effective for taxable years beginning after December 31, 2017. Throughout 2018 and 2019, the U.S. Treasury and certain states issuedrevenue. For example, various countries have proposed and final legislation and clarifying guidance with respect to the various provisions of the Tax Act. Additional legislation and guidance is expected to be issued in 2020 and could have a material adverse impact on the value of our U.S. deferred tax assets, result in significant changes to currently computed income tax liabilities for past and current tax periods, and increase our future U.S. tax expense. The implementation by us of new practices and processes designed to comply with, and benefit from, the Tax Act and its rules and regulations could require us to make substantial changes to our business practices, allocate additional resources, and increase our costs, which could negativelyor enacted digital services taxes. These actions may materially affect our business, results of operations, and financial condition.effective tax rate.
We may have exposure to greater than anticipated tax liabilities.
The determination of our worldwide provision for income taxes and other tax liabilities requires estimation and significant judgment, and there are many transactions and calculations wherefor which the ultimate tax determination is uncertain. Like many other multinational corporations, we are subject to tax in multiple U.S. and foreign tax jurisdictions. Our determination of our tax liability is always subject to audit and review by applicable domestic and foreign authorities, and weWe are currently undergoing a number of investigations, audits, and reviews by tax authorities throughout the world.in multiple U.S. and foreign tax jurisdictions. Any adverse outcome of any such audit or review could have a negative effect on our business, and the ultimate tax outcome mayresult in unforeseen tax-related liabilities that differ from the amounts recorded in our financial statements, andwhich may, individually or in the aggregate, materially affect our financial results in the periods for which such determination is made. While we have established reserves based on assumptions and estimates that we believe are reasonable to cover such eventualities, these reserves may prove to be insufficient.
In addition, our future income taxes could be adversely affected by the incurrence of losses or earnings being lower than anticipated or by the incurrence of losses, in jurisdictions that have lower statutory tax rates, and earnings being higher than anticipated in jurisdictions that have higher statutory tax rates; by changes in the valuation of our deferred tax assets and liabilities, including as a result of gains on our foreign currency exchange risk management program; orby changes in tax laws, regulations, or accounting principles, as well asprinciples; or by certain discrete items.
Various levels of government, such as U.S. federal and state legislatures, and international organizations, such as the Organization for Economic Co-operation and Development (“OECD”) and the EU, are increasingly focused on tax reform and other legislative or regulatory action to increase tax revenue. Various countries, most notably in the EU, have proposed or enacted digital services taxes. Any such tax reform or other legislative or regulatory actions could increase our effective tax rate.
We and our merchants may be subject to sales reporting and record-keeping obligations.
A number of U.S. states, the U.S. federal government, and foreign countriesjurisdictions have implemented or are in the process of implementingand may impose reporting or record-keeping obligations on companies that engage in or facilitate e-commerce to improve tax compliance. Additionally, aA number of jurisdictions are also reviewing whether payment service providers and other intermediaries could be deemed to be the legal agent of merchants for certain tax purposes. We have modified our systems to meet applicable requirements and expect that further modifications will be required to comply with future requirements, which may negatively impact our customer experience and increase operational costs. Any failure by us to comply with these and similar reporting and record-keeping obligations could result in substantial monetary penalties and other sanctions, adversely impact our ability to do business in certain jurisdictions, and harm our business.
Acquisitions, joint ventures, strategic investments, and other strategic transactions could result in operating difficulties and could harm our business.
Acquisitions, joint ventures, strategic investments, and other strategic transactions are important elements of our overall corporate strategy. We expect to continue to evaluate and consider a wide array of potential strategic transactions as part of our overall business strategy, including business combinations, acquisitions, and dispositions of certain businesses, technologies, services, products, and other assets, as well as joint ventures, strategic investments, and commercial and strategic partnerships. These transactions may involve significant challenges, uncertainties, and risks, including:
the potential loss of key customers, vendors, and other key business partners of the companies we acquire, or dispose of, following and continuing after announcement of our transaction plans;
difficulty making strategic hires of new employees, declining employee morale, and retention issues affecting employees (particularly the potential loss of key personnel) of companies that we acquire or dispose of, which may result from changes in compensation, management, reporting relationships, future prospects, or the direction of the acquired or disposed business;
differences between our culture and values and those of our acquired companies;
diversion of management time and focus;
the need to and difficulty of integrating the operations, systems (including accounting, compliance, management, information, human resource, and other administrative systems), technologies, data assets, products, and personnel of each acquired company, which is an inherently risky and potentially lengthy and costly process;
the need to and difficulty of implementing and/or enhancing controls, procedures, and policies appropriate for a larger public company at acquired companies which, prior to the acquisition, may have lacked such controls, procedures, and policies or whose controls, procedures, and policies did not meet applicable legal and regulatory standards;
the inefficiencies and lack of control that may result if integration of acquired companies is delayed or not implemented, and unforeseen difficulties and costs that may arise as a result;
potential exposure to new or increased regulatory oversight and uncertain or evolving legal, regulatory, and compliance requirements associated with new products and services or entry into new markets, including transactions with, or investments in, companies involved in new or developing businesses or industries;
potential reputational risks that could arise from transactions with, or investments in, companies involved in new or developing businesses or industries, which may be subject to uncertain or evolving legal, regulatory, and compliance requirements;
risks associated with our expansion into new international markets, and challenges caused by integrating operations across geographies, and different languages, cultures and political environments;
unidentified issues not discovered in our due diligence process, including, but not limited to, product or service quality issues, intellectual property issues, and legal contingencies;
risks associated with the complexity of entering into and effectively managing joint ventures, strategic investments, and other strategic partnerships;
risks associated with undetected cyberattacks or security breaches at companies that we acquire or with which we may combine or partner;
lawsuits or regulatory actions resulting from the transaction;
liability for activities or conduct of an acquired company before the acquisition, including legal and regulatory claims or disputes, violations of laws and regulations, commercial disputes, tax liabilities, and other known and unknown liabilities;
the need to maintain, and comply with the requirements of licenses for certain companies that we have acquired, and risks associated with any failure to maintain such licenses or comply with associated requirements;
the acquisition of new customer and employee personal data, which in and of itself may require regulatory approval and/or additional controls, policies, and procedures, and subject us to additional exposure and additional complexity and costs of compliance;
potential financial and credit risks associated with acquired customers, vendors, and partners; and
our dependence on the accounting, financial reporting, operating metrics and similar systems, controls and processes of acquired businesses, and the risk that errors or irregularities in those systems, controls, and processes will lead to errors in our financial statements or make it more difficult to manage the acquired business.
At any given time, we may be engaged in discussions or negotiations with respect to one or more strategic transactions, any of which could, individually or in the aggregate, be material to our financial condition and results of operations. There can be no assurance that we will be successful in identifying, negotiating, and consummating favorable transaction opportunities. It may take us longer than expected to fully realize the anticipated benefits and synergies of these transactions, and those benefits and synergies may ultimately be smaller than anticipated or may not be realized at all, which could adversely affect our business and operating results. Because acquisitions are inherently risky, our transactions may not be successful and may, in some cases, harm our operating results or financial condition. Any acquisitions, dispositions, or investments may also require us to issue additional equity securities, spend our cash, or incur debt (and increased interest expense), recognize liabilities, and record gains or losses (realized or unrealized) and amortization expenses related to intangible assets or write-offs of goodwill or intangibles, which could dilute the economic and voting rights of our stockholders and adversely affect our results of operations and the interests of holders of our indebtedness, as applicable.
Joint ventures and strategic investments in which we have a minority ownership stake inherently involve a lesser degree of influence over business operations, thereby potentially increasing the financial, legal, operational, and/or compliance risks associated with the joint venture or strategic investment. In addition, we may be dependent on joint venture partners, controlling shareholders, management, or other persons or entities who control them and who may have business interests, strategies, or goals that are inconsistent with ours. Business decisions or other actions or omissions of the joint venture partners, controlling shareholders, management, or other persons or entities who control joint ventures or companies in which we invest may adversely affect the value of our investment, result in litigation or regulatory action against us, and otherwise damage our reputation and brand.
There are risks associated with our indebtedness.
We have incurred indebtedness, and we may incur additional indebtedness in the future. Our outstanding indebtedness and any additional indebtedness we incur may have significant consequences, including, without limitation, the following:
our ability to pay interest and repay the principal for our indebtedness is dependent upon our ability to manage our business operations and generate sufficient cash flows to service such debt. We may be required to use a significant portion of our cash flow from operations and other available cash to service our indebtedness, thereby reducing the amount of cash available for other purposes, including capital expenditures, acquisitions, and strategic investments;
our indebtedness and leverage may increase our vulnerability to downturns in our business, to competitive pressures, and to adverse changes in general economic and industry conditions;
our ability to obtain additional financing for working capital, capital expenditures, acquisitions, share repurchases, or other general corporate and other purposes may be limited; and
our flexibility in planning for, or reacting to, changes in our business and our industry may be limited.
Our revolving credit facilities and the indenture for our senior unsecured notes pursuant to which certain of our outstanding debt securities were issued contain financial and other covenants that restrict or could restrict, among other things, our business and operations. If we fail to pay amounts due under a debt instrument or breach any of its covenants, the lenders would typically have the right to demand immediate repayment of all borrowings thereunder (subject in certain cases to a grace or cure period). Moreover, any such acceleration and required repayment of, or default in respect of, our indebtedness could, in turn, constitute an event of default under other debt instruments, thereby resulting in the acceleration and required repayment of our indebtedness. Any of these events could materially adversely affect our liquidity and financial condition.
In addition, changes by any rating agency to our outlook or credit rating could negatively affect the value of both our debt and equity securities and increase our borrowing costs. If our credit ratings are downgraded or other negative action is taken, the interest rates payable by us under our indebtedness may increase. In addition, any downgrades to our credit ratings may affect our ability to obtain additional financing in the future and the terms of any such financing. Any of these factors could adversely affect our financial condition and results of operations.
We rely on third parties in many aspects of our business, which creates additional risk.
We rely on third parties in many aspects of our business, including the following:
networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions;
unaffiliated third-party lenders to originate the U.S. PayPal Credit, PayPal-branded credit card, PayPal Working Capital, and PayPal Business Loan products;
third parties that provide loan servicing and customer statements processing;
third parties that provide certain outsourced customer support and product development functions, which are critical to our operations; and
third parties that provide facilities, infrastructure, components, and services, including data center facilities and cloud computing.
Because we rely on third parties to provide certain of our services and to facilitate certain of our business activities, we face increased operational risk. These third parties may be subject to financial, legal, regulatory, and labor issues, cybersecurity incidents, privacy breaches, service terminations, disruptions or interruptions, or other problems, which may impose additional costs or requirements on us or prevent these third parties from providing services to us or our customers on our behalf, which could harm our business. In addition, these third parties may breach their agreements with us, disagree with our interpretation of contract terms or applicable laws and regulations, refuse to continue or renew these agreements on commercially reasonable terms or at all, fail or refuse to process transactions or provide other services adequately, take actions that degrade the functionality of our services, impose additional costs or requirements on us or our customers, or give preferential treatment to competitive services. There can be no assurance that third parties who provide services directly to us or our customers on our behalf will continue to do so on acceptable terms, or at all. If any third parties do not adequately or appropriately provide their services or perform their responsibilities to us or our customers on our behalf, we may be unable to procure alternatives from other third parties in a timely and efficient manner and on acceptable terms, or at all, and we may be subject to business disruptions, losses or costs to remediate any of the deficiencies, customer dissatisfaction, reputational damage, legal or regulatory proceedings, or other adverse consequences which could harm our business.
Our point of sale solutions expose us to additional risks.
We have several point of sale solutions, which enable merchants to accept payments using a payments card reader attached to, or otherwise communicating with, a mobile device or to scan payment cards and codes using the mobile device’s embedded camera, and which enable consumers to use their mobile devices to pay at the point of sale. We have entered into strategic partnerships with major payment card networks to further expand our relationship in a way that will make it easier for merchants to accept and consumers to choose to pay for transactions utilizing credit and debit cards via PayPal at the point of sale. Those agreements provide us with access to each of these partner's tokenization services in the U.S. for in-store point-of-sale PayPal transactions, which we expect will increase the number of point of sale transactions that we process. We believe that the addition of the iZettle point of sale solutions to our product portfolio will enable us to further expand our in-store presence. As we continue to expand our product and service offerings at the point of sale, we will face additional risks, including:
increased expectations from merchants regarding the reliability and availability of our systems and services and correspondingly lower amounts of downtime, which we may not be able to meet;
increased expectations from merchants that our systems and services will help them to comply with laws and regulations relating to tax, accounting, and bookkeeping, such as cash register systems, which we may not be able to meet;
significant competition at the point of sale, particularly from established payment card providers, many of which have substantially greater resources than we do, and from other competing sale channels (such as e-commerce);
increased targeting by fraudsters; given that our fraud models are less developed in this area, we may experience increases in fraud and associated transaction losses as we adjust to potential fraudulent activity at the point of sale;
exposure to product liability claims to the extent that hardware devices (e.g., card readers) that we produce for use at the point of sale malfunction or are not in compliance with laws, which could result in substantial liability and require product recalls or other actions;
constraints in key resources to develop and maintain point of sale software and ancillary hardware;
exposure to additional laws, rules, and regulations;
increased reliance on third parties involved with processing in-store payments, including independent software providers, electronic point of sale providers, hardware providers (such as card reader, cash drawer, and pin-pad providers), payment processors, and banks that enable in-store transactions; and
lower operating income than our other payment solutions.
Unless we are able to successfully manage these risks, including driving adoption of, and significant volume through, our point of sale solutions over time, our business may be harmed.
Our success largely depends on key personnel. Because competition for our key employees is intense, we may not be able to attract, retain, and develop the highly skilled employees we need to support our business. The loss of
Competition for key personnel could harm our ability to maintain and grow our business.
Our future success and performance are significantly dependent upon the continued services of key personnel, including our executive team and other highly skilled employees, and our ability to attract, retain, and motivate such personnel. Competition for key personnel is intense, especially in the San Francisco Bay Area, where our corporate headquarters are locatedfor executive talent, software engineers, and where the cost of living is high, and we may be unable to successfully attract, integrate, or retain sufficiently qualified key personnel. In making employment decisions, particularly in the technology and payments industries, job candidates often consider the value of the equity awards they would receive in connection with their employment, and our stock price volatility, or a perception that the market price of our stock may not increase or may increase more slowly than stock prices at other technology or payments companies, may make it more difficult to attract, retain, and motivate employees.talent. We may be limited in our ability to recruit or hire internationally, including due to restrictive laws or policies on immigration, travel, or availability of visas for skilled workers. In addition, we do not have long-term employment agreements with any of our key personnel and do not maintain any “key person” life insurance policies. The loss of the services of any of our key personnel, or our inability to attract, orhire, develop, motivate and retain key and other highly qualified key personnel effectively,and diverse talent, whether in a remote or in-office environment, or protect the safety, health and productivity of our workforce could harm our overall business and growth prospects.results of operations.
We are subject to risks associated with information disseminated through our products and services.
Companies providing online servicesWe may be subject to claims relating to information disseminated through them,our online services, including claims alleging defamation, libel, harassment, hate speech, breach of contract, invasion of privacy, negligence, copyright or trademark infringement, or other theories based on the nature and content of the materials disseminated through the services, among other things. The laws relatingWe invest in measures intended to the liability of companies providing online services for information disseminated through their services are subject to frequent challenges. We are also subject to potential liability to third parties for the customer-provided contentdetect and block activities that may occur on our productspayments platform in violation of our policies and services, particularlyapplicable laws. These measures require continuous improvement and may not be sufficiently effective in jurisdictions outsidedetecting and preventing the U.S. whereexchange of information in violation of our policies and applicable laws. If these measures are not sufficiently effective, our business could be negatively impacted. If the applicable laws or regulations that provide protections for online dissemination of information are unsettled. Ifinvalidated or are modified to reduce protections available to us and we become liable for information provided by our customers and carried on our products and services, we could be directly harmed and we may be forced to implement new measures to reduce our exposure, to this liability, including expending substantial resources or discontinuing certain product or service offerings, which could harm our business.
Risks Related to Our Separation from eBay
If the distribution, together with certain related transactions, does not qualify as a transaction that is generally tax-free for U.S. federal income tax purposes under Sections 368(a)(1)(D) and 355 of the Internal Revenue Code (the “Code”), eBay, PayPal and eBay stockholders could be subject to significant tax liabilities.
On July 17, 2015, we became an independent publicly traded company through the pro rata distribution by eBay Inc. of 100% of our outstanding common stock to eBay’s stockholders (which we sometimes refer to as the “separation” or the “distribution”). eBay received an opinion from its outside legal counsel regarding the qualification of the distribution, together with certain related transactions, as a transaction that is generally tax-free for U.S. federal income tax purposes under Sections 368(a)(1)(D) and 355 of the Code. The opinion was based on and relied on, among other things, certain facts and assumptions, as well as certain representations, statements, and undertakings of eBay and of us, including those relating to the past and future conduct of eBay and of us. If any of these representations, statements, or undertakings were, or became, inaccurate or incomplete, or if eBay or we breach any of our respective covenants in the separation documents, the opinion of counsel may be invalid, and the conclusions reached therein could be jeopardized.
Notwithstanding the opinion of counsel, the Internal Revenue Service (the “IRS”) could determine that the distribution, together with certain related transactions, should be treated as a taxable transaction if the IRS determines that any of these representations, assumptions, or undertakings upon which such opinion was based are incorrect or have been violated or if the IRS disagrees with the conclusions in the opinion of counsel. An opinion of counsel is not binding on the IRS or any court and there can be no assurance that the IRS will not challenge the conclusions reached in the opinion. The IRS did not provide any opinion in advance of the separation that our proposed transaction is tax-free.
If the distribution, together with certain related transactions, failed to qualify as a transaction that is generally tax-free under Sections 368(a)(1)(D) and 355 of the Code, in general, eBay would recognize taxable gain as if it had sold the PayPal common stock in a taxable sale for its fair market value, eBay stockholders who received PayPal common stock in the distribution may be subject to tax as if they had received a taxable distribution equal to the fair market value of such shares, and we could incur significant liabilities.
There are risks associated with our relationship with eBay.
In connection with our separation from eBay, we entered into a separation and distribution agreement with eBay, as well as various other agreements, including an operating agreement, a tax matters agreement, an employee matters agreement, an intellectual property matters agreement, a data sharing addendum, and a product development agreement. The separation agreement, the tax matters agreement, the employee matters agreement, and the intellectual property matters agreement determined the allocation of assets and liabilities (including by means of licensing) between the companies following the separation for those respective areas and include associated indemnification obligations. The operating agreement, the data sharing addendum, and the product development agreement establish certain commercial relationships between eBay and us related to payment processing, credit, and data sharing. If either we or eBay are unable to satisfy our performance, payment, or indemnification obligations under these agreements, we could incur operational difficulties or losses or be required to make substantial indemnification or other payments to eBay.
Disputes between eBay and us have arisen and others may arise in the future. An adverse outcome in any such matters could materially and adversely affect our business, results of operations, and financial condition. eBay and PayPal are currently involved in a dispute regarding the calculation and amount of referral services fees due to eBay under the operating agreement. The parties are currently in arbitration proceedings with respect to this dispute pursuant to the dispute resolution provisions in the separation and distribution agreement.
Our relationship with eBay is governed, in part, by an operating agreement entered into at separation with a term of five years expiring July 2020 and a one-year tail period. This operating agreement defines a number of important elements of our commercial relationship with eBay, as well as certain obligations and restrictions that limit PayPal’s provision of services to certain competitive platform operators of eBay (as specified in the operating agreement). While eBay remains a significant source of our revenues and operating income, we expect the portion of our revenue and operating income attributable to eBay to continue to decline due to various factors (many of which are beyond our control), including the expiration (or earlier termination) of the operating agreement with eBay, and the speed and extent to which eBay intermediates payments on its platform (including by acting as a merchant of record and migrating eBay merchants to eBay's managed payments platform), limits the availability of PayPal as a payment option or offers (or promotes) alternative payment options, directs transactions on its platforms to different providers of payment services, or eliminates or modifies its risk management or customer protection programs on its platforms, which could result in customer dissatisfaction, reduction in eBay volume, and other consequences adverse to our business. If we are unable to generate sufficient business from our non-eBay customers to offset the expected reduction in the portion of our business attributable to eBay, it could materially impact the growth in our business and our ability to meet our long-term financial targets.
Risks Related to Our Common Stock
The price of our common stock has fluctuated and may continue to fluctuate significantly.
The price of our common stock has fluctuated and may continue to fluctuate significantly due to a number of factors, some of which may be beyond our control, including, but not limited to:
actual or anticipated fluctuations in our operating results;
changes in financial estimates by us or securities analysts and recommendations or lack of coverage and reports by securities analysts;
changes in our capital structure;
the activities of our competitors;
speculation, coverage, or sentiment in the media or the investment community;
the operating and stock price performance and valuation of comparable companies;
our quarterly or annual earnings, or those of other companies in our industry;
the public's reaction to our press releases, our other public announcements, and our filings with the SEC;
additions or departures of key personnel;
announcements related to litigation, regulation, or disputes;
changes to the regulatory and legal environment under which we operate; and
market conditions or trends in the payments industry, the industries of merchants, and the domestic and worldwide economy as a whole.
As a result of these and other factors, investors in our common stock may not be able to resell their shares at or above the price at which they purchase our common stock. In addition, the stock market in general has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of companies like us. These broad market and industry factors may materially reduce the market price of our common stock, regardless of our operating performance. In addition, in the past, some companies that have had volatile market prices for their securities have been subject to class action or derivative lawsuits. The filing of a lawsuit against us, regardless of the outcome, could have a negative effect on our business, financial condition, and results of operations, as it could result in substantial legal costs and a diversion of management's attention and resources.
Our amended and restated certificate of incorporation designates the state courts of the State of Delaware, or, if no state court located in the State of Delaware has jurisdiction, the federal court for the District of Delaware, as the sole and exclusive forum for certain types of actions and proceedings that may be initiated by our stockholders, which could discourage lawsuits against us and our directors and officers.
Our amended and restated certificate of incorporation provides that unless the corporation otherwise determines, the state courts of the State of Delaware, or, if no state court located in the State of Delaware has jurisdiction, the federal court for the District of Delaware, will be the sole and exclusive forum for any derivative action or proceeding brought on our behalf, any action asserting a claim of breach of a fiduciary duty owed by any of our directors or officers to us or our stockholders, any action asserting a claim against us or any of our directors or officers arising pursuant to any provision of the Delaware General Corporation Law (“DGCL”) or our amended and restated certificate of incorporation or bylaws, or any action asserting a claim against us or any of our directors or officers governed by the internal affairs doctrine. This exclusive forum provision may limit the ability of our stockholders to bring a claim in a judicial forum that such stockholders find favorable for disputes with us or our directors or officers, which may discourage such lawsuits against us and our directors and officers. Alternatively, if a court outside of Delaware were to find this exclusive forum provision inapplicable to, or unenforceable in respect of, one or more of the specified types of actions or proceedings described above, we could incur additional costs associated with resolving such matters in other jurisdictions, which could adversely affect our business, financial condition, or results of operations.
Certain provisions in our amended and restated certificate of incorporation and bylaws may prevent or delay an acquisition of our company, which could decrease the trading price of our common stock.
Certain provisions in our amended and restated certificate of incorporation and amended and restated bylaws may have the effect of deterring coercive takeover practices and inadequate takeover bids by making such practices or bids unacceptably expensive to the bidder and by encouraging prospective acquirers to negotiate with our Board of Directors rather than to attempt a hostile takeover. These provisions include, among others:
rules regarding how stockholders may present proposals or nominate directors for election at stockholder meetings;
the fact that directors may not be elected, removed, or replaced at stockholder-requested special meetings unless a person, entity, or group owns at least a majority of our outstanding common stock;
the right of our Board of Directors to issue preferred stock and to determine the voting, dividend, and other rights of preferred stock without stockholder approval;
the ability of our directors, and not stockholders, to fill vacancies on our board of directors in most circumstances and to determine the size of our board of directors;
the prohibition on stockholders acting by written consent; and
the absence of cumulative rights in the election of directors.
We have also elected not to be governed by Section 203 of the DGCL, which provides that, subject to limited exceptions, persons that acquire, or are affiliated with a person that acquires, more than 15% of the outstanding voting stock of a Delaware corporation shall not engage in any business combination with that corporation, including by merger, consolidation, or acquisitions of additional shares, for a three-year period following the date on which that person or its affiliates becomes the holder of more than 15% of the corporation’s outstanding voting stock. Our amended and restated certificate of incorporation, however, contains a provision that generally mirrors Section 203 of the DGCL, except that it provides for a 20% threshold instead of the 15% provided for by the DGCL. These provisions could delay or prevent a change of control that our stockholders may favor.
While these provisions are not intended to make us immune from takeovers, they will apply even if the offer may be considered beneficial by some stockholders and may delay or prevent an acquisition that our Board of Directors determines is not in the best interests of us and our stockholders. These provisions may also prevent or discourage attempts to remove and replace incumbent directors.
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
ITEM 2. PROPERTIES
We own and lease various properties in the United States (“U.S.”) and other countries around the world. We use thethese properties for executive and administrative offices, datacustomer services and operations centers, product development offices, warehouses, and customer services and operationsdata centers. As of December 31, 2019,2022, our owned and leased properties provided us with aggregate square footage as follows:
| | | United States | | Other Countries | | Total | | United States | | Other Countries | | Total |
| (In millions) | | (In millions) |
Owned facilities | 1.2 |
| | 0.2 |
| | 1.4 |
| Owned facilities | 1.0 | | | 0.1 | | | 1.1 | |
Leased facilities | 1.2 |
| | 1.8 |
| | 3.0 |
| Leased facilities | 2.2 | | | 2.0 | | | 4.2 | |
Total facilities | 2.4 |
| | 2.0 |
| | 4.4 |
| Total facilities | 3.2 | | | 2.1 | | | 5.3 | |
ITEM 3. LEGAL PROCEEDINGS
The information set forth under “Note 13—Commitments and Contingencies—Litigation and Regulatory Matters” to the consolidated financial statements included in Part IV, Item 15 of this Annual Report on Form 10-K is incorporated herein by reference.
ITEM 4. MINE SAFETY DISCLOSURES
Not applicable.
ITEM 5. MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS, AND ISSUER PURCHASES OF EQUITY SECURITIES
PayPal common stock is quoted on the NASDAQ Global Select Market under the ticker symbol “PYPL.”
We have never paid any cash dividends and we currently do not anticipate paying any cash dividends in the foreseeable future.
The stock repurchase activity under our stock repurchase programs during the three months ended December 31, 20192022 is summarized as follows:
ITEM 6. SELECTED FINANCIAL DATA
ITEM 7. MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS
This Management’s Discussion and Analysis of Financial Condition and Results of Operations focuses on a discussion of 20192022 results as compared to 20182021 results. For a discussion of 20182021 results as compared to 20172020 results, see “Exhibit 99.1—Revised Management’s Discussion and Analysis of Financial Condition and Results of Operations and Consolidated Financial Statements for the years ended December 31, 2018, 2017 and 2016—“Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” within our Form 8-K10-K for the year ended December 31, 2021 filed with the SEC on September 16, 2019.February 3, 2022.
We operate globally and in a rapidly evolving regulatory environment characterized by a heightened regulatory focus by regulators globally on all aspects of the payments industry. That focus continues to become even more heightened as regulators on a global basis focus on important issues such asindustry, including countering terrorist financing, anti-money laundering, privacy, cybersecurity, and consumer protection. Some of the laws and regulations to which we are subject were enacted recently, and theThe laws and regulations applicable to us, including those enacted prior to the advent of digital and mobile payments, are continuingcontinue to evolve through legislative and regulatory action and judicial interpretation. New or changing laws and regulations, including the way lawschanges to their interpretation and regulations are interpreted and implemented,implementation, as well as increased penalties and enforcement actions related to non-compliance, could have a material adverse impact on our business, results of operations, and financial condition. Therefore, weWe monitor these areas closely to designand are focused on designing compliant solutions for our customers who depend on us.customers.
The following table provides a summary of our consolidated financial results for the years ended December 31, 2019, 2018,2022, 2021, and 2017:2020: