Risk factor changes · PYPL

What changed in PayPal's risk factors

Item 1A (Risk Factors) of PayPal's FY2025 10-K compared with its FY2024 10-K, sentence by sentence.

Newer: 10-K filed 2026-02-03 · Older: 10-K filed 2025-02-04

New in the latest 10-K 27

• For example, in August 2025, PayPal experienced a temporary service disruption triggered by a coding error in a system update, which primarily impacted a limited number of customers and partners in Germany.
• In connection with this disruption, we experienced some fraudulent transaction activity for a limited time period.
• We have incurred transaction losses and other expenses as a result, including claims under our protection programs, and this or other disruptions may subject us to increased regulatory scrutiny, fines, penalties and litigation.
• AI; developments in technologies supporting our regulatory and compliance obligations; and in-store, digital, agentic and social commerce.
• Regulators and legislators globally continue to establish, evolve, and increase their regulatory authority, oversight, and enforcement, and it may be difficult to predict how these may be applied to our business and the way we conduct our operations.
• Additionally, we are a digital asset service provider under the Guiding and Establishing National Innovation for U.S.
• Stablecoins Act of 2025 (the GENIUS Act ), which subjects us to obligations relating to our cryptocurrency business and may affect the competitive landscape for payment stablecoins.
• The recently enacted GENIUS Act provides a regulatory framework that is in the process of being implemented.
• For example, there continues to be enforcement activity in connection with federal and state consumer protection laws, including suits which seek civil penalties.
• We have entered into agreements with third parties to sell various buy now, pay later loan receivables originated by PayPal entities.
• In certain markets, cross-border trade may represent our primary or sole offering.
• In particular, recent tariffs and reciprocal trade measures enacted or threatened to be enacted by the U.S. and other countries have led to increased volatility and uncertainty in certain parts of the global economy.
• We cannot predict the timing, strength or duration of any economic volatility, slowdown, instability or recovery, whether in the U.S. or globally, or within any particular industry.
• These conditions could have a material adverse impact on the demand for our products and services which FY 2025 FORM 10-K 25 Table of Contents could adversely affect our results of operations.
• There are inherent challenges and limitations in measuring our key metrics globally at scale.
• Evolving laws, regulations and stakeholder expectations with respect to environmental, social and governance matters could harm our reputation and adversely affect our business.
• Various jurisdictions both in the U.S. and internationally have adopted or are developing laws, regulations and policies relating to environmental, social and governance matters (e.g., environmental sustainability and climate change) which include disclosure, reporting and diligence requirements.
• Compliance with these requirements may involve significant costs, and any actual or perceived failure to comply with applicable (and potentially conflicting) federal, state, local or international laws or regulations concerning environmental, social, and governance matters could subject us to fines, penalties, regulatory or other enforcement actions, and adversely affect our business or financial condition.
• In addition, various stakeholders, including investors, customers, employees, governmental authorities and regulators, may have differing expectations regarding environmental, social and governance matters related to us (including those supporting and opposing various environmental, social and governance matters), whose expectations and requirements are evolving and varied.
• Any initiatives, targets, data, or commitments we disclose with respect to these matters involve risks and uncertainties and could be difficult to achieve and costly to implement.
• Any actual or perceived failure or inaccuracy with respect to such initiatives, targets, data or commitments or to otherwise successfully manage investor or other stakeholder expectations on these matters could result in adverse reaction by consumers or other stakeholders (including, but not limited to, customers choosing not to use our products and services and the commencement of legal and regulatory proceedings against us), harm our reputation, and adversely affect our business, results of operation and financial condition.
• Any downgrade in our credit rating or negative change in our rating outlook could increase our future borrowing costs and adversely affect our ability to obtain additional financing in the future on favorable terms or at all.
• There can be no assurance that we will continue to repurchase stock or declare cash dividends, and stock repurchases or dividends could increase the volatility of our stock price and could diminish our cash reserves.
• We engage in share repurchases of our common stock from time to time, and our stock repurchase programs do not have expiration dates and do not obligate us to repurchase any specific dollar amount or to acquire any specific number of shares.
• In October 2025, we announced the initiation of a cash dividend program.
• Future cash dividends are subject to declaration by our Board of Directors at its sole discretion and are therefore subject to numerous factors including, among others, prevailing market conditions, our results of operations, financial condition and liquidity, applicable laws and agreements.
• Our stock repurchases and our dividends could affect our share trading prices, increase its volatility, reduce our cash reserves and may be suspended or terminated at any time, which may result in a decrease in our share trading price.

Reworded 133

Removed words are struck through; added words are highlighted.

• The techniques Techniques used to attempt to obtain unauthorized or illegal access to systems and information (including customers personal data), disable or degrade service, exploit vulnerabilities, or sabotage systems are continuously evolving.
• In some circumstances, these These attempts may not be recognized or detected until after they have been launched against a target.
• Unauthorized parties continuously attempt to gain access to our systems or facilities through various means, including through hacking into our systems or facilities or those of our customers, partners, or vendors, and attempting to fraudulently induce users of our systems (including customers, employees, vendor and partner personnel and customers) vendor personnel) into disclosing user names, passwords, payment card information, multi-factor authentication application access or other sensitive information used to gain access to such systems or facilities.
• This information may, in turn, be used to access our customers confidential personal or proprietary information and financial instrument data that are stored on or accessible through our information technology ( IT ) systems and those of third parties with whom we partner.
• This information may also be used to execute fraudulent transactions or otherwise engage in fraudulent actions. other activity.
• Numerous and evolving cybersecurity and related threats, including advanced and persisting cyberattacks, artificial intelligence ( AI )-enabled threats, cyberextortion, distributed denial-of-service attacks, ransomware, spear phishing and social engineering schemes, the introduction of computer viruses or other malware, and the physical destruction of all or portions of our information technology IT and infrastructure and those of third parties with whom we partner or that are part of our information technology IT supply chain, are becoming increasingly sophisticated and complex, may be difficult to detect, and could compromise the confidentiality, availability, and integrity of the data in our systems, as well as the systems themselves.
• We believe that hostile actors, who may comprise individuals, coordinated groups, sophisticated organizations, or nation state nation-state supported entities, may target PayPal due to our name, brand recognition, types of data (including sensitive payments- and identity-related data) that customers provide to us, and the widespread adoption and use of our products and services.
• Any of the foregoing events may subject us to fines, penalties, regulatory or other enforcement actions, and adversely affect our business, reputation reputation, or financial condition may be adversely affected. condition.
• Any cybersecurity incidents, including cyberattacks or data security breaches affecting the information technology IT or infrastructure of our customers, partners, or vendors (including data center and cloud computing providers) or of companies we acquire, could have similar negative effects.
• While we maintain insurance policies intended to help offset the financial impact we may experience from of these risks, our coverage may be insufficient to compensate us for cover all our losses caused by security breaches and other damage to or 14 Table of Contents unavailability of our systems.
• FY 2025 FORM 10-K 14 Table of Contents Business interruptions or systems failures may impair the availability of our websites, applications, products or services, or otherwise harm our business.
• A catastrophic event that could lead to results in a disruption to or failure of our systems or operations could result in significant losses and require substantial recovery time and significant expenditures to resume or maintain operations.
• Further, some Some of our systems, including those of companies that we have acquired, are not fully redundant and any failure of these acquired systems, including due to a catastrophic event, may lead to operational outages or delays.
• We have experienced, and expect to continue to experience, system failures, cyberattacks, unplanned outages, and other events or conditions from time to time that have and or may interrupt the availability, or reduce or adversely affect the speed or functionality, of our products and services.
• While we continue to undertake system upgrades and re-platforming efforts designed to improve the availability, reliability, resiliency, and speed of our payments platform, these efforts are costly and time-consuming, involve significant technical complexity and risk, may divert our resources from new features and products, and may ultimately not be effective.
• Frequent or persistent interruptions in or disruptions to our services could permanently harm our relationship with our customers and partners and our reputation.
• We also rely on facilities, components, applications, software, and services supplied by third parties, including data center facilities and cloud data storage and processing services.
• While we maintain insurance policies intended to help offset the financial impact we may experience from these risks, business interruption insurance, our coverage may be insufficient to compensate us for cover all our losses caused by interruptions in our service due to systems failures and similar events.
• In addition, any failure to successfully implement new information systems and technologies or improvements or upgrades to existing information systems and technologies in a timely manner could lead to regulatory scrutiny, significant fines and penalties, and mandatory and costly changes to our business, adversely impact our business, internal controls, results of operations, and financial condition, and ultimately could cause us to lose existing licenses that we need to operate or prevent or delay us from obtaining additional licenses that may be required for our business.
• Rapid, significant, and disruptive technological changes impact the industries in which we operate, including payment technologies (including real-time payments, payment card tokenization, virtual currencies, distributed ledger and blockchain technologies, and proximity payment technology such as Near Field Communication and other contactless payments); internet web browser technologies that enable users to easily store their payment card information for use on any retail or e-commerce website; artificial intelligence ( AI ) and machine learning; developments in technologies supporting our regulatory and FY 2025 FORM 10-K 15 Table of Contents compliance obligations; and in-store, digital, and social commerce. website;
• We expect that new technologies applicable to the industries in which we operate, including the development, adoption, and use of generative AI technologies, technologies and autonomous AI agents, will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services.
• Our ability to develop, provide or incorporate new technologies and adapt our existing products and services to incorporate new technologies or develop future and new products and services using new technologies may be limited or restricted by industry-wide standards, platform providers, payments networks, changes to laws and regulations, changing customer expectations, third-party intellectual property rights, and other factors.
• Our business is subject to complex and changing laws, rules, regulations, policies, licensing schemes, and legal interpretations in the markets in which where (and relating to the industries and merchants to which) we offer services directly or through partners, including, but not limited to, those governing: banking, credit, deposit taking, cross-border and domestic money transmission, prepaid access, foreign currency exchange, privacy, data protection, data governance, cybersecurity, banking secrecy, digital payments, cryptocurrency, payment services (including payment processing and settlement services), lending, fraud detection, consumer protection, antitrust and competition, economic and trade sanctions, anti-money laundering, and counter-terrorist financing.
• As we introduce new products and services and expand into new markets, markets and support new industries and merchants, including through acquisitions, we expect to become subject to additional regulations, restrictions, and licensing requirements.
• In addition, because we facilitate sales of goods and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws, laws and regulations, which may impose different, more specific, or and/or conflicting obligations on us, as well as broader liability.
• Any We may not be able to respond quickly or effectively to regulatory, legislative, and other developments, and any failure or perceived failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to or expansion of their interpretation) may result in audits, inquiries, investigations, whistleblower complaints, and adverse media coverage; subject us to significant fines, penalties, monetary damages, injunctive relief, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions; result in additional compliance and licensure requirements; cause us to temporarily or permanently lose existing licenses or prevent or delay us from obtaining additional licenses that may be required for our business; increase regulatory scrutiny of our business; divert management s time and attention from our business; restrict our operations; lead to increased friction for customers; lead to loss of banking and other commercial partner relationships; force us to make changes to our business practices, products, or operations; require us to engage in remediation activities; or delay planned transactions, product launches, or improvements.
• The complexity of U.S. federal and state and international regulatory and enforcement regimes, coupled with the global scope of our operations and the evolving global regulatory environment, could result in a single event prompting a large number of overlapping investigations and legal and regulatory proceedings by multiple FY 2025 FORM 10-K 16 Table of Contents government authorities in different jurisdictions.
• Payments Regulation 16 Table of Contents In the U.S., PayPal, Inc.
• ( PayPal (Europe) ), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg Luxembourg, and to our customers in the United Kingdom ( U.K. ) through PayPal U.K.
• Limited ( PayPal U.K. ), a wholly-owned subsidiary that is subject to regulation as an electronic money institution and a consumer credit firm (and registration registered as a crypto asset business) in the United Kingdom ( U.K. ) by the Financial Conduct Authority ( FCA ).
• PayPal (Europe) or PayPal U.K. may be subject to enforcement actions and significant fines and penalties if either violates they violate applicable requirements.
• Compliance with applicable laws and regulations could become more costly and operationally difficult to manage due to additional supervision, potentially inconsistent interpretations, and domestic regulations by various countries in the region. EEA.
• Applicable regulation relating to payments, anti-money laundering, and digital services, which are key focus areas of European regulators and subject to extensive new regulation, could subject us to additional and complex obligations, risks, and associated costs, and impact our ability to expand our business in Europe.
• For many of the our other markets outside the U.S., we provide services on a cross-border basis through PayPal Pte.
• Ltd. has been is supervised by the Monetary Authority of Singapore ( MAS ), and in July 2023 was issued a Major Payment Institution license by the MAS under the Payment Services Act 2019.
• There are substantial costs and potential product and operational changes considerations involved in maintaining and renewing licenses, certifications, and approvals, and we could be subject to enforcement actions, fines, penalties, and litigation if we are found to violate any of these requirements.
• In certain markets, we may need to rely on local banks or other partners to process payments and conduct foreign currency exchange transactions in local currency, and local regulators may use their authority authority, including over such local partners partners, to prohibit, restrict, or limit us from doing business.
• Any of the foregoing could, individually or in the aggregate, result in substantial additional costs, delay or preclude planned transactions, geographical expansions, expansion, or product launches or improvements, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, products and services, or prevent or limit us from providing our products or services in a given market.
• Cryptocurrency Regulation and Related Risks Our customer cryptocurrency offerings could may subject us to additional regulations, licensing requirements, or other obligations or liabilities.
• Within the U.S., we are regulated by the New York State Department of Financial Services as a virtual currency FY 2025 FORM 10-K 17 Table of Contents business, which does not qualify permit us to engage in securities brokerage or dealing activities.

Removed since the previous 10-K 28

• Under payment card network rules and our contracts with our payment processors, if there is a breach of payment card information stored by us or our direct payment card processing vendors, we could be liable to the payment card issuing banks, including for their cost of issuing new cards and related expenses.
• Regulators and legislators globally have been establishing, evolving, and increasing their regulatory authority, oversight, and enforcement in a manner that impacts our business.
• Ltd. is supervised by the Monetary Authority of Singapore ( MAS ).
• As of July 1, 2023, PayPal Pte.
• For example, if the Securities and Exchange Commission ( SEC ) were to assert that any of the cryptocurrencies we support are securities, the SEC could assert that our activities involving that cryptocurrency require securities broker-dealer registration or other obligations under the federal securities laws.
• In addition, the CFPB, pursuant to its market-monitoring authority, may require us to provide extensive information on our products and offerings.
• From time to time, we have received orders from the CFPB pursuant to such market-monitoring authority requiring us to provide, among other items, extensive information on our payment products, including with respect to the collection, use of, and access to data and consumer protections, as well as our Buy Now, Pay Later offerings.
• Management s Discussion and Analysis of Financial Condition and Results of Operations Key Metrics and Financial Results ), and materially and adversely affect our financial condition and results of operations .
• In June 2023, we entered into a multi-year agreement to sell U.K. and European buy now, pay later ( BNPL ) loan receivables originated by PayPal (Europe) and PayPal U.K., consisting of the sale of a substantial majority of the U.K. and European BNPL loan portfolio held on PayPal (Europe) s balance sheet at the closing of the transaction and a forward-flow arrangement for the sale of future originations of eligible loans.
• In certain markets, cross-border trade represents our primary (and in some instances our only) offerings.
• See Note 13 Commitments and Contingencies Protection Programs to our consolidated financial statements.
• Strategic investments in which we have a minority ownership stake inherently involve a lesser degree of influence over business operations.
• Our international operations generate a significant portion of our net revenues.
• While the measurement of our key metrics is based on what we believe to be reasonable methodologies and estimates, there are inherent challenges and limitations in measuring our key metrics globally at scale.
• For example, we continuously apply models, processes and practices designed to detect and prevent fraudulent account creation on our platforms, and work to improve and enhance those capabilities.
• When we detect a significant volume of illegitimate activity, we generally remove the activity identified from our key metrics.
• Environmental, social and governance ( ESG ) issues may have an adverse effect on our business, financial condition and results of operations and damage our reputation.
• Various jurisdictions are adopting or considering new laws and regulations that expand mandatory disclosure, reporting and diligence requirements with respect to ESG matters.
• If we are unable to comply with new laws and regulations concerning ESG matters or fail to meet investor, industry or stakeholder expectations and standards, our reputation may be harmed, customers may choose to refrain from using our products and services, we may be subject to fines, penalties, regulatory or other enforcement actions, and our business or financial condition may be adversely affected.
• If our ESG-related data, processes and reporting are viewed as incomplete or inaccurate, or if we fail to achieve progress with respect to ESG-related goals on a timely basis or at all, we may be viewed negatively by stakeholders concerned about these matters.
• Moreover, investors, customers, partners, media, government entities, and other stakeholders (including those in support of or in opposition to ESG principles) may have a negative view of us to the extent we are perceived to have not responded appropriately to their ESG concerns or take positions that are contrary to their views or expectations.
• We recognize that climate-related risks may impact our business.
• For example, California, where our headquarters are located, has historically experienced, and is projected to continue to experience, extreme weather and natural disaster events more frequently, including drought, flooding, heat waves, and wildfires.
• We regularly monitor our concentration of, and exposure to counterparty risk, and actively manage this exposure to mitigate the associated risk.
• Changes by any rating agency to our outlook or credit rating could negatively affect the value of both our debt and equity securities and increase our borrowing costs.
• If our credit ratings are downgraded or other negative action is taken, the interest rates payable by us under our indebtedness may increase, and our ability to obtain additional financing in the future on favorable terms or at all could be adversely affected.
• These measures require continuous improvement and may not be sufficiently effective in detecting and preventing the exchange of information in violation of our policies and applicable laws, which could negatively impact our business.
• This increased risk could require us to expend substantial resources or discontinue certain product or service offerings, which could harm our business. 28 Table of Contents

Source: SEC EDGAR filings, compared sentence by sentence by EdgarStack. Sentence matching is automated and may pair or split passages imperfectly; check the linked filings before relying on any passage. A software tool, not financial advice. Not affiliated with the U.S. Securities and Exchange Commission.