PayPal Holdings (PYPL) Risk Analysis

Our business is subject to complex and changing laws, rules, regulations, policies, and legal interpretations in the markets in which we offer services directly or through partners, including, but not limited to, those governing: banking, credit, deposit taking, cross-border and domestic money transmission, prepaid access, foreign currency exchange, privacy, data protection, data governance, cybersecurity, banking secrecy, digital payments, cryptocurrency, payment services (including payment processing and settlement services), lending, fraud detection, consumer protection, antitrust and competition, economic and trade sanctions, anti-money laundering, and counter-terrorist financing. Regulators and legislators globally have been establishing, evolving, and increasing their regulatory authority, oversight, and enforcement in a manner that impacts our business. As we introduce new products and services and expand into new markets, including through acquisitions, we expect to become subject to additional regulations, restrictions, and licensing requirements. As we expand and localize our international activities, we expect that our obligations in the markets in which we operate will continue to increase. In addition, because we facilitate sales of goods and provide services to customers worldwide, one or more jurisdictions may claim that we or our customers are required to comply with their laws, which may impose different, more specific, or conflicting obligations on us, as well as broader liability. Any failure or perceived failure to comply with existing or new laws, regulations, or orders of any government authority (including changes to or expansion of their interpretation) may subject us to significant fines, penalties, monetary damages, injunctive relief, criminal and civil lawsuits, forfeiture of significant assets, and enforcement actions in one or more jurisdictions; result in additional compliance and licensure requirements; cause us to lose existing licenses or prevent or delay us from obtaining additional licenses that may be required for our business; increase regulatory scrutiny of our business; divert management's time and attention from our business; restrict our operations; lead to increased friction for customers; force us to make changes to our business practices, products, or operations; require us to engage in remediation activities; or delay planned transactions, product launches, or improvements. Any of the foregoing could, individually or in the aggregate, harm our reputation, damage our brands and business, and adversely affect our results of operations and financial condition. The complexity of U.S. federal and state and international regulatory and enforcement regimes, coupled with the global scope of our operations and the evolving global regulatory environment, could result in a single event prompting a large number of overlapping investigations and legal and regulatory proceedings by multiple government authorities in different jurisdictions. While we have implemented policies and procedures designed to help ensure compliance with applicable laws and regulations, there can be no assurance that our employees, contractors, and agents will not violate such laws and regulations. Payments Regulation In the U.S., PayPal, Inc. (a wholly-owned subsidiary) holds licenses to operate as a money transmitter (or its equivalent) in the states where such licenses are required, as well as in the District of Columbia and certain territories. If we fail to comply with applicable laws or regulations required to maintain our licenses, we could be subject to liability and/or additional restrictions, forced to cease doing business with residents of certain states or territories, forced to change our business practices, or required to obtain additional licenses or regulatory approvals, which could impose substantial costs and harm our business. While we currently allow our customers to send payments from approximately 200 markets, we allow customers in only approximately half of those markets (including the U.S.) to also receive payments, in some cases with significant restrictions on the manner in which customers can hold balances or withdraw funds. These restrictions may limit our ability to grow our business. We principally provide our services to customers in the European Economic Area ("EEA") through PayPal (Europe) S.à.r.l. et Cie, S.C.A. ("PayPal (Europe)"), our wholly-owned subsidiary that is licensed and subject to regulation as a credit institution in Luxembourg and PayPal U.K. Limited ("PayPal U.K."), a wholly-owned subsidiary that is subject to regulation as an electronic money institution and a consumer credit firm (and registration as a crypto asset business) in the United Kingdom ("U.K.") by the Financial Conduct Authority ("FCA"). PayPal (Europe) or PayPal U.K. may be subject to enforcement actions and significant fines and penalties if either violates applicable requirements. If the business activities of PayPal (Europe) exceed certain thresholds, or if the European Central Bank ("ECB") so determines, PayPal (Europe) may be deemed a significant supervised entity and certain activities of PayPal (Europe) would become directly supervised by the ECB, rather than by the Luxembourg Commission de Surveillance du Secteur Financier. PayPal (Europe) is also subject to regulation by the ECB under the oversight framework for electronic payment instruments, schemes and arrangements ("PISA"). Compliance with applicable laws and regulations could become more costly and operationally difficult to manage due to additional supervision, potentially inconsistent interpretations, and domestic regulations by various countries in the region. Applicable regulation relating to payments, anti-money laundering, and digital services, which are key focus areas of regulators and subject to extensive new regulation, could subject us to additional and complex obligations, risks, and associated costs, and impact our ability to expand our business in Europe. For many of the other markets outside the U.S., we provide services on a cross-border basis through PayPal Pte. Ltd., our wholly-owned subsidiary based in Singapore. PayPal Pte. Ltd. is supervised by the Monetary Authority of Singapore ("MAS"). As of July 1, 2023, PayPal Pte. Ltd. has been issued a Major Payment Institution license by the MAS under the Payment Services Act 2019. In order to maintain this license and certain other licenses or registrations we hold in certain markets, we are required to comply with applicable regulatory requirements, which have imposed and will continue to impose increasing operational complexity and costs for our Singapore and international operations. Moreover, in many non-U.S. markets (other than Singapore) where customers of PayPal Pte. Ltd. or local branches or subsidiaries subject to local regulatory supervision or oversight, as the case may be, are located, there may be uncertainty whether our Singapore-based service is subject only to Singapore law or also to other local laws, and whether such local laws might require a payment processor like us to be licensed as a payments service, bank, financial institution, or otherwise. There are substantial costs and potential product and operational changes involved in maintaining and renewing licenses, certifications, and approvals, and we could be subject to enforcement actions, fines, penalties, and litigation if we are found to violate any of these requirements. There can be no assurance that we will be able to (or decide to) continue to apply for or obtain any licenses, renewals, certifications, and approvals in any jurisdiction. In certain markets, we may need to rely on local banks or other partners to process payments and conduct foreign currency exchange transactions in local currency, and local regulators may use their authority over such local partners to prohibit, restrict, or limit us from doing business. Any of the foregoing could, individually or in the aggregate, result in substantial additional costs, delay or preclude planned transactions, geographical expansions, or product launches or improvements, require significant and costly operational changes, impose restrictions, limitations, or additional requirements on our business, products and services, or prevent or limit us from providing our products or services in a given market. Cryptocurrency Regulation and Related Risks Our customer cryptocurrency offerings could subject us to additional regulations, licensing requirements, or other obligations or liabilities. Within the U.S., we are regulated by the New York State Department of Financial Services as a virtual currency business, which does not qualify us to engage in securities brokerage or dealing activities. The regulatory status of particular cryptocurrencies is unclear under existing law. For example, if the Securities and Exchange Commission ("SEC") were to assert that any of the cryptocurrencies we support are securities, the SEC could assert that our activities involving that cryptocurrency require securities broker-dealer registration or other obligations under the federal securities laws. The rapidly evolving legislative and regulatory landscapes with respect to cryptocurrency may subject us to additional licensing and regulatory obligations or to additional inquiries or investigations from the SEC or other regulators and governmental authorities, and require us to make product changes, restrict or discontinue product offerings in certain markets, implement additional and potentially costly controls, or take other actions. In August 2023, a third-party issuer with which we have partnered commercially (the "PYUSD Issuer") launched a U.S. dollar-denominated stablecoin named PayPal USD ("PYUSD"), which is available to PayPal U.S. customers and Venmo customers. These PayPal and Venmo customers may, if provisioned for external transfers and subject to our sanctions and anti-money laundering controls, send PYUSD to external wallets not controlled by PayPal. The PYUSD Issuer may also allow institutional users to directly purchase PYUSD from the PYUSD Issuer (as per the PYUSD Issuer's stablecoin terms and conditions). The regulatory treatment of stablecoins is evolving and has drawn significant attention from legislative and regulatory bodies around the world, including the SEC. There are uncertainties on how ongoing changes to federal, state, and international laws and regulations would apply to stablecoins in practice, and we and the PYUSD Issuer may face substantial costs to operationalize and comply with any additional or changed requirement. If we or the PYUSD Issuer fail to comply with regulations, requirements, prohibitions or other obligations applicable to us, we could face regulatory or other enforcement actions, potential fines, penalties, and other consequences. In addition, we could face reputational harm through our relationship with the PYUSD Issuer if the PYUSD Issuer were to face regulatory scrutiny, PYUSD is deemed to be a security, or PYUSD is alleged to be used for transactions in connection with illicit or illegal activities. We hold our customers' cryptocurrency assets through one or more third-party custodians. Financial and third-party risks related to our customer cryptocurrency offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodians, insufficient insurance coverage by a custodian to reimburse us for all such losses, a custodian's failure to maintain effective controls over the custody and settlement services provided to us, a custodian's inability to purchase or liquidate cryptocurrency holdings, the failure of the PYUSD Issuer to maintain sufficient reserve assets backing PYUSD and defaults on financial or performance obligations by a custodian, banks with which the PYUSD Issuer maintains reserve assets or counterparty financial institutions, could expose our customers and us to loss, and significantly harm our business, financial condition, and reputation. We have selected custodian partners and the PYUSD Issuer, and may in the future select additional custodian partners and stablecoin issuing entities, that are subject to regulatory oversight, capital requirements, maintenance of audit and compliance industry certifications, and cybersecurity procedures and policies. Nevertheless, any operational disruptions at any such custodian or issuer, or such custodians' or issuer's failure to safeguard cryptocurrency holdings (or reserve assets), could result in losses of customer assets, expose us to customer claims, reduce consumer confidence and materially impact our cryptocurrency product offerings and our operating results. Custodial arrangements to safeguard cryptocurrency assets involve unique risks and uncertainties in the event of a custodian's bankruptcy. While other types of assets and some custodied cryptocurrencies have been deemed not to be part of the custodian's bankruptcy estate under various regulatory regimes, bankruptcy courts have not yet definitively determined the appropriate treatment of custodial holdings of digital assets in a bankruptcy proceeding. In the event of a custodian's bankruptcy, the lack of precedent and the highly fact-dependent nature of the determination could delay or preclude the return of custodied cryptocurrency assets to us or to our customers. Although we contractually require our custodians to segregate our customer assets and not commingle them with proprietary or other assets, we cannot be certain that these contractual obligations, even if duly observed by a custodian, will be effective in preventing such assets from being treated as part of the custodian's estate under bankruptcy or other insolvency law. In that event, our claim on behalf of such customers against a custodian's estate for our customers' cryptocurrency assets could be treated as a general unsecured claim against the custodian, in which case our customers could seek to hold us liable for any resulting losses. Lending Regulation We hold a number of U.S. state lending licenses for our U.S. consumer short-term installment loan product, which is subject to federal and state laws governing consumer credit and debt collection. Similarly, the consumer short-term installment loan products that we offer outside the U.S. may be subject to consumer credit legislation, licensing requirements, consumer lending laws, consumer protection or banking transparency regulations. Increased global regulatory focus on short-term installment products and consumer credit more broadly could result in laws or regulations requiring changes to our policies, procedures, operations, and product offerings, and restrict or limit our ability to offer credit products. Consumer Protection Violations of consumer protection law in applicable jurisdictions, including both federal and state laws and regulations in the U.S., such as the Electronic Fund Transfer Act ("EFTA") and Regulation E as implemented by the Consumer Financial Protection Bureau ("CFPB"), could result in the assessment of significant actual damages or statutory damages or penalties (including treble damages in some instances) and plaintiffs' attorneys' fees. We are subject to, and have paid amounts in settlement of, lawsuits containing allegations that our business violated the EFTA and Regulation E or otherwise advance claims for relief relating to our business practices (e.g., that we improperly held consumer funds or otherwise improperly limited consumer accounts). In addition, the CFPB, pursuant to its market-monitoring authority, may require us to provide extensive information on our products and offerings. From time to time, we have received orders from the CFPB pursuant to such market-monitoring authority requiring us to provide, among other items, extensive information on our payment products, including with respect to the collection, use of, and access to data and consumer protections, as well as our Buy Now, Pay Later offerings. Anti-Money Laundering and Counter-Terrorist Financing; Economic and Trade Sanctions Regulators globally continue to increase standards and expectations regarding anti-money laundering and counter-terrorist financing, and to expand the scope of existing laws and regulations to emerging products and markets, which may require us to revise or expand our compliance program globally and/or in specific jurisdictions, including the procedures we use to verify the identity of our customers and to monitor international and domestic transactions. Such changes could have the effect of making compliance more costly and operationally difficult to manage, lead to increased friction for customers, and result in a decrease in business. Regulators regularly re-examine the transaction volume thresholds at which we must obtain and keep applicable records or the circumstances in which we must verify identities of customers, and any change to such obligations could result in greater compliance costs and impact our business. We are also required to comply with economic and trade sanctions administered by the U.S., the European Union ("EU") and its member states, the U.K., and other jurisdictions in which we operate. Non-compliance with anti-money laundering laws and regulations or economic and trade sanctions may subject us to significant fines, penalties, lawsuits, and enforcement actions, result in regulatory sanctions and additional compliance requirements, increase regulatory scrutiny of our business, restrict our operations, and damage our reputation and brands. In the ordinary course of business we may identify and voluntarily report, and have reported, potential compliance issues to regulatory authorities, including the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"), and our compliance history may be considered by OFAC and other regulators as part of any potential future investigation of our sanctions regulation. Privacy and Protection of Customer Data The legal and regulatory environment relating to privacy and data protection laws continues to develop and evolve in ways we cannot predict, including with respect to technologies such as cloud computing, (generative) AI, machine learning, cryptocurrency, and blockchain technology. Any failure or alleged failure by us to comply with our privacy policies as communicated to customers or with privacy and data protection laws relating to our collection, use, storage, transfer, or sharing of customer data with third parties could result in proceedings or actions against us by data protection authorities, other government agencies, our customers or others, which could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, result in reputational harm, and materially harm our business. Compliance with inconsistent privacy and data protection laws may also restrict or limit our ability to provide products and services to our customers. Many jurisdictions in which we operate globally have enacted, or are in the process of enacting, data privacy legislation or regulations aimed at creating and enhancing individual privacy rights, including with respect to the use of personal data for personalization and cross-contextual advertising. For example, numerous U.S. states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and retention of their residents' personal information as well as specific privacy obligations around youth. The continued proliferation of privacy laws in the jurisdictions in which we operate is likely to result in a disparate array of privacy rules with unaligned or conflicting provisions, accountability requirements, individual rights, and national or local enforcement powers, which may subject us to increased regulatory scrutiny and business costs and could lead to unintended consumer confusion. Artificial Intelligence (AI) The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including in the areas of consumer protection, intellectual property, cybersecurity, and privacy and data protection. In addition, there is uncertainty around the validity and enforceability of intellectual property rights related to the use, development, and deployment of AI-generated outputs. Compliance with new and emerging laws, regulations or industry standards relating to AI in the U.S. and internationally, such as U.S. state regulations and the Artificial Intelligence Act in the EU, may impose significant operational costs and may limit our ability to develop, deploy or use existing or future AI technologies. As a result, our ability to adapt our existing products and services or develop future and new products and services using AI may be limited or restricted, which could adversely impact our business.