1.   The processing of personal data under this Regulation is subject to Directive 95/46/EC, as transposed into national law. Personal data that is processed pursuant to this Regulation by the Commission or by the ESAs is subject to Regulation (EC) No 45/2001.

2.   Personal data shall be processed by payment service providers on the basis of this Regulation only for the purposes of the prevention of money laundering and terrorist financing and shall not be further processed in a way that is incompatible with those purposes. The processing of personal data on the basis of this Regulation for commercial purposes shall be prohibited.

3.   Payment service providers shall provide new clients with the information required pursuant to Article 10 of Directive 95/46/EC before establishing a business relationship or carrying out an occasional transaction. That information shall, in particular, include a general notice concerning the legal obligations of payment service providers under this Regulation when processing personal data for the purposes of the prevention of money laundering and terrorist financing.

4.   Payment service providers shall ensure that the confidentiality of the data processed is respected.