Item 1A. RISK FACTORS

The following discussion is divided into three sections. The first section, which begins immediately following this paragraph, discusses some of the risks that may adversely affect our business, results of operations and financial condition. The second section, captioned “Risks Related to the Separation and Our Operation as an Independent Publicly Traded Company,” discusses some of the risks relating to our separation into an independent publicly traded company. The third section, captioned “Risks Related to Our Common Stock,” discusses some of the risks relating to an investment in our Common Stock. You should carefully review all of these sections for important information regarding risks and uncertainties that affect us, in addition to the other information appearing in this Annual Report on Form 10-K, including our consolidated financial statements and related notes. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that adversely affect our business. If any of the following risks actually occurs, our business, financial condition, results of operations, and future prospects could be materially and adversely affected.

Risk Factors That May Affect Our Business, Results of Operations and Financial Condition

Substantial and increasingly intense competition worldwide in the global payments industry may harm our business.

The global payments industry is highly competitive, and we compete against a wide range of businesses, some of which are larger than we are, have a dominant and secure position, or offer other products and services to consumers and merchants that we do not offer. The global payments industry is rapidly changing, highly innovative and increasingly subject to regulatory scrutiny. Many of the areas in which we compete evolve rapidly with changing and disruptive technologies, shifting user needs, and frequent introductions of new products and services. Competition may also intensify as businesses against which we compete or merchants enter into business combinations and alliances, and established companies in other segments expand to become competitive with our business.

We compete against a wide range of businesses with varying roles in all forms of payments, including:

•	paper-based transactions (principally cash and checks);

•	providers of traditional payment methods, particularly credit and debit cards and Automated Clearing House transactions (in particular, well-established banks);

•	payment networks which facilitate payments for credit card users;

•	providers of “digital wallets” which offer customers the ability to pay online and/or in-store through a variety of payment methods, including with mobile applications, through contactless payments, and with a variety of payment cards;

•	providers of mobile payments solutions that use tokenized card data approaches and contactless payments (e.g., near field communication ("NFC") or host card emulation functionality) to eliminate the need to swipe or insert a card or enter a personal identification number or password;

•	payment-card processors that offer their services to merchants, including for “card on file” payments where the merchant invites the consumer to select a payment method for their first transaction and to use the same payment method for subsequent transactions;

•	providers of “person-to-person” payments that facilitate individuals sending money with an email address or mobile phone number;

•	merchants and merchant associations providing proprietary payment networks to facilitate payments within their own retail network;

•	money remitters;

•	providers of card readers for mobile devices and of other point-of-sale and multi-channel technologies; and

•	providers of virtual currencies and distributed ledger technologies.

We often partner with many of these businesses and we consider the ability to continue establishing these partnerships as important to our business. Competition for relationships with these partners is intense and there can be no assurance that we will be able to continue to establish, grow or maintain these partner relationships.

We also face competition and potential competition from:

•	service providers that provide online merchants the ability to offer their customers the option of paying for purchases from their bank account or paying on credit;

•	issuers of stored value targeted at online payments;

•	other global online and mobile payment-services providers;

•	other providers of online and mobile account-based payments;

•	services targeting users of social networks and online gaming, including those offering social commerce and peer-to-peer payments;

•	mobile payment services between bank accounts;

•	payment services enabling banking customers to send and receive payments through their bank account, including through immediate or real-time payments systems;

•	ecommerce services that provide special offers linked to a specific payment provider;

•	services that help merchants accept and manage virtual currencies; and

•	electronic funds transfer services as a method of payment for both online and offline transactions.

Some of these competitors have larger customer bases, volume, scale, resources, and market share than we do, which may provide significant competitive advantages. Some of our competitors may also be subject to less burdensome licensing, anti-money laundering, counter-terrorist financing, and other regulatory requirements. They may devote greater resources to the development, promotion, and sale of products and services, and they may offer lower prices or more effectively introduce their own innovative programs, products and services that adversely impact our growth.

We compete primarily on the basis of the following:

•	ability to attract, retain and engage both merchants and consumers;

•	ability to demonstrate that merchants will achieve incremental sales by offering PayPal services;

•	consumer confidence in safety and security of transactions on our Payments Platform, including the ability for consumers to use PayPal products and services without sharing their financial information with the merchant or the party they are paying;

•	simplicity of our fee structure;

•	ability to develop services across multiple commerce channels, including mobile payments and payments at the retail point of sale;

•	trust in our dispute resolution and buyer and seller protection programs;

•	customer service;

•	brand recognition;

•	website, mobile platform and application onboarding, ease-of-use, speed, availability, and dependability;

•	the technology- and payment-agnostic nature of our Payments Platform;

•	system reliability and data security;

•	ease and quality of integration into third-party mobile applications and operating systems; and

•	quality of developer tools, such as our application programming interfaces and software development kits.

If we are not able to differentiate our products and services from those of our competitors, drive value for our customers, or effectively align our resources with our goals and objectives, we may not be able to compete effectively against our competitors.

Our failure to compete effectively against any of the foregoing competitive threats could materially and adversely harm our business.

Substantially all of our net revenues each quarter come primarily from transactions involving payments during that quarter, which may result in significant fluctuations in our operating results that could adversely affect our business, financial condition, results of operations, and cash flows, as well as the trading price of our common stock.

Substantially all of our net revenues each quarter come primarily from transactions involving payments during that quarter. As a result, our operating and financial results have varied on a quarterly basis during our operating history, and may continue to fluctuate significantly as a result of a variety of factors, including as a result of the risks set forth in this “Risk Factors” section. It is difficult for us to forecast the level or source of our revenues or earnings accurately. In view of the rapidly evolving nature of our business, period-to-period comparisons of our operating results may not be meaningful, and you should not rely upon them as an indication of future performance. Due to the inherent difficulty in forecasting revenues, it is also difficult to forecast expenses as a percentage of net revenues. Quarterly and annual expenses as a percentage of net revenues reflected in our financial statements may be significantly different from historical or projected rates. Our operating results in one or more future quarters may fall below the expectations of securities analysts and investors. The trading price of our common stock may decline significantly as a result of the factors described in this paragraph.

Global and regional economic conditions could harm our business.

Our operations and performance depend significantly on global and regional economic conditions. Uncertainty about global and regional economic events and conditions may result in consumers and businesses postponing or lowering spending in response to tighter credit, higher unemployment, financial market volatility, fluctuations in foreign currency exchange rates and interest rates, government austerity programs, negative financial news, declines in income or asset values, and other factors. These and other global and regional economic events and conditions could have a material adverse impact on the demand for our products and services, including a reduction in the volume and size of transactions on our Payments Platform. In addition, any financial turmoil affecting the banking system or financial markets could cause additional consolidation of the financial services industry, significant financial service institution failures, new or incremental tightening in the credit markets, low liquidity, and extreme volatility or distress in the fixed income, credit, currency and equity markets, which could have a material adverse impact on our business.

If we cannot keep pace with rapid technological developments to provide new and innovative products and services, the use of our products and services and, consequently, our revenues could decline.

Rapid, significant, and disruptive technological changes impact the industries in which we operate, including developments in payment card tokenization, mobile, social commerce (i.e., ecommerce through social networks), authentication, virtual currencies (including distributed ledger technologies), and NFC and other proximity payment devices, such as contactless payments. We cannot predict the effects of technological changes on our business. In addition to our own initiatives and innovations, we rely in part on third parties, including some of our competitors, for the development of and access to new technologies. We expect that new services and technologies applicable to the industries in which we operate will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services. Developing and incorporating new technologies into our products and services may require substantial expenditures, take considerable time, and ultimately may not be successful. In addition, our ability to adopt new products and services and to develop new technologies may be inhibited by industry-wide standards, payments networks, changes to laws and regulations, resistance to change from consumers or merchants, third-party intellectual property rights, or other factors. Our success will depend on our ability to develop and incorporate new technologies and adapt to technological changes and evolving industry standards; if we are unable to do so in a timely or cost-effective manner, our business could be harmed.

Changes in how consumers fund their PayPal transactions could harm our business.

We pay transaction fees when consumers fund payment transactions using credit cards, lower fees when consumers fund payments with debit cards, and nominal fees when consumers fund payment transactions by electronic transfer of funds from bank accounts, or from an existing PayPal account balance or through our PayPal Credit products. Our financial success is sensitive to changes in the rate at which our consumers fund payments using credit and debit cards (collectively, “payment cards”), which can significantly increase our costs. Although we provide consumers with the opportunity to use their existing PayPal account balance to fund payment transactions, some of our consumers may prefer to use payment cards, especially if these payment cards offer features and benefits that are not provided as part of their PayPal accounts. An increase in the portion of our payment volume funded using payment cards or in fees associated with our funding mix, or other events or developments that make it more difficult

or costly for us to fund transactions with lower-cost funding options, could materially and adversely affect our financial performance and significantly harm our business.

We have entered into strategic partnerships with major payment card networks and/or issuing banks to promote greater consumer choice and make it easier for merchants to accept and consumers to pay with these partners’ credit and/or debt cards and to allow us to gain access to these partners’ tokenization services for in-store point of sale PayPal transactions. These arrangements may have an uncertain impact on our business. While we anticipate that these and similar strategic partnerships we may enter into in the future will result in an increase in the number of transactions and transaction volume that we process, we also anticipate that a greater percentage of customer transactions will be executed using a payment card, which would likely increase the transaction costs associated with our funding mix, which could adversely affect our business and results of operations.

Our business is subject to cyberattacks and security and privacy breaches.

Our business involves the collection, storage, processing and transmission of customers’ personal data, including financial information and information about how they interact with our Payments Platform. In addition, a significant number of our customers authorize us to bill their payment card or bank accounts directly for all transaction and other fees charged by us. We have built our reputation on the premise that our Payments Platform offers customers a more secure way to make payments. An increasing number of organizations, including large merchants and businesses, other large technology companies, financial institutions, and government institutions, have disclosed breaches of their information security systems, some of which have involved sophisticated and highly targeted attacks, including on their websites and infrastructure.

The techniques used to obtain unauthorized, improper or illegal access to our systems, our data or customers' data, disable or degrade service, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized until launched against a target. Unauthorized parties may attempt to gain access to our systems or facilities through various means, including hacking into our systems or facilities or those of our customers, partners or vendors, or attempting to fraudulently induce (often through spear phishing attacks) our employees, customers, partners, vendors or other users of our systems into disclosing user names, passwords, payment card information, or other sensitive information, which may in turn be used to access our information technology systems. Certain efforts may be state-sponsored and supported by significant financial and technological resources, making them even more sophisticated and difficult to detect. We believe that PayPal is a particularly attractive target for such breaches and attacks due to our name and brand recognition and the widespread adoption and use of our products and services. Although we have developed systems and processes designed to protect our data and customer data and to prevent data loss and other security breaches, and expect to continue to expend significant resources to bolster these protections, these security measures cannot provide absolute security. Our information technology and infrastructure may be vulnerable to cyberattacks or security breaches, and third parties may be able to access our customers’ personal or proprietary information and payment card data that are stored on or accessible through those systems. Our security measures may also be breached due to human error, malfeasance, system errors or vulnerabilities, or other irregularities. Actual or perceived breaches of our security could interrupt our operations, result in our systems or services being unavailable, result in improper disclosure of data, materially harm our reputation and brands, result in significant regulatory scrutiny and legal and financial exposure, cause us to incur significant remediation costs, lead to loss of customer confidence in, or decreased use of, our products and services, divert the attention of management from the operation of our business, result in significant compensation or contractual penalties from us to our customers and their business partners as a result of losses to them or claims by them, and adversely affect our business and results of operations. In addition, any cyberattacks or data security breaches affecting companies that we acquire or our customers, partners or vendors (including data center and cloud computing providers) could have similar negative effects. See Note 3—"Business Combinations," Note 4—"Goodwill and Intangible Assets" and Note 13—"Commitments and Contingencies" to our consolidated financial statements for disclosure relating to the suspension of operations of TIO Networks ("TIO") (which we acquired in July 2017) as part of an ongoing investigation of security vulnerability of the TIO platform. Actual or perceived vulnerabilities or data breaches have led and may lead to claims against us.

In addition, under payment card rules and our contracts with our card processors, if there is a breach of payment card information that we store, or that is stored by our direct payment card processing customers, we could be liable to the payment card issuing banks for their cost of issuing new cards and related expenses. We also expect to expend significant additional resources to protect against security or privacy breaches, and may be required to redress problems caused by breaches. Financial services regulators in various jurisdictions, including the U.S. and the EU, have implemented authentication requirements for banks and payment processors intended to reduce online fraud, which could impose significant costs, require us to change our business practices, make it more difficult for new customers to join PayPal, and reduce the ease of use of our products, which could harm our business. Additionally, while we maintain insurance policies, they may not be adequate to reimburse us for losses caused by security breaches.

Systems failures and resulting interruptions in the availability of our websites, applications, products or services could harm our business.

Our systems and those of our services providers and partners may experience service interruptions or degradation because of hardware and software defects or malfunctions, computer denial-of-service and other cyberattacks, human error, earthquakes, hurricanes, floods, fires, natural disasters, power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks, computer viruses or other malware, or other events. Our systems also may be subject to break-ins, sabotage, and intentional acts of vandalism. Some of our systems are not fully redundant, and our disaster recovery planning may not be sufficient for all eventualities. In addition, as a provider of payments solutions, we are subject to heightened scrutiny by regulators that may require specific business continuity, resiliency and disaster recovery plans, and more rigorous testing of such plans, which may be costly and time-consuming and may divert our resources from other business priorities.

We have experienced and expect to continue to experience system failures, denial of service attacks, and other events or conditions from time to time that interrupt the availability, or reduce or adversely affect the speed or functionality of our products and services. These events have resulted and likely will result in loss of revenue. A prolonged interruption in the availability or reduction in the availability, speed or functionality of our products and services could materially harm our business. Frequent or persistent interruptions in our services could cause current or potential customers to believe that our systems are unreliable, leading them to switch to our competitors or to avoid or reduce the use of our products and services, and could permanently harm our reputation and brands. Moreover, if any system failure or similar event results in damages to our customers or their business partners, these customers or partners could seek significant compensation or contractual penalties from us for their losses, and those claims, even if unsuccessful, would likely be time-consuming and costly for us to address, and could have other consequences described in this “Risk Factors” section under the caption “Our business is subject to cyberattacks and security and privacy breaches.”

Our Payments Platform has experienced and may in the future experience intermittent unavailability. The full-time availability and expeditious delivery of our products and services is critical to our goal of gaining widespread acceptance among consumers and merchants for digital payments. We have undertaken certain system upgrades and re-platforming efforts designed to improve our reliability and speed. These efforts are costly and time-consuming, involve significant technical risk and may divert our resources from new features and products, and there can be no guarantee that these efforts will succeed. Because we are a regulated financial institution in certain jurisdictions, frequent or persistent site interruptions could lead to regulatory scrutiny, significant fines and penalties, and mandatory and costly changes to our business practices, and ultimately could cause us to lose existing licenses that we need to operate or prevent or delay us from obtaining additional licenses that may be required for our business.

We also rely on facilities, components and services supplied by third parties, including data center facilities and cloud storage services. If these third parties cease to provide the facilities or services, experience operational interference or disruptions, breach their agreements with us, or fail to perform their obligations and meet our expectations, our operations could be disrupted or otherwise negatively affected, which could result in customer dissatisfaction and damage to our reputation and brands, and materially and adversely affect our business. We do not carry business interruption insurance sufficient to compensate us for all losses that may result from interruptions in our service as a result of systems failures and similar events.

In addition, we are continually improving and upgrading our information systems and technologies. Implementation of new systems and technologies is complex, expensive and time-consuming. If we fail to timely and successfully implement new information systems and technologies, or improvements or upgrades to existing information systems and technologies, or if such systems and technologies do not operate as intended, this could have an adverse impact on our business, internal controls (including internal controls over financial reporting), results of operations and financial condition.

Changes to payment card networks or bank fees, rules, or practices could harm our business.

We rely on banks or other payment processors to process transactions and pay fees for the services. From time to time, payment card networks have increased, and may increase in the future, the interchange fees and assessments that they charge for each transaction that accesses their networks. Payment card networks have or may impose special fees or assessments for transactions that are executed through a “digital wallet” such as PayPal’s, which could particularly impact us and significantly increase our costs. Our payment card processors may have the right to pass any increases in interchange fees and assessments on to us as well as increase their own fees for processing. Any changes in interchange fees and assessments could increase our operating costs and reduce our operating income. We have entered into strategic partnerships with Visa and Mastercard to further expand our relationships in a way that will make it easier for merchants to accept and consumers to choose to pay with Visa and Mastercard credit and debit cards. During the terms of these agreements, Visa and Mastercard have each agreed to not enact or impose any fees or rules that solely target PayPal. Upon termination of the agreements, PayPal could become subject to special digital wallet fees or other special assessments.

In addition, in some jurisdictions, governmental regulations have required payment card networks to reduce interchange fees. Any material change in credit or debit card interchange rates in the U.S. or other markets, including as a result of changes in interchange fee limitations, could adversely affect our competitive position against traditional credit and debit card service providers and our business.

We are required by our processors to comply with payment card network operating rules, including special operating rules for payment service providers to merchants. We have agreed to reimburse our processors for any fines they are assessed by payment card networks as a result of any rule violations by us or our merchants. The payment card networks set and interpret the card operating rules. From time to time, the networks have alleged that various aspects of our business model violate these operating rules. If such allegations are not resolved favorably, they may result in significant fines and penalties or require changes in our business practices that may be costly. The payment card networks could adopt new operating rules or interpret or re-interpret existing rules that we or our processors might find difficult or even impossible to follow, or costly to implement. As a result, we could lose our ability to give consumers the option of using payment cards to fund their payments or the choice of currency in which they would like their payment card to be charged. If we are unable to accept payment cards or are limited in our ability to do so, our business would be adversely affected.

We and our payment card processors have implemented specific business processes for merchants to comply with payment card network operating rules for providing services to merchants. Any failure to comply with these rules could result in fines. We are also subject to fines from payment card networks if we fail to detect that merchants are engaging in activities that are illegal or that are considered “high risk,” including the sale of certain types of digital content. For “high risk” merchants, we must either prevent such merchants from using PayPal services or register such merchants with the payment card networks and conduct additional monitoring with respect to such merchants. Although the amount of these fines has not been material to date, additional fines in the future could become significant and could result in a termination of our ability to accept payment cards or require changes in our process for registering new customers, which would adversely affect our business. Payment card network rules may also increase the cost of, impose restrictions on, or otherwise negatively impact the development of, our retail point-of-sale solutions, which may negatively impact their deployment and adoption.

Failure to deal effectively with fraud, fictitious transactions, bad transactions, and negative customer experiences would increase our loss rate and harm our business, and could severely diminish merchant and consumer confidence in and use of our services.

In the event that merchants do not fulfill their obligations to consumers or a merchant's goods or services do not match the merchant’s description, we may incur substantial losses as a result of claims from consumers. We seek to recover such losses from the merchant, but may not be able to recover in full if the merchant is unwilling or unable to pay. In addition, in the event of the bankruptcy or other business interruption of a merchant that sells goods or services in advance of the date of their delivery or use (e.g., airline, cruise or concert tickets, custom-made goods and subscriptions), we could be liable to the buyers of such goods or services, either through our buyer protection program or through chargebacks on payment cards used by customers to fund their payment. While we have established reserves based on assumptions and estimates that we believe are reasonable to cover such eventualities, these reserves may be insufficient.

We also incur substantial losses from claims that the consumer did not authorize the purchase, from customer fraud, from erroneous transactions, and as a result of customers who have closed bank accounts or have insufficient funds in their bank accounts to satisfy payments. In addition, if losses incurred by us related to payment card transactions become excessive, they could potentially result in our losing the right to accept payment cards for payment, which would harm our business. We have taken measures to detect and reduce the risk of fraud, but these measures need to be continually improved and may not be effective against fraud, particularly new and continually evolving forms of fraud or in connection with new product offerings. If these measures do not succeed, our business could be harmed.

We are exposed to fluctuations in foreign currency exchange rates.

We have significant operations internationally that are denominated in foreign currencies, including the British Pound, Euro, Australian Dollar and Canadian Dollar, subjecting us to foreign currency risk. The strengthening or weakening of the U.S. dollar versus the British Pound, Euro, Australian Dollar, and Canadian Dollar impacts the translation of our net revenues generated in these foreign currencies into the U.S. dollar. In connection with providing our services in multiple currencies, we may face financial exposure if we incorrectly set our foreign exchange rates or as a result of fluctuations in foreign exchange rates between the times that we set them. Given that we also hold some corporate and customer funds in non-U.S. currencies, our financial results are affected by the remeasurement of these non-U.S. currencies into U.S. dollars. We also have foreign exchange risk on our assets and liabilities denominated in currencies other than the functional currency of our subsidiaries. While we regularly enter into transactions to hedge foreign currency risk for portions of our foreign currency translation and balance sheet exposure, it is

impossible to predict or eliminate the effects of this exposure. Fluctuations in foreign exchange rates could materially and adversely impact our financial results.

Any factors that reduce cross-border trade or make such trade more difficult could harm our business.

Cross-border trade (i.e., transactions where the merchant and consumer are in different countries) is an important source of our revenue and profits. Cross-border transactions generally provide higher revenues and operating income than similar transactions that take place within a single country or market. Cross-border trade also represents our primary (and in some cases, our only) presence in certain important markets.

Cross-border trade is subject to, and may be negatively impacted by, foreign exchange rate fluctuations. In addition, the interpretation and application of laws of multiple jurisdictions (e.g., the jurisdiction of the merchant and of the consumer) are often extremely complicated in the context of cross-border trade. Changes to or the interpretation and/or application of laws and regulations applicable to cross-border trade could impose additional requirements and restrictions, impose conflicting obligations, and increase the costs associated with cross-border trade. Any factors that increase the costs of cross-border trade for us or our customers or that restrict, delay, or make cross-border trade more difficult or impractical would lower our revenues and profits and could harm our business.

The United Kingdom’s departure from the EU could adversely affect us.

The United Kingdom (“U.K.”) held a referendum in June 2016 in which a majority of voters approved an exit from the EU (“Brexit”). In March 2017, the U.K. invoked Article 50 of the Treaty on European Union, which triggered a two-year period, with extension subject to unanimous consent by the other EU member states, during which the U.K. government will negotiate its withdrawal agreement with the EU. Brexit could adversely affect U.K., regional (including European), and worldwide economic and market conditions and could contribute to instability in global financial and foreign exchange markets, including volatility in the value of the British Pound and Euro, which in turn could adversely affect our customers and companies with which we do business, particularly in the U.K. In addition, Brexit could lead to legal uncertainty and see national laws and regulations in the U.K. diverge from EU laws and regulations, as the U.K. determines which EU laws to replace or replicate. In particular, depending on the terms of Brexit, we may face new regulatory costs and challenges, including the following:

•

we could lose our ability for our EU operations to offer services on a cross-border basis into the U.K. market utilizing regulatory permissions of PayPal (Europe) S.à r.l. et Cie, SCA (“PayPal (Europe)”), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg, and our corresponding ability to work with the Luxembourg regulators as the lead authority for various aspects of our U.K. operations;

•	we could be required to obtain additional regulatory permissions to operate in the U.K. market, adding costs and potential inconsistency to our business (and, depending on the capacity of the U.K. authorities, the criteria for obtaining permission, and any possible transitional arrangements, there is a risk that our business in the U.K. could be materially affected or disrupted);

•	we could be required to comply with regulatory requirements in the U.K. that are in addition to, or inconsistent with, the regulatory requirements of the EU; and

•	our ability to attract and retain the necessary human resources in appropriate locations to support the U.K. business and the EU business of PayPal could be adversely impacted.

Any of the effects of Brexit described above and others that we cannot anticipate could adversely affect our business, results of operations, financial condition and cash flows.

Our business is subject to extensive government regulation and oversight, as well as extensive, complex, overlapping and frequently changing rules, regulations and legal interpretations.

Our business is subject to laws, rules, regulations, policies, and legal interpretations in the markets in which we operate, including, but not limited to, those governing banking, credit, deposit taking, cross-border and domestic money transmission, foreign exchange, privacy, data protection, cybersecurity, banking secrecy, payment services (including payment processing and settlement services), consumer protection, economic and trade sanctions, anti-money laundering, and counter-terrorist financing. The legal and regulatory requirements applicable to us are extensive, complex, frequently changing, and increasing in number, and may impose overlapping and/or conflicting requirements or obligations.

Financial and political events have increased the level of regulatory scrutiny on the payments industry, and regulatory agencies may view matters or interpret laws and regulations differently than they have in the past and in a manner adverse to our business.

Our success and increased visibility may result in increased regulatory oversight and tighter enforcement of rules and regulations that may apply to our business.

As we expand and localize our international activities, we are increasingly becoming obligated to comply with the laws of the countries or markets in which we operate. In addition, because our services are accessible worldwide and we facilitate sales of goods and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws. Laws regulating the Internet, mobile and related technologies outside of the U.S. often impose different, more specific, or even conflicting obligations on us, as well as broader liability. For example, certain transactions that may be permissible in a local jurisdiction may be prohibited by regulations of U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”) or U.S. anti-money laundering or counter-terrorist financing regulations.

Any failure or perceived failure to comply with existing or new laws, regulations or orders of any governmental authority (including changes to or expansion of the interpretation of those laws, regulations or orders), including those discussed in this risk factor, may subject us to significant fines, penalties, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions, result in additional compliance and licensure requirements, increase regulatory scrutiny of our business, restrict our operations, and force us to change our business practices, make product or operational changes or delay planned product launches or improvements. Any of the foregoing could, individually or in the aggregate, damage our brands and business, and adversely affect our results of operations and financial condition. The complexity of U.S. federal and state regulatory and enforcement regimes, coupled with the global scope of our operations and the evolving global regulatory environment, could result in a single event giving rise to a large number of overlapping investigations and legal and regulatory proceedings by multiple government authorities in different jurisdictions. We have implemented policies and procedures designed to help ensure compliance with applicable laws, and regulations, but there can be no assurance that our employees, contractors, or agents will not violate such laws and regulations.

Payments Regulation

In the U.S., PayPal, Inc. has obtained licenses to operate as a money transmitter (or its equivalent) in the states where it is required, as well as in the District of Columbia, the U.S. Virgin Islands and Puerto Rico. These licenses include not only the PayPal branded products and services in these states, but also our Braintree, Venmo, Xoom and TIO branded products and services. As a licensed money transmitter, PayPal is subject to restrictions with respect to the investment of customer funds, reporting requirements, bonding requirements and inspection by state regulatory agencies. Accordingly, if we violate these laws or regulations, we could be subject to liability and/or additional restrictions, forced to cease doing business with residents of certain states, forced to change our business practices or required to obtain additional licenses or regulatory approvals, which could impose substantial costs.

While we currently allow our customers with payment cards to send payments from approximately 200 markets, we allow customers in only approximately half of those markets (including the U.S.) to also receive payments, in some cases with significant restrictions on the manner in which customers can withdraw funds. These limitations may adversely affect our ability to grow our business in these markets.

We provide our services to customers in the EU through PayPal (Europe), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg. Accordingly, PayPal (Europe) is subject to significant fines or other enforcement action if it violates the disclosure, reporting, anti-money laundering, capitalization, fund management, corporate governance, privacy, data protection, information security, banking secrecy, taxation, sanctions, or other requirements imposed on Luxembourg banks. In addition, EU laws and regulations are typically subject to different and potentially inconsistent interpretations by the countries that are members of the EU, which can make compliance more costly and operationally difficult to manage. Moreover, the countries that are EU members may each have different and potentially inconsistent domestic regulations implementing European Directives, including the EU Payment Services Directive and the E-Money Directive, which could make compliance more costly and operationally difficult to manage. The Revised Payment Services Directive (“PSD2”) entered into force in January 2016 and is in the process of being implemented into national legislation, with certain requirements effective January 13, 2018. The implementation of the PSD2 may negatively affect our business. PSD2 seeks to enable new payment models whereby a newly formed category of regulated payment provider would be able to access bank and payment accounts (including PayPal accounts) for the purposes of accessing account information or initiating a payment on behalf of a customer. Such access could subject us to data security and other legal and financial risks and could create new competitive forces and new types of competitors in the European payments market. PSD2 seeks to regulate more online platforms that handle payments for their sellers. PayPal merchants with affected business models which are not licensed, or which do not benefit from exemptions or integrate a compliant marketplaces solution may not be able to offer PayPal products in the future. PSD2 also imposes new standards for payment security and strong customer authentication that may make it more difficult and time consuming to carry out a PayPal transaction, which may adversely impact PayPal’s customer value proposition and its European business.

Finally, if the business activities of PayPal (Europe) exceed certain thresholds, or if the European Central Bank (“ECB”) determines that PayPal (Europe) is a significant supervised entity or that some activity of PayPal (Europe) is deemed subject to oversight by the ECB, PayPal (Europe) could become directly regulated by the ECB in addition to the Luxembourg regulator, the Commission de Surveillance du Secteur Financier (the "CSSF"), as its national supervisor, which could subject us to additional requirements and would likely increase compliance costs.

In Australia, we serve our customers through PayPal Australia Pty. Ltd. (“PayPal Australia”), which is licensed by the Australian Securities and Investments Commission as a provider of a non-cash payment product and by the Australian Prudential Regulation Authority as a purchased payment facility provider, which is a type of authorized depository institution. Accordingly, PayPal Australia is subject to significant fines or other enforcement action if it violates the product disclosure, reporting, anti-money laundering, capital requirements, privacy, corporate governance or other requirements imposed on Australian depository institutions.

In Hong Kong, we serve our customers through PayPal Hong Kong Limited (“PayPal Hong Kong”), which is licensed by the Hong Kong Monetary Authority as an issuer of stored value facility (“SVF Licensee”). Accordingly, PayPal Hong Kong is subject to significant fines or other enforcement action if it violates the reporting, anti-money laundering, capital requirements, privacy, corporate governance, risk management, float management, and/or any other requirements imposed on SVF Licensees.

In many of the other markets in which we do business, we serve our customers through PayPal Pte. Ltd., our wholly-owned subsidiary based in Singapore. PayPal Pte. Ltd. is supervised by the Monetary Authority of Singapore and designated as a holder of a stored value facility, but does not hold a remittance license. As a result, PayPal Pte. Ltd. is not able to offer outbound remittance payments (including donations to charities) from Singapore, and can only offer payments for the purchase of goods and services in Singapore. In many of the markets (other than Singapore) served by PayPal Pte. Ltd., it is unclear and uncertain whether our Singapore-based service is subject only to Singapore law or, if it is subject to the application of local laws, whether such local laws would require a payment processor like us to be licensed as a payments service, bank, financial institution or otherwise.

We are also subject to regulation in other markets in which we do business, and we have been and expect to continue to be required to apply for various licenses, certifications and regulatory approvals in a number of the countries where we provide our services. There can be no assurance that we will be able to obtain any such licenses, certifications, and approvals. In addition, there are substantial costs and potential product changes involved in maintaining such licenses, certifications, and approvals, and we could be subject to fines or other enforcement action if we are found to violate disclosure, reporting, anti-money laundering, capitalization, corporate governance or other requirements of such licenses. These factors could impose substantial additional costs and involve considerable delay to the development or provision of our products or services, or could require significant and costly operational changes or prevent us from providing our products or services in a given market.

In many countries, it may not be clear whether we are required to be licensed as a payment services provider, bank, financial institution or otherwise. In such markets, we may rely on local banks to process payments and conduct foreign exchange transactions in local currency. Local regulators may use their power to slow or halt payments to local merchants conducted through local banks or otherwise prohibit us from doing business in a country. Such regulatory actions or the need to obtain licenses, certifications or other regulatory approvals could impose substantial costs, involve considerable delay to the provision or development of our services, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, or prevent us from providing any products or services in a given market.

Consumer Protection

The financial services sector is subject to significant regulation and we are subject to consumer protection laws and regulations in the countries in which we operate. In the U.S., we are subject to federal and state consumer protection laws and regulations applicable to our activities, including the Electronic Fund Transfer Act (“EFTA”) and Regulation E as implemented by the Consumer Financial Protection Bureau (“CFPB”). These regulations require us to provide advance disclosure of changes to our services, follow specified error resolution procedures, and reimburse consumers for losses from certain transactions not authorized by the consumer, among other requirements. Additionally, technical violations of consumer protection laws could result in the assessment of actual damages or statutory damages or penalties of up to $1,000 in individual cases or up to $500,000 per violation in any class action and treble damages in some instances; we could also be liable for plaintiffs’ attorneys’ fees in such cases. We are subject to, and have paid amounts in settlement of, lawsuits containing allegations that our business violated the EFTA and Regulation E or otherwise advance claims for relief relating to our business practices (e.g., that we improperly held consumer funds or otherwise improperly limited consumer accounts).

In October 2016, the CFPB issued a final rule on prepaid accounts. The rule’s definition of prepaid account includes certain accounts that are capable of being loaded with funds and whose primary function is to conduct transactions with multiple,

unaffiliated merchants, at ATMs and/or for person-to-person transfers, including certain digital wallets. The rule’s requirements include: the disclosure of fees and other information to the consumer prior to the creation of a prepaid account; the extension of Regulation E liability limits and error-resolution requirements to all prepaid accounts; the application of Regulation Z credit card requirements to prepaid accounts with overdraft and credit features; and the submission of prepaid account agreements to the CFPB and their publication to the general public. In April 2017, the CFPB delayed the effective date of the final rule on prepaid accounts to April 1, 2018, and indicated that it would review, among other issues, the linking of credit cards to digital wallets that are capable of storing funds. In June 2017, the CFPB released proposed changes to its final rule, and in January 2018, the CFPB issued its final rule,with an effective date of April 1, 2019. We are evaluating the final rule and its requirements. Implementation of the rule could require us to make substantial changes to our business practices and the design of certain products, allocate additional resources, and increase our costs, which could negatively affect our business.

In May 2015, we entered into a Stipulated Final Judgment and Consent Order (“Consent Order”) with the CFPB in which we settled regulatory claims arising from PayPal Credit practices between 2011 and 2015. The Consent Order included obligations on PayPal to pay $15 million in redress to consumers and a $10 million civil monetary penalty, and required PayPal to make various changes to PayPal Credit disclosures and related business practices. We continue to cooperate and engage with the CFPB and work to ensure compliance with the Consent Order, which may result in us incurring additional costs.

PayPal (Europe) principally offers its services in EU countries through a “passport” notification process through the Luxembourg regulator to regulators in other EU member states pursuant to EU regulation. Regulators in these countries could notify PayPal (Europe) of local consumer protection laws that apply to its business, in addition to Luxembourg consumer protection law, and could also seek to persuade the Luxembourg regulator to order PayPal (Europe) to conduct its or the PayPal group's activities in the local country directly or through a branch office. These or similar actions by these regulators could increase the cost of, or delay, our plans to expand our business in EU countries.

Economic and Trade Sanctions

We are required to comply with U.S. economic and trade sanctions administered by OFAC. We have self-reported to OFAC certain transactions that were inadvertently processed but subsequently identified as possible violations of U.S. economic and trade sanctions. In March 2015, we reached a settlement with OFAC regarding possible violations arising from our sanctions compliance practices between 2009 and 2013, prior to the implementation of our real-time transaction scanning program. Subsequently, we have self-reported additional transactions as possible violations, and we have received new subpoenas from OFAC seeking additional information about certain of these transactions. Such self-reported transactions could result in claims or actions against us, including litigation, injunctions, damage awards, fines or penalties, or require us to change our business practices in a manner that could result in a material loss, require significant management time, result in the diversion of significant operational resources or otherwise harm our business. Furthermore, compliance with economic and trade sanctions in force in one jurisdiction may conflict with the laws and regulations of other jurisdictions in which we operate and can expose us to the risk of fines, sanctions and penalties.

Anti-Money Laundering and Counter-Terrorist Financing

We are subject to various anti-money laundering and counter-terrorist financing laws and regulations around the world that prohibit, among other things, our involvement in transferring the proceeds of criminal activities. U.S. and other regulators globally continue to increase their scrutiny of compliance with these obligations, which may require us to further revise or expand our compliance program, including the procedures we use to verify the identity of our customers and to monitor international and domestic transactions. Many countries in which we operate also have anti-money laundering and counter-terrorist financing laws and regulations, and we have been and will continue to be required to make changes to our compliance program in various jurisdictions in response. Regulators regularly re-examine the transaction volume thresholds at which we must obtain and keep applicable records or verify identities of customers and any change in such thresholds could result in greater costs for compliance. In the EU, the implementation of the Fourth Anti-Money Laundering Directive and the regulation on information accompanying transfer of funds (commonly known as the Revised Wire Transfer Regulation) are expected to make compliance more costly and operationally difficult to manage, lead to increased friction for customers, and result in a decrease in business. As of December 2017, PayPal (Europe)’s home state, Luxembourg, had not yet implemented all of the provisions of the Fourth Anti-Money Laundering Directive and there is uncertainty as to the exact requirements with which PayPal (Europe) will be required to comply. Penalties for non-compliance with the Fourth Anti-Money Laundering Directive could include fines of up to 10% of PayPal (Europe)’s total annual turnover. EU institutions are also proposing changes to the Fourth Anti-Money Laundering Directive which could be even more stringent.

Privacy and Protection of User Data

We are subject to a number of laws, rules, directives and regulations (which we refer to as “privacy laws”) relating to the collection, use, retention, security, processing and transfer (which we refer to as “process”) of personally identifiable information about our customers and employees (which we refer to as “personal data”) in the countries where we operate. Much of the personal data that we process, especially financial information, is regulated by multiple privacy laws and, in some cases, the privacy laws of multiple jurisdictions. In many cases, these laws apply not only to third-party transactions, but also to transfers of information between or among us, our subsidiaries, and other parties with which we have commercial relationships.

Regulatory scrutiny of privacy, data protection, and the collection, use and sharing of data is increasing around the world. There is uncertainty associated with the legal and regulatory environment relating to privacy and data protection laws, which continue to develop in ways we cannot predict, including with respect to evolving technologies such as cloud computing. Privacy and data protection laws may be interpreted and applied inconsistently from country to country and impose inconsistent or conflicting requirements. Complying with varying jurisdictional requirements could increase the costs and complexity of compliance or require us to change our business practices in a manner adverse to our business, and violations of privacy and data protection-related laws may expose us to significant damage awards, fines and other penalties that could, individually or in the aggregate, materially harm our business and reputation. In addition, compliance with inconsistent privacy laws may restrict our ability to provide products and services to our customers.

PayPal relies on a variety of compliance methods to transfer personal data of EU citizens to the U.S., including reliance on Binding Corporate Rules (“BCRs”) for internal transfers of certain types of personal data and Standard Contractual Clauses (“SCCs”) as approved by the European Commission for transfers to and from third parties. PayPal must also ensure that third parties processing personal data of PayPal’s EU customers and/or employees outside of the EU have compliant transfer mechanisms. In October 2015, the European Court of Justice invalidated U.S.-EU Safe Harbor framework clauses that were previously relied upon by some PayPal vendors to lawfully transfer personal data of EU citizens to U.S. companies, and PayPal entered into SCCs with those third parties who had previously relied on the U.S.-EU Safe Harbor framework. In July 2016, the U.S. and EU authorities agreed on a replacement for Safe Harbor known as “Privacy Shield.” Both the Privacy Shield framework and SCCs are facing legal challenges in the European justice system. To the extent that the Privacy Shield or SCCs are invalidated, PayPal’s ability to process EU personal data with third parties outside of the EU could be jeopardized.

In 2016, the EU adopted a comprehensive overhaul of its data protection regime from the current national legislative approach to a single European Economic Area Privacy Regulation, the General Data Protection Regulation (“GDPR”), which comes into effect in May 2018. The proposed EU data protection regime expands the scope of the EU data protection law to all foreign companies processing personal data of EU residents, imposes a strict data protection compliance regime with severe penalties of up to the greater of 4% of worldwide turnover and €20 million, and includes new rights such as the “portability” of personal data. Although the GDPR will apply across the EU without a need for local implementing legislation, local data protection authorities (“DPAs”) will still have the ability to interpret the GDPR through so-called opening clauses, which permit region-specific data protection legislation and have the potential to create inconsistencies on a country-by-country basis. We are evaluating the rule and its requirements. Implementation of the GDPR could require us to change our business practices and increase the costs and complexity of compliance.

PayPal also faces additional potential challenges from local DPAs. Because PayPal (Europe) is headquartered in Luxembourg and subject to regulation as a bank in that jurisdiction, we have relied on the “one-stop-shop” concept under which Luxembourg has been our lead data protection regulator in the EU. However, a 2015 European Court of Justice ruling (Weltimmo) affecting companies that do business in the EU potentially could make us subject to the local data protection laws or regulatory enforcement activities of the various EU member states in which we have established legal entities and which apply privacy laws that are different than, and may conflict with, Luxembourg privacy laws.

In addition, because of the large number of text messages, emails, phone calls and other communications we send or make to our customers for various business purposes, communication-related privacy laws that provide a specified monetary damage award or fine for each violation could result in particularly significant damage awards or fines. For example, under the Telephone Consumer Protection Act (“TCPA”), in the U.S., plaintiffs may seek actual monetary loss or statutory damages of $500 per violation, whichever is greater, and courts may treble the damage award for willful or knowing violations. We have been, and may continue to be subject to lawsuits (including class-action lawsuits) containing allegations that our business violated the TCPA. These lawsuits seek damages (including statutory damages) and injunctive relief, among other remedies. Given the large number of communications we send to our customers, a determination that there have been violations of the TCPA or other communications-based statutes could expose us to significant damage awards that could, individually or in the aggregate, materially harm our business.

Data protection, privacy and information security have become the subject of increasing public, media, regulatory and legislative concern. We post on our websites and applications our privacy policies and practices regarding the collection, use and disclosure of user data. Any failure, or perceived failure, by us to comply with our posted privacy policies, with any applicable regulatory requirements or orders, or with privacy, data protection, information security or consumer protection-related laws and regulations in one or more jurisdictions could result in proceedings or actions against us by governmental entities or others, including class action privacy litigation in certain jurisdictions, subject us to significant fines, penalties, judgments and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, and adversely affect our business. As noted above, we are also subject to the possibility of security and privacy breaches, which themselves may result in a violation of privacy laws.

If one or more of our counterparty financial institutions default on their financial or performance obligations to us or fail, we may incur significant losses.

We have significant amounts of cash, cash equivalents and other investments on deposit or in accounts with banks or other financial institutions in the U.S. and abroad. As part of our currency hedging activities, we enter into transactions involving derivative financial instruments with various financial institutions. Certain banks and financial institutions are also lenders under our credit facilities. We regularly monitor our exposure to counterparty credit risk, and actively manage this exposure to mitigate the associated risk. Despite these efforts, we may be exposed to the risk of default by, or deteriorating operating results or financial condition or failure of, these counterparty financial institutions. The risk of counterparty default, deterioration or failure may be heightened during economic downturns and periods of uncertainty in the financial markets. If one of our counterparties were to become insolvent or file for bankruptcy, our ability to recover losses incurred as a result of default or to access or recover our assets that are deposited or held in accounts with such counterparty may be limited by the counterparty’s liquidity or the applicable laws governing the insolvency or bankruptcy proceedings. In the event of default or failure of one or more of our counterparties, we could incur significant losses, which could negatively impact our results of operations and financial condition.

PayPal is not a bank or licensed lender in the U.S. and relies upon third parties to make loans and provide other products critical to our business.

As PayPal is neither a chartered financial institution nor licensed to make loans in any state in the U.S., we rely on a third-party chartered financial institution to issue the PayPal Credit consumer product in the U.S., and different chartered financial institutions to issue the PayPal Working Capital product and other business loan products in the U.S. These chartered financial institutions are state chartered industrial banks. Any termination or interruption in a partner bank’s ability to lend could result in us being unable or unwilling to offer our consumer and business loan products, which could materially and adversely affect our ability to issue our loan products in the U.S. and our business. In the event of a partner bank’s inability or unwillingness to lend, we may need to reach a similar agreement with another chartered financial institution or obtain our own bank charter or lending licenses. We may be unable to reach a similar agreement with another partner on favorable terms or at all, and obtaining a bank charter or lending licenses would be a costly, time-consuming and uncertain process, subject us to additional laws and regulatory requirements, which could be burdensome, increase our costs and require us to change our business practices. In addition, as a service provider to these bank partners, which are federally supervised U.S. financial institutions, we are subject from time to time to examination by their federal banking regulators.

A case decided in the U.S. Court of Appeals for the Second Circuit, Madden v. Midland Funding, LLC (786 F.3d 246 (2d Cir. 2015)), resulted in some uncertainty as to whether non-bank entities purchasing loans originated by a bank may rely on federal preemption of state usury laws, and may create an increased risk of litigation by plaintiffs challenging our ability to collect interest and fees in accordance with the terms of certain loans. Although the decision specifically addressed preemption under the National Bank Act, this decision could support future challenges to federal preemption for other institutions, including FDIC-insured, state chartered industrial banks like those that we rely on to issue our loan products in the U.S. After the Madden decision, there continue to be a number of U.S. state and federal court legal actions challenging the viability of business models where a non-bank entity relies on a third party chartered financial institution in connection with the issuance of credit products. While we believe the manner in which we offer our credit products can be distinguished from Madden, there can be no assurance as to the outcome of any potential litigation, which could materially and adversely impact our ability to issue our loan products in the U.S. and our business.

On November 16, 2017, we announced an arrangement under which Synchrony Bank will acquire the U.S. consumer credit receivables portfolio held by us and certain of our affiliates, which totaled approximately $6.4 billion in receivables as of December 31, 2017. The purchase price is subject to a post-closing true-up and certain adjustments. The transaction is expected to be completed during the third quarter of 2018, subject to certain closing conditions. The transaction may not close within the expected timeframe or at all. Even if the transaction is consummated, it may take us longer than expected to realize the anticipated benefits of the transaction, and those benefits may ultimately be smaller than anticipated or may not be realized at all, which could adversely affect our business and operating results. Under our expanded program agreement with Synchrony Bank, at the closing of the

consumer credit receivables portfolio sale, Synchrony Bank will become the exclusive issuer of the PayPal Credit online consumer financing program in the U.S. for a 10-year term, and we retain an option to designate a purchaser of the portfolio at the end of that term, Our increased reliance on Synchrony will subject us to risks in the nature of those discussed in this “Risk Factors” section under the caption "We rely on third parties in many aspects of our business, which creates additional risk."

Our credit products expose us to additional risks.

We offer our PayPal Credit consumer product and PayPal Working Capital and other business loan products to a wide range of consumers and merchants in various markets, and the financial success of these products depends on the effective management of related risk. The credit decisioning process for our PayPal Credit consumer product uses proprietary segmentation and credit algorithms and other analytical techniques designed to analyze the credit risk of specific consumers based on their past purchasing and payment history with PayPal as well as their credit scores. Similarly proprietary risk models and other indicators are applied to assess merchants who wish to use our business loan products to help predict their ability to repay. These risk models may not accurately predict the creditworthiness of a consumer or merchant due to factors such as inaccurate assumptions, including assumptions related to the particular consumer or merchant, market conditions, economic environment or limited transaction history or other data, among other factors. The accuracy of these risk models and the ability to manage credit risk related to our credit products may also be affected by legal or regulatory requirements, competitors’ actions, changes in consumer behavior, changes in the economic environment and other factors. Our international expansion of our credit product offerings also exposes us to additional risks, including those discussed below under the risk factor titled “Our international operations are subject to increased risks, which could harm our business.”

Like other businesses with significant exposure to losses from consumer and merchant credit, we face the risk that account holders will default on their payment obligations, creating the risk of potential charge-offs. The non-payment rate among account holders may increase due to, among other things, changes to underwriting standards, worsening economic conditions, such as a recession or government austerity programs, increases in prevailing interest rates, and high unemployment rates. Account holders who miss payments often fail to repay their loans, and account holders who file for protection under the bankruptcy laws generally do not repay their loans.

We currently purchase receivables related to our credit products in the U.S. If we are unable to fund our purchase of these receivables adequately or in a cost-effective manner, or if we are unable to efficiently manage the cash resources utilized for these purposes, our business could be harmed.

Our business may be impacted by political events, war, terrorism, public health issues, natural disasters and other business interruptions.

War, terrorism, geopolitical uncertainties, public health issues, natural disasters and other business interruptions have caused and could cause damage or disruption to the economy and commerce on a global or regional basis, which could have a material adverse effect on our business, our customers, and companies with which we do business. Our business operations are subject to interruption by, among others, natural disasters, fire, power shortages, earthquakes, floods, nuclear power plant accidents and other industrial accidents, terrorist attacks and other hostile acts, labor disputes, public health issues and other events beyond our control. Such events could decrease demand for our products and services or make it difficult or impossible for us to deliver products and services to our customers. In the event of a natural disaster, we could incur significant losses, require substantial recovery time and experience significant expenditures in order to resume or maintain operations, which could have a material adverse impact on our business, financial condition and results of operations.

Changes to our buyer and seller protection programs could increase our loss rate.

Our buyer and seller protection programs protect merchants and consumers from fraudulent transactions, and consumers if they do not receive the item ordered or if the item received is significantly different from its description. In 2015, we increased the scope of our buyer protection program to cover digital goods and intangible goods and services. In addition, consumers who pay through PayPal may have reimbursement rights from their payment card issuer (usually a bank), which in turn will seek recovery from us. The risk of losses from our buyer and seller protection programs are specific to individual buyers, sellers and transactions, and may also be impacted by regional variations to these programs, modifications to these programs resulting from changes in regulatory requirements, or changes that we decide to implement, such as expanding the scope of transactions covered by one or more of these programs. Upon PayPal becoming an independent publicly traded company in July 2015, we extended our protection programs in several countries to cover certain customers’ purchases on eBay, and our costs associated with these programs have therefore increased. Increases in our loss rate, including as a result of changing our buyer and seller protection programs, could harm our business.

Our international operations are subject to increased risks, which could harm our business.

Our international operations have generated approximately one-half of our net revenues in recent years. There are risks inherent in doing business internationally on both a domestic (i.e., in-country) and cross-border basis, including:

•	foreign currency and cross-border trade risks discussed earlier in this “Risk Factors” section under the captions “We are exposed to fluctuations in foreign currency exchange rates” and “Any factors that reduce cross-border trade or make such trade more difficult could harm our business”;

•	risks related to other government regulation or required compliance with local laws;

•	local licensing and reporting obligations (e.g., data localization requirements);

•	expenses associated with localizing our products and services, including offering customers the ability to transact business in the local currency, and adapting our products and services to local preferences (e.g., payment methods) with which we may have limited or no experience;

•	trade barriers and changes in trade regulations;

•	difficulties in developing, staffing, and simultaneously managing a large number of varying foreign operations as a result of distance, language, and cultural differences;

•	stringent local labor laws and regulations;

•	credit risk and higher levels of payment fraud;

•	profit repatriation restrictions, foreign currency exchange restrictions or extreme fluctuations in foreign currency exchange rates for a particular currency;

•	political or social unrest, economic instability, repression, or human rights issues;

•	geopolitical events, including natural disasters, public health issues, acts of war, and terrorism;

•	import or export regulations;

•	compliance with U.S. laws and foreign laws prohibiting corrupt payments to government officials, such as the Foreign Corrupt Practices Act and the U.K. Bribery Act, and other local anticorruption laws;

•	compliance with U.S. and foreign laws designed to combat money laundering and the financing of terrorist activities;

•	antitrust and competition regulations;

•	potentially adverse tax developments and consequences;

•	economic uncertainties relating to sovereign and other debt;

•	national or regional differences in macroeconomic growth rates;

•	different, uncertain, overlapping, or more stringent user protection, data protection, privacy, and other laws and regulations; and

•	increased difficulties in collecting accounts receivable.

Violations of the complex foreign and U.S. laws, rules and regulations that apply to our international operations may result in fines, criminal actions, or sanctions against us, our officers, or our employees; prohibitions on the conduct of our business; and damage to our reputation. Although we have implemented policies and procedures designed to promote compliance with these laws, there can be no assurance that our employees, contractors, or agents will not violate our policies. These risks are inherent in our international operations and expansion, may increase our costs of doing business internationally, and could harm our business.

We are exposed to fluctuations in interest rates.

We are exposed to interest rate risk from our investment portfolio and from interest-rate sensitive assets underlying the customer balances we hold on our balance sheet as customer accounts. A low interest rate environment or reductions in interest rates may negatively impact our investment income and our net income. In addition, fluctuations in interest rates may adversely impact our customers’ spending levels and ability and willingness to pay outstanding amounts owed to us. Higher interest rates often lead to higher payment obligations by customers to us and other lenders under mortgage, credit card and other consumer and merchant loans, which may reduce our customers’ ability to remain current on their obligations to us and therefore lead to increased delinquencies, charge-offs and allowance for loan and interest receivable which could have an adverse effect on our net income.

We have entered into a revolving credit facility and a 364-day delayed-draw term loan credit facility. We have borrowed under these credit facilities from time to time, and any borrowings under these credit facilities bear interest at a floating rate, exposing us to interest rate fluctuations.

Use of our payments services for illegal purposes could harm our business.

Our payment system is susceptible to potentially illegal or improper uses, including money laundering, terrorist financing, illegal online gambling, fraudulent sales of goods or services, illegal sales of prescription medications or controlled substances, piracy of software, movies, music, and other copyrighted or trademarked goods (in particular, digital goods), bank fraud, child pornography trafficking, prohibited sales of alcoholic beverages or tobacco products, online securities fraud, or to facilitate other illegal activity. Any use of our payment system for illegal or improper uses could subject us to claims, individual and class action lawsuits, and government and regulatory investigations, inquiries or requests that could result in liability and reputational harm for us. Moreover, certain activity that may be legal in one country may be illegal in another country, and a merchant may intentionally or inadvertently be found responsible for importing or exporting illegal goods, resulting in liability for us. Changes in law have increased the penalties for intermediaries providing payment services for certain illegal activities, and government authorities may consider additional payments-related proposals from time to time. Owners of intellectual property rights or government authorities may seek to bring legal action against providers of payments solutions, including PayPal, that are peripherally involved in the sale of infringing or allegedly infringing items. Any threatened or resulting claims could result in reputational harm, and any resulting liabilities, loss of transaction volume or increased costs could harm our business.

Our failure to manage our customer funds and the assets underlying our customer funds properly could harm our business.

We hold a substantial amount of funds belonging to our customers, including deposits in customer accounts and funds being remitted to sellers of goods and services. In certain jurisdictions where we operate, we are required to hold eligible liquid assets, as defined by the relevant regulators in each jurisdiction, equal to at least 100% of the aggregate amount of all customer balances. Our ability to manage and account accurately for the assets underlying our customer funds and comply with applicable liquid asset requirements requires a high level of internal controls. As our business continues to grow and we expand our product offerings, we must continue to strengthen our associated internal controls. PayPal (Europe), with the permission of the CSSF, utilizes certain European customer balances held by our Luxembourg banking subsidiary to fund credit balances relating to our customers. Our success requires significant public confidence in our ability to properly manage our customers’ balances and handle large and growing transaction volumes and amounts of customer funds. Any failure to maintain the necessary controls or to manage our customer funds and the assets underlying our customer funds accurately and in compliance with applicable regulatory requirements could result in reputational harm, lead customers to discontinue or reduce their use of our products and result in significant penalties and fines, which could materially harm our business.

We are subject to regulatory activity and antitrust litigation under competition laws.

We are subject to scrutiny by various government agencies under U.S. and foreign laws and regulations, including antitrust and competition laws. An increasing number of jurisdictions also provide private rights of action for competitors or consumers to assert claims of anti-competitive conduct. Other companies and government agencies have in the past and may in the future allege that our actions violate the antitrust or competition laws of the U.S., individual states, other countries, or the European Commission, or otherwise constitute unfair competition. An increasing number of governments are regulating and increasing their scrutiny of competition law activities. Our business agreements or arrangements with customers or other companies could give rise to regulatory action or antitrust litigation. Some regulators, particularly those outside of the U.S., may perceive that our products and services are used so broadly that otherwise uncontroversial business practices could be deemed anticompetitive. Any claims or investigations, even if without merit, may be very expensive to defend or respond to, involve negative publicity and substantial diversion of management time and effort, and could result in reputational harm, significant judgments against us, or require us to change our business practices.

We are subject to patent litigation.

We have repeatedly been sued for allegedly infringing other parties’ patents. At any given time, we are typically a defendant in a number of patent lawsuits and have been notified of several other potential patent disputes. We expect that we will continue to be subject to patent infringement claims because, among other reasons:

•	our products and services continue to expand in scope and complexity;

•	we continue to expand into new business areas, including through acquisitions; and

•	the number of patent owners who may claim that we, any of the companies that we have acquired, or our customers infringe their patents, and the aggregate number of patents controlled by such patent owners, continues to increase.

Such claims may be brought directly against us or against our customers whom we may indemnify because we are contractually obligated to do so or we choose to do so as a business matter. We believe that many of the claims against us and other technology companies have been, and continue to be, initiated by third parties whose sole or primary business is to assert such claims. In

addition, we have seen significant patent disputes between operating companies in some technology industries. Patent claims, whether meritorious or not, are time-consuming and costly to defend and resolve, and could require us to make expensive changes in our methods of doing business, enter into costly royalty or licensing agreements, make substantial payments to satisfy adverse judgments or settle claims or proceedings, or cease conducting certain operations, which would harm our business.

We may be unable to adequately protect or enforce our intellectual property rights, or third parties may allege that we are infringing their intellectual property rights.

The protection of our intellectual property, including our trademarks, patents, copyrights, domain names, trade dress, and trade secrets, is important to the success of our business. We seek to protect our intellectual property rights by relying on applicable laws and regulations in the U.S. and internationally, as well as a variety of administrative procedures. We also rely on contractual restrictions to protect our proprietary rights when offering or procuring products and services, including confidentiality and invention assignment agreements entered into with our employees and contractors and confidentiality agreements with parties with whom we conduct business.

Effective intellectual property protection may not be available in every country in which we offer our products and services. We may be required to expend significant time and expense in order to prevent infringement or to enforce our rights.

Although we have generally taken measures to protect our intellectual property rights, there can be no assurance that we will be successful in protecting or enforcing our rights in every jurisdiction, or that contractual arrangements and other steps that we have taken to protect our intellectual property will prevent third parties from infringing or misappropriating our intellectual property or deter independent development of equivalent or superior intellectual property rights by others. If we are unable to prevent third parties from adopting, registering or using trademarks and trade dress that infringe, dilute or otherwise violate our trademark rights, the value of our brands could be diminished and our business could be adversely affected. Also, we may not be able to discover or determine the extent of any unauthorized use of our proprietary rights. We have licensed in the past, and expect to license in the future, certain of our proprietary rights, such as trademarks or copyrighted material, to others. These licensees may take actions that diminish the value of our proprietary rights or harm our reputation. Any failure to adequately protect or enforce our intellectual property rights, or significant costs incurred in doing so, could diminish the value of our intangible assets and materially harm our business.

As the number of products in the technology and payments industries increases and the functionality of these products further overlaps, and as we acquire technology through acquisitions or licenses, we may become increasingly subject to intellectual property infringement and other claims. Litigation may be necessary to determine the validity and scope of the patent and other intellectual property rights of others. The ultimate outcome of any allegation is often uncertain and, regardless of the outcome, any such claim, with or without merit, may be time-consuming, result in costly litigation, divert management’s time and attention from our business, and require us to, among other things, redesign or stop providing our products or services, pay substantial amounts to satisfy judgments or settle claims or lawsuits, pay substantial royalty or licensing fees, or satisfy indemnification obligations that we have with certain parties with whom we have commercial relationships. Our failure to obtain necessary license or other rights, or litigation or claims arising out of intellectual property matters, may harm our business.

We are regularly subject to general litigation, regulatory disputes, and government inquiries.

We are regularly subject to claims, individual and class action lawsuits, government and regulatory investigations, inquiries or requests, and other proceedings alleging violations of laws, rules and regulations with respect to competition, antitrust, intellectual property, privacy, data protection, information security, anti-money laundering, counter-terrorist financing, sanctions, anti-corruption, consumer protection, fraud, accessibility, securities, tax, labor and employment, commercial disputes, services, charitable fundraising, contract disputes, escheatment of unclaimed or abandoned property, and other matters. In particular, our business faces ongoing consumer protection and intellectual property litigation, as discussed above. The number and significance of these disputes and inquiries have increased as our business has expanded in scale, scope and geographic reach, and our products and services have increased in complexity. In addition, the laws, rules and regulations affecting our business, including those pertaining to Internet and mobile commerce, payments services, and credit, are subject to ongoing interpretation by the courts and governmental authorities, and the resulting uncertainty in the scope and application of these laws, rules and regulations increases the risk that we will be subject to private claims and governmental actions alleging violations.

The scope, outcome and impact of claims, lawsuits, government investigations, and proceedings to which we are subject cannot be predicted with certainty. Regardless of the outcome, such investigations and proceedings can have an adverse impact on us because of legal costs, diversion of management resources, reputational damage, and other factors. Determining reserves for our pending litigation and regulatory proceedings is a complex, fact-intensive process that involves a high degree of judgment. Resolving one or more such legal and regulatory proceedings could potentially require us to make substantial payments to satisfy

judgments, fines or penalties or to settle claims or proceedings, any of which could materially and adversely affect our business. These proceedings could also result in reputational harm, criminal sanctions, consent decrees, or orders that prevent us from offering certain products or services, require us to change our business practices in costly ways or develop non-infringing or otherwise altered products or technologies. Any of these consequences could materially and adversely affect our business, results of operations and financial condition.

While certain of our customer agreements contain arbitration provisions with class action waiver provisions that may limit our exposure to consumer class action litigation, there can be no assurance that we will be successful in enforcing these arbitration provisions, including the class action waiver provisions, in the future or in any given case. Legislative, administrative or regulatory developments may directly or indirectly prohibit or limit the use of pre-dispute arbitration clauses and class action waiver provisions. Any such prohibitions or limitations on or discontinuation of the use of, such arbitration or class action waiver provisions could subject us to additional lawsuits, including additional consumer class action litigation, and significantly limit our ability to avoid exposure from consumer class action litigation.

Changes in U.S. tax laws could have a material adverse effect on our business, cash flow, results of operations and financial conditions.

On December 22, 2017, the U.S. government enacted comprehensive Federal tax legislation commonly referred to as the Tax Cuts and Jobs Act of 2017 (the “Tax Act”). The Tax Act makes changes to the corporate tax rate, business-related deductions and taxation of foreign earnings, among others, that will generally be effective for taxable years beginning after December 31, 2017. These changes could have a material adverse impact on the value of our U.S. deferred tax assets, result in significant one-time charges in the current or future taxable years and increase our future U.S. tax expense. We are continuing to evaluate the Tax Act and its requirements, as well as its application to our business and its impact on our effective tax rate. At this stage, it is unclear how many U.S. states will incorporate these federal law changes, or portions thereof, into their tax codes. The implementation by us of new practices and processes designed to comply with, and benefit from, the Tax Act and its rules and regulations could require us to make substantial changes to our business practices, allocate additional resources, and increase our costs, which could negatively affect our business, results of operations and financial condition.

We may have exposure to greater than anticipated tax liabilities.

The determination of our worldwide provision for income taxes and other tax liabilities requires estimation and significant judgment, and there are many transactions and calculations where the ultimate tax determination is uncertain. Like many other multinational corporations, we are subject to tax in multiple U.S. and foreign tax jurisdictions. Our determination of our tax liability is always subject to audit and review by applicable domestic and foreign tax authorities, and we are currently undergoing a number of investigations, audits and reviews by taxing authorities throughout the world. Any adverse outcome of any such audit or review could have a negative effect on our business, and the ultimate tax outcome may differ from the amounts recorded in our financial statements and may materially affect our financial results in the periods for which such determination is made. While we have established reserves based on assumptions and estimates that we believe are reasonable to cover such eventualities, these reserves may prove to be insufficient.

In addition, our future income taxes could be adversely affected by earnings being lower than anticipated, or by the incurrence of losses, in jurisdictions that have lower statutory tax rates and higher than anticipated in jurisdictions that have higher statutory tax rates, by changes in the valuation of our deferred tax assets and liabilities, as a result of gains on our foreign exchange risk management program, or changes in tax laws, regulations, or accounting principles, as well as certain discrete items.

Various levels of government, such as U.S. federal and state legislatures, and international organizations, such as the Organization for Economic Co-operation and Development (“OECD”) and the EU, are increasingly focused on tax reform and other legislative or regulatory action to increase tax revenue. Any such tax reform or other legislative or regulatory actions could increase our effective tax rate.

We and our merchants may be subject to sales reporting and record-keeping obligations.

A number of U.S. states, the U.S. federal government and foreign countries have implemented or are in the process of implementing reporting or record-keeping obligations on companies that engage in or facilitate ecommerce to improve tax compliance. Additionally, a number of jurisdictions are reviewing whether payment service providers and other intermediaries could be deemed to be the legal agent of merchants for certain tax purposes. We have modified our systems to meet known requirements and expect further modifications will be required to comply with future requirements, which may negatively impact our customer experience and increase operational costs. Any failure by us to comply with these and similar reporting and record-keeping obligations could

result in substantial monetary penalties and other sanctions, adversely impact our ability to do business in certain jurisdictions, and harm our business.

Acquisitions, joint ventures, strategic investments, and other strategic transactions could result in operating difficulties and could harm our business.

Acquisitions, joint ventures, strategic investments, and other strategic transactions are important elements of our overall corporate strategy. We expect to continue to evaluate and consider a wide array of potential strategic transactions as part of our overall business strategy, including business combinations, acquisitions, and dispositions of certain businesses, technologies, services, products, and other assets, as well as joint ventures, strategic investments, and commercial and strategic partnerships. These transactions may involve significant challenges and risks, including:

•	the potential loss of key customers, vendors and other key business partners of the companies we acquire, or dispose of, following and continuing after announcement of our transaction plans;

•	difficulty making strategic hires of new employees, declining employee morale and retention issues affecting employees (particularly the potential loss of key personnel) of companies that we acquire or dispose of, which may result from changes in compensation, management, reporting relationships, future prospects, or the direction of the acquired or disposed business;

•	diversion of management time and focus;

•	the need to and difficulty of integrating the operations, systems (including accounting, compliance, management, information, human resource and other administrative systems), technologies, products and personnel of each acquired company, which is an inherently risky and potentially lengthy and costly process;

•	the need to and difficulty of implementing and/or enhancing controls, procedures and policies appropriate for a larger public company at acquired companies which, prior to the acquisition, may have lacked such controls, procedures and policies or whose controls, procedures and policies did not meet applicable legal and regulatory standards;

•	the inefficiencies and lack of control that may result if integration of acquired companies is delayed or not implemented, and unforeseen difficulties and costs that may arise as a result;

•	potential exposure to new or increased regulatory oversight and regulatory obligations associated with new products and services or entry into new markets;

•	risks associated with our expansion into new international markets;

•	risks associated with the complexity of entering into and effectively managing joint ventures, strategic investments, and other strategic partnerships;

•	risks associated with undetected cyberattacks or security breaches at companies that we acquire or with which we may combine or partner;

•	lawsuits or regulatory actions resulting from the transaction;

•	liability for activities or conduct of the acquired company before the acquisition, including legal and regulatory claims or disputes, violations of laws and regulations, commercial disputes, tax liabilities and other known and unknown liabilities;

•	the acquisition of new customer and employee personal information, which in and of itself may require regulatory approval and or additional controls, policies and procedures and subject us to additional exposure and additional complexity and costs of compliance; and

•	our dependence on the accounting, financial reporting, operating metrics and similar systems, controls and processes of acquired businesses and the risk that errors or irregularities in those systems, controls and processes will lead to errors in our financial statements or make it more difficult to manage the acquired business.

At any given time, we may be engaged in discussions or negotiations with respect to one or more of these or other types of transactions, any of which could, individually or in the aggregate, be material to our financial condition and results of operations. There can be no assurance that we will be successful in identifying, negotiating, and consummating favorable transaction opportunities. It may take us longer than expected to fully realize the anticipated benefits of these transactions, and those benefits may ultimately be smaller than anticipated or may not be realized at all, which could adversely affect our business and operating results. Any acquisitions or dispositions may also require us to issue additional equity securities, spend our cash, or incur debt (and increased interest expense), recognize liabilities, and record amortization expenses related to intangible assets or write-offs of goodwill or intangibles, which could dilute the economic and voting rights of our stockholders and adversely affect our results of operations and the interests of holders of our indebtedness, as applicable.

Joint ventures and minority investment inherently involve a lesser degree of control over business operations, thereby potentially increasing the financial, legal, operational and/or compliance risks associated with the joint venture or minority investment. In addition, we may be dependent on joint venture partners, controlling shareholders, management or other persons or entities who control them and who may have business interests, strategies or goals that are inconsistent with ours. Business decisions or other

actions or omissions of the joint venture partners, controlling shareholders, management or other persons or entities who control them and who may adversely affect the value of our investment, result in litigation or regulatory action against us and otherwise damage our reputation and brand.

There are risks associated with our indebtedness.

We have incurred indebtedness, and we may incur additional indebtedness in the future. Our ability to pay interest and repay the principal for our indebtedness is dependent upon our ability to manage our business operations, generate sufficient cash flows to service such debt and the other factors discussed in this “Risk Factors” section. There can be no assurance that we will be able to manage any of these risks successfully. In addition, changes by any rating agency to our outlook or credit rating could negatively affect the value of both our debt and equity securities and increase the interest amounts we pay on outstanding or future debt. These risks could adversely affect our financial condition and results of operations.

We rely on third parties in many aspects of our business, which creates additional risk.

We rely on third parties in many aspects of our business, including the following:

•	networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions;

•	unaffiliated third-party lenders to originate loans in the U.S. for our PayPal Credit consumer product. PayPal Working Capital and other business loan products;

•	third parties that provide loan servicing and customer statements processing;

•	third parties that provide certain outsourced customer support and product development functions, which are critical to our operations; and

•	third parties that provide facilities, infrastructure, components and services, including data center facilities and cloud computing.

Because we rely on third parties to provide services to us and our customers and to facilitate certain of our business activities, we face increased operational risk. These third parties may be subject to financial, legal, regulatory, labor or other issues, such as service terminations, disruptions or interruptions, that prevent them from providing services to us or our customers. Moreover, these third parties are themselves subject to the risks discussed earlier in the "Risk Factors" section under the caption "Our business is subject to cyberattacks and security and privacy breaches." In addition, these third parties may breach their agreements with us, disagree with our interpretation of contract terms or applicable laws and regulations, refuse to continue or renew these agreements on commercially reasonable terms or at all, fail or refuse to process transactions adequately, take actions that degrade the functionality of our services, impose additional costs or requirements on us, or give preferential treatment to competitive services. There can be no assurance that third parties who provide services directly to us or our customers will continue to do so on acceptable terms, or at all. If any third parties were to stop providing services to us or our customers on acceptable terms, we may be unable to procure alternatives from other third parties in a timely and efficient manner, and on acceptable terms or at all. If third parties we rely on do not adequately or appropriately provide their services or perform their responsibilities, we may be subject to business disruptions, losses or costs to remediate any of the deficiencies, customer dissatisfaction, reputational damage, legal or regulatory proceedings, or other adverse consequences which could harm our business.

Our developer platforms, which are open to merchants and third-party developers, subject us to additional risks.

We provide third-party developers with access to application programming interfaces, software development kits and other tools designed to allow them to produce applications for use, with a particular focus on mobile applications. There can be no assurance that merchants or third-party developers will develop and maintain applications and services on our open platforms on a timely basis or at all, and a number of factors could cause such third-party developers to curtail or stop development for our platforms. In addition, our business is subject to many regulatory restrictions. It is possible that merchants and third-party developers who utilize our development platforms or tools could violate these regulatory restrictions and we may be held responsible for such violations, which could harm our business.

Our retail point of sale solutions expose us to additional risks.

We have announced several retail point of sale solutions, which enable merchants to accept payments using a payments card reader attached to, or otherwise communicating with, a mobile device or to scan payment cards and codes using the mobile device’s embedded camera, and which enable consumers to use their mobile devices to pay at the point of sale. We have entered into strategic partnerships with major payment card networks to further expand our relationship in a way that will make it easier for merchants to accept and consumers to choose to pay for transactions utilizing these companies' credit and debit cards. Those

agreements provide us with access to each of these partner's tokenization services in the U.S. for in-store point-of-sale PayPal transactions, which we expect will increase the number of point of sale transactions that we process. As we continue to expand our product and service offerings at the retail point of sale, we will face additional risks, including:

•	increased expectations from offline retailers regarding the reliability and availability of our systems and services and correspondingly lower amounts of downtime, which we may not be able to meet;

•	significant competition at the retail point of sale, particularly from established payment card providers , many of which have substantially greater resources than we do;

•	increased targeting by fraudsters; given that our fraud models are less developed in this area, we may experience increases in fraud and associated transaction losses as we adjust to fraudulent activity at the point of sale;

•	exposure to product liability claims to the extent that hardware devices that we produce for use at the retail point of sale malfunction or are not in compliance with laws, which could result in substantial liability and require product recalls or other actions;

•	exposure to additional laws, rules and regulations;

•	increased reliance on third parties involved with processing in-store payments, including independent software providers, electronic point of sale providers, hardware providers (such as cash register and pin-pad providers), payment processors and banks that enable in-store transactions; and

•	lower operating income than our other payment solutions.

Unless we are able to successfully manage these risks, including driving adoption of, and significant volume through, our retail point of sale solutions over time, our business may be harmed.

Our success largely depends on key personnel. Because competition for our key employees is intense, we may not be able to attract, retain, and develop the highly skilled employees we need to support our business. The loss of key personnel could harm our business.

Our future performance depends substantially on the continued services of key personnel, including our executive team and other highly skilled employees, and our ability to attract, retain, and motivate such personnel. Competition for key personnel is intense, especially in the San Francisco Bay Area, where our corporate headquarters are located and where the cost of living is high, and we may be unable to successfully attract, integrate, or retain sufficiently qualified key personnel. In making employment decisions, particularly in the technology and payments industries, job candidates often consider the value of the equity awards they would receive in connection with their employment, and fluctuations in our stock price, or a perception that the market price of our stock may not increase or may increase more slowly than stock prices at other technology or payments companies, may make it more difficult to attract, retain, and motivate employees. We may be limited in our ability to recruit internationally by restrictive domestic immigration laws or policies. In addition, we do not have long-term employment agreements with any of our key personnel and do not maintain any “key person” life insurance policies. The loss of the services of any of our key personnel, or our inability to attract highly qualified key personnel, could harm our business.

We are subject to risks associated with information disseminated through our products and services.

Companies providing online services may be subject to claims relating to information disseminated through them, including claims alleging defamation, libel, harassment, hate speech, breach of contract, invasion of privacy, negligence, copyright or trademark infringement, among other things. The laws relating to the liability of companies providing online services for information disseminated through their services are subject to frequent challenges. We are also subject to potential liability to third parties for the customer-provided content on our products and services, particularly in jurisdictions outside the U.S. where the applicable laws are unsettled. If we become liable for information provided by our customers and carried on our products and services, we could be directly harmed and we may be forced to implement new measures to reduce our exposure to this liability, including expending substantial resources or discontinuing certain product or service offerings, which could harm our business.

Risks Related to the Separation from eBay

If the distribution, together with certain related transactions, does not qualify as a transaction that is generally tax-free for U.S. federal income tax purposes under Sections 368(a)(1)(D) and 355 of the Internal Revenue Code (the “Code”), eBay, PayPal and eBay stockholders could be subject to significant tax liabilities and, in certain circumstances, we could be required to indemnify eBay for material taxes pursuant to indemnification obligations under the tax matters agreement.

On July 17, 2015, we became an independent publicly traded company through the pro rata distribution by eBay Inc. of 100% of our outstanding common stock to eBay’s stockholders (which we sometimes refer to as the “separation” or the “distribution”). eBay received an opinion from its outside legal counsel regarding the qualification of the distribution, together with certain related

transactions, as a transaction that is generally tax-free for U.S. federal income tax purposes under Sections 368(a)(1)(D) and 355 of the Code. The opinion was based on and relied on, among other things, certain facts and assumptions, as well as certain representations, statements and undertakings of eBay and of us, including those relating to the past and future conduct of eBay and of us. If any of these representations, statements or undertakings were, or became, inaccurate or incomplete, or if eBay or we breach any of our respective covenants in the separation documents, the opinion of counsel may be invalid and the conclusions reached therein could be jeopardized.

Notwithstanding the opinion of counsel, the IRS could determine that the distribution, together with certain related transactions, should be treated as a taxable transaction if the IRS determines that any of these representations, assumptions, or undertakings upon which such opinion was based are incorrect or have been violated or if the IRS disagrees with the conclusions in the opinion of counsel. An opinion of counsel is not binding on the IRS or any court and there can be no assurance that the IRS will not challenge the conclusions reached in the opinion. The IRS did not provide any opinion in advance of the separation that our proposed transaction is tax-free.

If the distribution, together with certain related transactions, failed to qualify as a transaction that is generally tax-free under Sections 368(a)(1)(D) and 355 of the Code, in general, eBay would recognize taxable gain as if it had sold the PayPal common stock in a taxable sale for its fair market value, eBay stockholders who received PayPal common stock in the distribution may be subject to tax as if they had received a taxable distribution equal to the fair market value of such shares and we could incur significant liabilities.

There are risks associated with certain agreements that we entered into with eBay at the separation.

In connection with the separation, we entered into a separation and distribution agreement with eBay as well as various other agreements, including an operating agreement, a tax matters agreement, an employee matters agreement, an intellectual property matters agreement, a data sharing addendum, and a product development agreement. The separation agreement, the tax matters agreement, the employee matters agreement, and the intellectual property matters agreement determine the allocation of assets and liabilities (including by means of licensing) between the companies following the separation for those respective areas and include associated indemnification obligations. The operating agreement, the data sharing addendum and the product development agreement establish certain commercial relationships between eBay and us related to payment processing, credit and data sharing. If we or eBay is unable to satisfy its performance, payment or indemnification obligations under these agreements, we could incur operational difficulties or losses or be required to make substantial indemnification or other payments to eBay.

Our relationship with eBay is governed in part by an operating agreement entered into at separation with a term of five years. This operating agreement defines a number of important elements of our commercial relationship with eBay, as well as certain obligations and limitations that limit PayPal’s provision of services to certain competitive platform operators of eBay (as specified in the operating agreement). eBay remains a significant source of our revenues and operating income. If our operating agreement with eBay expires or is terminated prior to its expiration, or if there is a significant change in our relationship with eBay, including if eBay becomes a merchant of record, eliminates or modifies any of its risk management or customer protection programs, directs transactions to a different provider of payment services or offers eBay customers alternative payment options, it could lead to customer dissatisfaction, reputational damage, and other adverse consequences, and our business, financial condition and results of operations could be materially harmed.

Risks Related to Our Common Stock

The price of our common stock has fluctuated and may continue to fluctuate significantly.

The price of our common stock has fluctuated and may continue to fluctuate significantly due to a number of factors, some of which may be beyond our control, including, but not limited to:

•	actual or anticipated fluctuations in our operating results;

•	changes in financial estimates by us or securities analysts and recommendations by securities analysts;

•	changes in our capital structure;

•	speculation, coverage or sentiment in the media or the investment community;

•	the operating and stock price performance of comparable companies;

•	changes to the regulatory and legal environment under which we operate; and

•	market conditions or trends in the payments industry, the industries of merchants and the domestic and worldwide economy as a whole.

Our amended and restated certificate of incorporation designates the state courts of the State of Delaware, or, if no state court located in the State of Delaware has jurisdiction, the federal court for the District of Delaware, as the sole and exclusive forum for certain types of actions and proceedings that may be initiated by our stockholders, which could discourage lawsuits against us and our directors and officers.

Our amended and restated certificate of incorporation provides that unless the corporation otherwise determines, the state courts of the State of Delaware, or, if no state court located in the State of Delaware has jurisdiction, the federal court for the District of Delaware, will be the sole and exclusive forum for any derivative action or proceeding brought on our behalf, any action asserting a claim of breach of a fiduciary duty owed by any of our directors or officers to us or our stockholders, any action asserting a claim against us or any of our directors or officers arising pursuant to any provision of the Delaware General Corporation Law (“DGCL”) or our amended and restated certificate of incorporation or bylaws, or any action asserting a claim against us or any of our directors or officers governed by the internal affairs doctrine. This exclusive forum provision may limit the ability of our stockholders to bring a claim in a judicial forum that such stockholders find favorable for disputes with us or our directors or officers, which may discourage such lawsuits against us and our directors and officers. Alternatively, if a court outside of Delaware were to find this exclusive forum provision inapplicable to, or unenforceable in respect of, one or more of the specified types of actions or proceedings described above, we could incur additional costs associated with resolving such matters in other jurisdictions, which could adversely affect our business, financial condition or results of operations.

Certain provisions in our amended and restated certificate of incorporation and bylaws may prevent or delay an acquisition of our company, which could decrease the trading price of our common stock.

Certain provisions in our amended and restated certificate of incorporation and amended and restated bylaws may have the effect of deterring coercive takeover practices and inadequate takeover bids by making such practices or bids unacceptably expensive to the bidder and by encouraging prospective acquirers to negotiate with our board of directors rather than to attempt a hostile takeover. These provisions include, among others:

•	rules regarding how stockholders may present proposals or nominate directors for election at stockholder meetings;

•	the fact that directors may not be elected, removed or replaced at stockholder-requested special meetings unless a person, entity or group owns at least a majority of our outstanding common stock;

•	the right of our board to issue preferred stock and to determine the voting, dividend and other rights of preferred stock without stockholder approval;

•	the ability of our directors, and not stockholders, to fill vacancies on our board of directors in most circumstances and to determine the size of our board of directors;

•	the prohibition on stockholders acting by written consent; and

•	the absence of cumulative rights in the election of directors.

We have also elected not to be governed by Section 203 of the DGCL, which provides that, subject to limited exceptions, persons that acquire, or are affiliated with a person that acquires, more than 15% of the outstanding voting stock of a Delaware corporation shall not engage in any business combination with that corporation, including by merger, consolidation or acquisitions of additional shares, for a three-year period following the date on which that person or its affiliates becomes the holder of more than 15% of the corporation’s outstanding voting stock. Our amended and restated certificate of incorporation, however, contains a provision that generally mirrors Section 203 of the DGCL, except that it provides for a 20% threshold instead of the 15% provided for by the DGCL. These provisions could delay or prevent a change of control that our stockholders may favor.

These provisions are not intended to make us immune from takeovers. However, these provisions will apply even if the offer may be considered beneficial by some stockholders and may delay or prevent an acquisition that our board of directors determines is not in the best interests of us and our stockholders. These provisions may also prevent or discourage attempts to remove and replace incumbent directors.