2.

Upon expiry of the retention period referred to in paragraph 1, payment service providers shall ensure that the personal data is deleted, unless otherwise provided for by national law, which shall determine under which circumstances payment service providers may or shall further retain the data. Member States may allow or require further retention only after they have carried out a thorough assessment of the necessity and proportionality of such further retention, and where they consider it to be justified as necessary for the prevention, detection or investigation of money laundering or terrorist financing. That further retention period shall not exceed five years.

← art_16__para_1__text_1 · All articles · art_16__para_2__text_1 →

Source: EUR-Lex (Cellar) · retrieved 2026-10-11 · Text as adopted (Official Journal); later amendments are not incorporated in this text.