PayPal Holdings Inc.: 10-K Risk Factor Changes

Rapid, significant, and disruptive technological changes impact the industries in which we operate, including payment technologies (including real-time payments, payment card tokenization, virtual currencies, distributed ledger and blockchain technologies, and proximity payment technology such as Near Field Communication and other contactless payments); internet browser technologies that enable users to easily store their payment card information for use on any retail or e-commerce website; artificial intelligence (“AI”) and machine learning; developments in technologies supporting our regulatory and 15 15 15 15 Table of Contents Table of Contents compliance obligations; and in-store, digital, and social commerce. We expect that new technologies applicable to the industries in which we operate, including the development, adoption, and use of generative AI technologies, will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services. We cannot predict the effects of technological changes on our business, which technological developments or innovations will become widely adopted, and how those technologies may be regulated. Developing and incorporating new technologies into new and existing products and services may require significant investment, take considerable time, and may not ultimately be successful. For example, AI algorithms that we use may be flawed or may be based on datasets that are biased or insufficient. In addition, any latency, disruption, or failure in our AI systems or infrastructure could result in delays or errors in our offerings. There also may be real or perceived social harm, unfairness, or other outcomes that undermine public confidence in the use of our products or of AI. In addition, third parties may deploy AI technologies in a manner that reduces customer demand for our products and services. We rely in part on third parties, including some of our competitors, for the development of and access to new or evolving technologies. These third parties may restrict or prevent our access to, or utilization of, those technologies, as well as their platforms or products. Our ability to develop, provide or incorporate new technologies and adapt our existing products and services or develop future and new products and services using new technologies may be limited or restricted by industry-wide standards, platform providers, payments networks, changes to laws and regulations, changing customer expectations, third-party intellectual property rights, and other factors. If we are unable to develop and incorporate new technologies and adapt to technological changes and evolving industry standards in a timely or cost-effective manner, our business, results of operations, or reputation could be harmed.

Rapid, significant, and disruptive technological changes impact the industries in which we operate, including payment technologies (including real-time payments, payment card tokenization, virtual currencies, distributed ledger and blockchain technologies, and proximity payment technology such as Near Field Communication and other contactless payments); internet browser technologies, that enable users to easily store their payment card information for use on any retail or e-commerce website; artificial intelligence and machine learning; developments in technologies supporting our regulatory and compliance obligations; and in-store, digital, and social commerce. We expect that new technologies applicable to the industries in which we operate will continue to emerge and may be superior to, or render obsolete, the technologies we currently use in our products and services. We cannot predict the effects of technological changes on our business, which technological developments or innovations will become widely adopted, and how those technologies may be regulated. Developing and incorporating new technologies into new and existing products and services may require significant investment, take considerable time, and may not ultimately be successful. We rely in part on 17 17 17 17 Table of Contents Table of Contents third parties, including some of our competitors, for the development of and access to new or evolving technologies. These third parties may restrict or prevent our access to, or utilization of, those technologies, as well as their platforms or products. Our ability to develop, provide or incorporate new technologies and adapt our existing products and services or develop future and new products and services using new technologies may be limited or restricted by industry-wide standards, platform providers, payments networks, changes to laws and regulations, changing customer expectations, third-party intellectual property rights, and other factors. If we are unable to develop and incorporate new technologies and adapt to technological changes and evolving industry standards in a timely or cost-effective manner, our business could be harmed.

Adverse global and regional economic conditions such as turmoil affecting the banking system or financial markets, including, but not limited to, tightening in the credit markets, extreme volatility or distress in the financial markets (including the fixed 25 25 25 25 Table of Contents Table of Contents income, credit, currency, equity, and commodity markets), unemployment, consumer debt levels, recessionary or inflationary pressures, supply chain issues, reduced consumer confidence or economic activity, government fiscal, monetary and tax policies, U.S. and international trade relationships, agreements, treaties, tariffs and restrictive actions, the inability of a government to enact a budget in a fiscal year, government shutdowns, government austerity programs, geopolitical conditions or events, and other negative financial news or macroeconomic developments could have a material adverse impact on the demand for our products and services, including a reduction in the volume and size of transactions on our payments platform. Additionally, any inability to access the capital markets when needed due to volatility or illiquidity in the markets, liquidity needs due to unanticipated reductions in customer balances, or increased regulatory liquidity and capital requirements may strain our liquidity position. Such conditions may also expose us to fluctuations in foreign exchange rates or interest rates that could materially and adversely affect our financial results.

27 27 27 27 Table of Contents Table of Contents Adverse global and regional economic conditions such as turmoil affecting the banking system or financial markets, including, but not limited to, tightening in the credit markets, extreme volatility or distress in the financial markets (including the fixed income, credit, currency, equity, and commodity markets), higher unemployment, high consumer debt levels, recessionary or inflationary pressures, supply chain issues, reduced consumer confidence or economic activity, government fiscal, monetary and tax policies, U.S. and international trade relationships, agreements, treaties, tariffs and restrictive actions, the inability of a government to enact a budget in a fiscal year, government shutdowns, government austerity programs, and other negative financial news or macroeconomic developments could have a material adverse impact on the demand for our products and services, including a reduction in the volume and size of transactions on our payments platform. Additionally, any inability to access the capital markets when needed due to volatility or illiquidity in the markets or increased regulatory liquidity and capital requirements may strain our liquidity position. Such conditions may also expose us to fluctuations in foreign currency exchange rates or interest rates that could materially and adversely affect our financial results.

An increasing number of U.S. states, the U.S. federal government, and governments of foreign jurisdictions, such as the EU Commission, as well as international organizations, such as the Organization for Economic Co-operation and Development (“OECD”), are focused on tax reform and other legislative or regulatory action to increase tax revenue. These actions may 27 27 27 27 Table of Contents Table of Contents materially and adversely affect our effective tax rate, net income, and cash flows. Specifically, the OECD has published model rules and is coordinating negotiations among participating countries with the goal of achieving consensus on significant changes to international tax rules, including the implementation of a global minimum tax rate of 15%, commonly referred to as Pillar Two. Each individual jurisdiction will need to enact minimum tax legislation which may result in various interpretations of the OECD model rules and applicable timelines. Certain countries in which we do business have enacted implementing legislation effective January 1, 2024. As additional jurisdictions enact similar legislation, transition rules expire, and other provisions of the minimum tax legislation become effective, our effective tax rate and cash tax payments could increase in future years. The impact will depend on several factors including U.S and foreign tax legislation as well as our overall tax profile. A number of details around the provisions are still uncertain as the OECD and individual jurisdictions continue to issue guidance. The determination of our worldwide provision for income taxes and other tax liabilities requires estimation and significant judgment, and there are many transactions and calculations for which the ultimate tax determination is uncertain. We are currently undergoing a number of investigations, audits, and reviews by tax authorities in multiple U.S. and foreign tax jurisdictions. Any adverse outcome of any such audit or review could result in unforeseen tax-related liabilities that differ from the amounts recorded in our financial statements, which may, individually or in the aggregate, materially affect our financial results in the periods for which such determination is made. While we have established reserves based on assumptions and estimates that we believe are reasonable to cover such eventualities, these reserves may prove to be insufficient. In addition, our future income taxes could be adversely affected by changes in our geographical mix of income and impacts of statutory tax rates; by changes in the valuation of our deferred tax assets and liabilities, including as a result of gains on our foreign exchange risk management program; by changes in tax laws, regulations, or accounting principles; or by certain discrete items. A number of U.S. states, the U.S. federal government, and foreign jurisdictions have implemented and may impose reporting or record-keeping obligations on companies that engage in or facilitate e-commerce to improve tax compliance. A number of jurisdictions are also reviewing whether payment service providers and other intermediaries could be deemed to be the legal agent of merchants for certain tax purposes. We have modified our systems to meet applicable requirements and expect that further modifications will be required to comply with future requirements, which may negatively impact our customer experience and increase operational costs. Any failure by us to comply with these and similar reporting and record-keeping obligations could result in substantial monetary penalties and other sanctions, adversely impact our ability to do business in certain jurisdictions, and harm our business.

An increasing number of U.S. states, the U.S. federal government, and governments of foreign jurisdictions, such as the EU Commission, as well as international organizations, such as the Organization for Economic Co-operation and Development (“OECD”), are focused on tax reform and other legislative or regulatory action to increase tax revenue. For example, various countries have proposed or enacted digital services taxes and global minimum tax provisions under the Pillar Two OECD model rules. These actions may materially and adversely affect our effective tax rate, net income, and cash flows. The determination of our worldwide provision for income taxes and other tax liabilities requires estimation and significant judgment, and there are many transactions and calculations for which the ultimate tax determination is uncertain. We are currently undergoing a number of investigations, audits, and reviews by tax authorities in multiple U.S. and foreign tax jurisdictions. Any adverse outcome of any such audit or review could result in unforeseen tax-related liabilities that differ from the amounts recorded in our financial statements, which may, individually or in the aggregate, materially affect our financial results in the periods for which such determination is made. While we have established reserves based on assumptions and estimates that we believe are reasonable to cover such eventualities, these reserves may prove to be insufficient. In addition, our future income taxes could be adversely affected by the incurrence of losses or earnings being lower than anticipated in jurisdictions that have lower statutory tax rates, and earnings being higher than anticipated in jurisdictions that have higher statutory tax rates; by changes in the valuation of our deferred tax assets and liabilities, including as a result of gains on our foreign currency exchange risk management program; by changes in tax laws, regulations, or accounting principles; or by certain discrete items. A number of U.S. states, the U.S. federal government, and foreign jurisdictions have implemented and may impose reporting or record-keeping obligations on companies that engage in or facilitate e-commerce to improve tax compliance. A number of jurisdictions are also reviewing whether payment service providers and other intermediaries could be deemed to be the legal agent of merchants for certain tax purposes. We have modified our systems to meet applicable requirements and expect that further modifications will be required to comply with future requirements, which may negatively impact our customer experience and increase operational costs. Any failure by us to comply with these and similar reporting and record-keeping obligations could result in substantial monetary penalties and other sanctions, adversely impact our ability to do business in certain jurisdictions, and harm our business.

We may be subject to claims relating to information disseminated through our online services by our customers and other third parties, including, but not limited to, claims alleging defamation, libel, harassment, hate speech, breach of contract, invasion of privacy, negligence, copyright or trademark infringement, or other theories based on the nature and content of the materials disseminated through the services. We invest in measures intended to detect and block activities that may occur on our payments platform in violation of our policies and applicable laws. These measures require continuous improvement and may not be sufficiently effective in detecting and preventing the exchange of information in violation of our policies and applicable laws, which could negatively impact our business. If the laws or regulations that provide protections for online dissemination of information are invalidated, modified, or supplemented to reduce protections available to us, or to increase requirements on us to remove certain information or implement other processes, we could be harmed and may be forced to implement new measures to reduce our potential liability for information provided by our customers and carried on our products and services. This increased risk could require us to expend substantial resources or discontinue certain product or service offerings, which could harm our business. 28 28 28 28 Table of Contents Table of Contents

We may be subject to claims relating to information disseminated through our online services, including claims alleging defamation, libel, harassment, hate speech, breach of contract, invasion of privacy, negligence, copyright or trademark infringement, or other theories based on the nature and content of the materials disseminated through the services, among other things. We invest in measures intended to detect and block activities that may occur on our payments platform in violation of our policies and applicable laws. These measures require continuous improvement and may not be sufficiently effective in detecting and preventing the exchange of information in violation of our policies and applicable laws. If these measures are not sufficiently effective, our business could be negatively impacted. If the laws or regulations that provide protections for online dissemination of information are invalidated or are modified to reduce protections available to us and we become liable for information provided by our customers and carried on our products and services, we could be directly harmed and we may be forced to implement new measures to reduce our exposure, including expending substantial resources or discontinuing certain product or service offerings, which could harm our business.

We rely on third parties in many aspects of our business, including, but not limited to, networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions; unaffiliated third-party lenders to originate our U.S. credit products to consumers, U.S. merchant financing, and branded credit card products; branded debit card and savings products issued by unaffiliated banks; cryptocurrency custodial service providers; and external business partners and contractors who provide key functions (including, but not limited to, data center facilities and cloud computing, information technology, and outsourced customer support and product development functions). We are subject to additional risks inherent in engaging and relying upon third-party providers, including operational, legal, regulatory, information security, reputational, commercial, and resiliency risks. If we are unable to effectively manage our third-party relationships, these third parties are unable to meet their obligations to us, we are overly reliant on certain relationships, or we experience substantial disruptions in these relationships (including interruptions to the availability of our products and services), our operations, results of operations, and financial results could be adversely impacted. Additionally, our relationships with third parties inherently involve a lesser degree of control over business operations, governance, and compliance, which potentially increases our financial, legal, reputational, and operational risk.

We rely on third parties in many aspects of our business, including networks, banks, payment processors, and payment gateways that link us to the payment card and bank clearing networks to process transactions; unaffiliated third-party lenders to originate our U.S. credit products to consumers, U.S. merchant financing, and branded credit card products; branded debit card and savings products issued by unaffiliated banks; cryptocurrency custodial service providers; and external business partners and contractors who provide key functions (e.g., outsourced customer support and product development functions; facilities; information technology, data center facilities and cloud computing). We are subject to additional risks inherent in engaging and relying upon third-party providers, including legal, regulatory, information security, reputational and operational risks. We are undertaking efforts to diversify our reliance on a small number of third-party payment processors in various markets. We are working with our primary payment processor in the U.S. to facilitate the migration of our arrangements to other payment processors over a transition period in connection with the wind-down of our agreement; however, if we are unable to timely and efficiently migrate our business to other payment processors or experience disruptions in connection with this transition, our business could be harmed. If we are unable to effectively manage our third-party relationships, these third parties are unable to meet their obligations to us, or we experience substantial disruptions in these relationships, our operations, results of operations, and financial results could be adversely impacted. Additionally, our relationships with third parties inherently involve a lesser degree of control over business operations, governance, and compliance, which potentially increases our financial, legal, reputational, and operational risk.

Various jurisdictions are adopting or considering new laws and regulations that expand mandatory disclosure, reporting and diligence requirements with respect to ESG matters. If we are unable to comply with new laws and regulations concerning ESG matters or fail to meet investor, industry or stakeholder expectations and standards, our reputation may be harmed, customers may choose to refrain from using our products and services, we may be subject to fines, penalties, regulatory or other enforcement actions, and our business or financial condition may be adversely affected. If our ESG-related data, processes and reporting are viewed as incomplete or inaccurate, or if we fail to achieve progress with respect to ESG-related goals on a timely basis or at all, we may be viewed negatively by stakeholders concerned about these matters. Moreover, investors, customers, partners, media, government entities, and other stakeholders (including those in support of or in opposition to ESG principles) may have a negative view of us to the extent we are perceived to have not responded appropriately to their ESG concerns or take positions that are contrary to their views or expectations. We recognize that climate-related risks may impact our business. For example, California, where our headquarters are located, has historically experienced, and is projected to continue to experience, extreme weather and natural disaster events more frequently, including drought, flooding, heat waves, and wildfires. Such events may disrupt our business and may cause us to experience additional costs to maintain or resume operations. 26 26 26 26 Table of Contents Table of Contents

Investors, customers, employees, regulators, legislators and other stakeholders are increasingly focused on ESG matters and related disclosures, including with respect to cybersecurity, data privacy and protection, global talent and climate. If we are unable to comply with new laws and regulations or changes to legal or regulatory requirements concerning ESG matters, or fail to meet investor, industry or stakeholder expectations and standards, our reputation may be harmed, customers may choose to refrain from using our products and services, we may be subject to fines, penalties, regulatory or other enforcement actions, and our business or financial condition may be adversely affected. We may also experience additional scrutiny or criticism from investors, customers, partners, media, government entities, and other stakeholders if they perceive PayPal to not have acted appropriately with respect to ESG matters. If our ESG-related data, processes and reporting are incomplete or inaccurate, or if we fail to achieve progress with respect to ESG-related goals on a timely basis, or at all, our reputation, business, financial performance and growth could be adversely affected. We specifically recognize the inherent physical climate-related risks where we conduct business. Our primary locations may be vulnerable to the adverse effects of climate change. For example, California, where our headquarters are located, has 28 28 28 28 Table of Contents Table of Contents historically experienced, and is projected to continue to experience, extreme weather and natural disaster events more frequently, including drought, water scarcity, flooding, heat waves, wildfires and resultant air quality impacts, and power shutoffs associated with wildfire prevention. Such events may disrupt our business and may cause us to experience additional costs to maintain or resume operations and higher attrition.