PARTI Item1A.RiskFactors to comply with economic and trade sanctions administered by the U.S., the EU and its member states, the U.K., and other jurisdictions in which we operate. Non-compliance with anti-money laundering laws and regulations or economic and trade sanctions may subject us to significant fines, penalties, lawsuits, and enforcement actions, result in regulatory sanctionsandadditionalcompliancerequirements,increaseregulatoryscrutinyof our business,restrictour operations,and damage our reputation and brands. Our compliance history may be considered by OFAC and other regulators as part of anypotentialfutureinvestigationof our sanctionsregulation. PrivacyandProtectionofCustomerData Thelegal and regulatory environment relating to privacy and data protection laws continues to develop and evolve in ways we cannot predict, including with respect to technologies such as cloud computing, artificial intelligence, machine learning, cryptocurrency,and blockchaintechnology.Any failure or alleged failure by us to comply with our privacy policies as communicatedto customers or with privacy and data protection laws could result in proceedings or actions against us by data protection authorities, other government agencies, or others, which could subject us to significant fines, penalties, ANNU judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, result in reputational harm, and materially harm our business. Compliance with inconsistent privacy and data AL protectionlawsmayalsorestrictorlimitourabilitytoprovideproductsandservicestoourcustomers. REPOR PayPal relies on a variety of compliance methods to transfer personal data of EEA individuals to the U.S., including Binding Corporate Rules for internal transfers of certain types of personal data and Standard Contractual Clauses (“SCCs”) as T approved by the European Commission for transfers to and from third parties. In June 2021, the European Commission imposed new SCC requirements which impose certain contract and operational requirements on PayPal, its merchants, and vendors to adhere to certain affirmative duties, including requirements related to government access transparency, enhanced data subject rights, and broader third-party assessments to ensure safeguards necessary to protect personal dataexportedfromPayPalsEEAcustomersand/oremployeestocountriesoutsidetheEEA.TotheextentwerelyonSCCs, we will potentially need to enter into new contractual arrangements reflecting the updated SCC requirements to avoid limitations on PayPals ability to process EEA data in countries outside of the EEA. Manyjurisdictions in which we operate globally have enacted, or are in the process of enacting, data privacy legislation or regulations aimed at creating and enhancing individual privacy rights. For example, numerous U.S. states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and retention of their residents personal information. The continued proliferation of privacy laws in the jurisdictions in which we operate is likely to result in a disparate array of privacy rules with unaligned or conflicting provisions, accountability requirements, individual rights, and national or local enforcement powers, which may subject us to increased regulatory scrutiny and businesscosts,andcouldleadtounintendedconsumerconfusion. Wearesubjecttoregulatoryscrutinyandmaybesubjecttolegalproceedingsunderantitrustand competitionlaws. Wearesubjecttoscrutinyby various governmentagenciesregardingantitrust and competitionlaws and regulations in the U.S. and internationally, including in connection with proposed or implemented business combinations, acquisitions, investments, partnerships, commercial agreements and business practices. Some jurisdictions also provide private rights of action for competitors or consumers to assert claims of anticompetitive conduct. Companies and government agencies havein the past alleged, and may in the future allege, that our actions violate the antitrust or competition laws in the U.S. or other jurisdictions in which we operate or otherwise constitute unfair competition, or that our products and services are used so broadly that otherwise uncontroversial business practices could be deemed anticompetitive. Any claims or investigations, even if without merit, may be costly to defend or respond to, involve negative publicity, and cause substantial diversion of managements time and effort, and could result in reputational harm, significant judgments, fines and other remedial actions against us, require us to change our business practices, make product or operational changes, or delay or precludeplannedtransactions,productlaunchesorimprovements. Weareregularlysubjecttogenerallitigation,regulatoryscrutiny,andgovernmentinquiries. Weareregularlysubjectto claims, individual and class action lawsuits, arbitration proceedings, government and regulatory investigations, inquiries, actions or requests, and other proceedings alleging violations of laws, rules, and regulations with respectto competition, antitrust, intellectual property, privacy, data protection, information security, anti-money laundering, counter-terrorist financing, sanctions, anti-bribery, anti-corruption, consumer protection (including unfair, deceptive, or abusive acts or practices), fraud, accessibility, securities, tax, labor and employment, commercial disputes, services, charitable fundraising, contract disputes, escheatment of unclaimed or abandoned property, product liability, use of our services for illegal purposes, the matters described in “Note 13—Commitments and Contingencies—Litigation and Regulatory Matters—General Matters” to our consolidated financial statements, and other matters. The number and •2022AnnualReport 19