--- instrument_id: psr chunk_id: psr_t01 chunk_title: "SUBJECT MATTER, SCOPE AND DEFINITIONS" path: Title I source_class: operative_text document_type: proposal normative_weight: non_binding legal_status: council_compromise_text jurisdiction: EU effective_period: from: null to: null articles_contained: - 1 - 2 - 3 topics: - payments - payment_services - scope - general_provisions - definitions - authorisation - investment_funds - crypto_assets - fraud_prevention - strong_customer_authentication - payment_systems - funds_transfer - consolidation recitals: - number: 24 text: "So-called digital ‘pass-through wallets’, involving either the tokenisation of an existing payment instrument, for example a payment card, or a credit transfer from a payment account, are to be considered as technical services and should thus be excluded from the definitions of payment instrument and of payment initiation service, provided that no funds are stored in the digital wallet, that the digital wallet provider never enters into possession of such funds and that the wallet provider operates under contractual arrangements within a closed system with the payment service providers servicing the payer's payment account or issuing the payer's payment instrument. A token cannot be regarded as being itself a payment instrument but, rather, a ‘payment application’ within the meaning of Article 2(21) of Regulation (EU) 2015/751 of the European Parliament and of the Council.9 However, some other categories of digital wallets, namely pre-funded electronic wallets such as ‘staged-wallets’, characterised by a funding-stage and a payment-stage, should be considered a payment instrument and their issuance a payment service. This includes both wallets where users store funds in advance for future transactions and wallets where the funding stage and the payment stage occur simultaneously at the time of the transaction, including where the wallet is automatically funded, in whole or in part, from a linked payment instrument or account." - number: 45 text: "To be able to make an informed choice payment service users should be able to compare Automatic Teller Machine (ATM) charges with those of other providers. To increase the transparency of ATM charges for the payment service user, payment service providers should provide payment service users with information, on paper or on another durable medium, on all applicable charges for domestic ATM withdrawals in different situations, depending on the ATM from which the payment service users withdraw cash. For ATM withdrawals denominated in euro, any charges payable by payment service users to their payment service provider, including where withdrawals are made at ATMs operated by independent ATM deployers, should be subject to the principle of equality of charges, as set out in Article 3 of Regulation (EU) 2021/1230. That Regulation should be amended accordingly." - number: 86b text: "Given that fraud is a criminal activity in accordance with Article 2, point (1), of Directive (EU) 2018/1673, it is therefore considered a predicate offence for the purposes of Regulation (EU) 2024/1624. For that reason, the obligations laid down in that Regulation regarding the reporting of suspicious transactions in accordance with Article 69 of that Regulation, and regarding the obligation to refrain from executing those suspicious transactions in accordance with Article 71 of that Regulation, apply also in cases where a payment service provider knows or suspects that a payment transaction is fraudulent. Those obligations also apply where the payment service provider has reasonable grounds to suspect that a payment transaction is related to criminal activity, such as where the payer’s payment service provider has reasonable grounds to suspect that a payment transaction that the payer is initiating may be the result of fraud, or where, before making the funds available to the payee, the payee’s payment service provider has reasonable grounds to suspect that a payment transaction that has been or will be credited to its account may be the result of fraud." - number: 96c text: "With regard to providers of intermediary services, Regulation (EU) 2022/2065 sets up a fully harmonised framework for the conditional exemption from liability of those providers, under certain conditions and as interpreted by the Court of Justice of the European Union. In order to benefit from the exemption from liability for hosting services under Regulation (EU) 2022/2065, providers of hosting services including online platforms, should remove illegal content or disable access to it, expeditiously, upon obtaining actual knowledge or, in the case of claims for damages, upon becoming aware of the content, in particular in cases in which the provider of hosting services has been made aware of facts or circumstances on the basis of which a diligent economic operator should have identified the illegality in question. In particular with regard to providers of hosting services as defined in Article 3(g)(iii) of the Digital Services Act, where those conditions for exemption from liability under Article 6(1) of Regulation (EU) 2022/2065 are not met, and hosting service providers become liable for content stored in their services, and where that content gave rise to one or a series of unauthorized payment transactions or fraudulent authorized payment transactions within the meaning of this Regulation, payment service providers should be able to obtain compensation from hosting services providers for the amount refunded to their customers for those transactions under this Regulation." - number: 102a text: "Payment service providers should store data processed for the purpose of complying with their obligations with respect to transaction monitoring and fraud information sharing only for as long as necessary for those purposes, and in any event, only for a maximum of five years after the termination of the customer relationship. The revised FATF Recommendations demonstrate that, in order to be able to cooperate fully and comply swiftly with information requests from competent authorities for the purposes of the prevention, detection or investigation of money laundering and terrorist financing, obliged entities should maintain, for at least 5 years, the necessary information obtained through customer due diligence measures and the records on transactions. Accordingly, Regulation (EU) 2024/1624 establishes that the retention period applicable to personal data processed in accordance with that Regulation, including as regards information processed in the context of information sharing partnerships established under Article 75 of that Regulation, should be fixed at 5 years after the end of a business relationship or an occasional transaction. Given that fraud is considered to be a criminal activity, in accordance with Article 2, point (1), of Directive (EU) 2018/1673, and is therefore considered a predicate offence for the purposes of Regulation (EU) 2024/1624, it is appropriate to establish that a maximum retention period applicable to personal data processed in accordance with this Regulation should also be fixed at 5 years after the end of a business relationship or an occasional transaction, in order to ensure legal certainty and consistency across financial crime preventative and detection measures." - number: 106b text: "Member States should ensure that sufficient funding is available for such awareness raising and education measures, and that they are adequately targeted, in particular to the needs and interests of vulnerable consumer groups, including young and elderly people and those with low digital skills. Payment service providers, providers of interpersonal communication services as defined in Article 2(4), point (b), of Directive (EU) 2018/1972, and providers of very large online platforms and very large online search engines within the meaning of Regulation (EU) 2022/2065 should cooperate with the Member States in the development and updating of such fraud awareness campaigns, including by providing information on fraud threats and patterns identified in their services, and best practices in terms of users' awareness. Such cooperation should be free of charge, within reasonable and proportionate terms." --- # Title I - SUBJECT MATTER, SCOPE AND DEFINITIONS ## Article 1 - Subject matter 1. This Regulation lays down uniform requirements on the provision of payment services, as regards: (a) the transparency of conditions and information requirements for payment services; (b) the respective rights and obligations of payment service users, and of payment service providers in relation to the provision of payment services. 2. Unless specified otherwise, any reference to payment services shall be understood in this Regulation as meaning payment services as referred to in Annex I of [PSD3]. ## Article 2 - Scope 1. This Regulation applies to payment services provided within the Union by the following categories of payment service providers: (a) credit institutions as defined in Article 4(1), point (1) of Regulation (EU) No 575/2013 of the European Parliament and of the Council25, including branches thereof where such branches are located in the Union, whether the head offices of those are located within the Union or outside the Union; (b) post office giro institutions which are entitled under national law to provide payment services; (c) payment institutions; (d) the ECB and national central banks when not acting in their capacity as monetary authority or other public authorities; (e) Member States or their regional or local authorities when not acting in their capacity as public authorities. 25 Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1). 1a. This Regulation also applies to services provided within the Union by the following entities: (a) technical service providers, for the purposes of Articles 23(2), 58, 87, 88a, 89, 91 and 93; (b) operators of payment systems and payment schemes, for the purposes of Articles 31, 80, 91 and 93, payment schemes for the purpose of Articles 31a 58 and processing entities for Article 31a; (c) providers of electronic communications services as defined in Article 2(4), point (b), of Directive (EU)2018/1972, for the purposes of Articles 59, 59a, 84, 88a, 91 and 93; (ee) providers of electronic communications services as defined in Article 2(4), of Directive (EU)2018/1972, for the purposes of Article 88a; (ef) providers of hosting services, for the purposes of Articles 59a, 78 and 91; (eg) providers of very large online platforms and of very large online search engines within the meaning of Article 33 of Regulation (EU) 2022/2065 for the purposes of Articles 59a, 59b, 84 and 89a; (eh) original equipment manufacturers of mobile devices for the purposes of Article 88a. 2. This Regulation does not apply to the following: (a) payment transactions made exclusively in cash directly from the payer to the payee, without any intermediary intervention; (a1) payment transactions made exclusively in electronic money tokens directly from the payer to the payee, without any intermediary intervention; (b) payment transactions from the payer to the payee through a commercial agent, provided that the following conditions are met: (i) the commercial agent is authorised via an agreement to negotiate or conclude the sale or purchase of goods or services on behalf of only the payer or only the payee, but not both of them; and (ii) such agreement gives the commercial agent a real scope to negotiate with the payer or payee or conclude the sale or purchase of goods or services; (c) payment transactions consisting of the non-professional cash collection and delivery within the framework of a non-profit or charitable activity; (d) services where cash is provided by the payee to the payer as part of a payment transaction for the purchase of goods and services, following an explicit request by the payment service user just before the execution of the payment transaction; (e) services where retail stores agree to provide cash following an explicit request by the payment service user but independently of the execution of any payment transaction and without any obligation to make a purchase of goods and services; (f) payment transactions based on any of the following documents drawn on the payment service provider to place funds at the disposal of the payee: (i) paper cheques governed by the Geneva Convention of 19 March 1931 providing a uniform law for cheques; (ii) paper cheques similar to those referred to in point (i) and governed by the laws of Member States which are not party to the Geneva Convention of 19 March 1931 providing a uniform law for cheques; (iii) paper-based drafts referred to in the Geneva Convention of 7 June 1930 providing a uniform law for bills of exchange and promissory notes; (iv) paper-based drafts similar to those referred to in point (iii) and governed by the laws of Member States which are not party to the Geneva Convention of 7 June 1930 providing a uniform law for bills of exchange and promissory notes; (v) paper-based vouchers or physical vouchers of similar nature; (vi) paper-based traveller’s cheques; (vii) paper-based postal money orders as defined by the Universal Postal Union; (g) payment transactions carried out within a payment or securities settlement system between settlement agents, central counterparties, clearing houses or central banks and other participants of the system, and payment service providers, without prejudice to Article 31; (h) payment transactions related to securities asset servicing, including dividends, income or other distributions, or redemption or sale, carried out by persons as referred to in point (g) or by investment firms, credit institutions, collective investment undertakings or asset management companies providing investment services and any other entities allowed to have the custody of financial instruments; (ha) payments transactions carried out by a crypto-asset service provider intermediating between a buyer and a seller where electronic money tokens are exchanged for other electronic money tokens or for crypto-assets, as well as the exchange of electronic money tokens for funds, including electronic money tokens, or crypto- assets carried out by a crypto-asset service provider acting in its own name as buyer or seller of those electronic money tokens; (j) services based on specific payment instruments, including electronic money-based instruments, that meet one of the following conditions: (i) instruments allowing the holder to acquire goods or services only in the premises, including physical premises or online stores, of the issuer or within a single limited network of service providers under direct commercial agreement with a professional issuer; (ii) instruments which can be used only to acquire a very limited range of goods or services, including instruments restricted to be used in transactions between payment service users who are not consumers; (iii) instruments valid only in a single Member State, which are provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer, and which cannot be converted into cash; (k) payment transactions by a provider of electronic communications networks as defined in Article 2, point (1), of Directive (EU) 2018/1972 of the European Parliament and of the Council26, or services provided in addition to electronic communications services as defined in Article 2, point (4), of that Directive to a subscriber to the network or service: (i) to purchase digital content and voice-based services, regardless of the device used for the purchase or consumption of the digital content and charged to the related bill; or (ii) performed from or via an electronic device and charged to the related bill within the framework of a charitable activity or for the purchase of tickets; provided that the value of any single payment transaction does not exceed EUR 60 and: - the cumulative value of payment transactions for an individual subscriber does not exceed EUR 360 per month, or - where a subscriber pre-funds its account with the provider of the electronic communications network or service, the cumulative value of payment transactions does not exceed EUR 360 per month; 26 Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (OJ L 321, 17.12.2018, p. 36). (l) payment transactions carried out between payment service providers, their agents or branches for their own account; (la) payment transactions carried out between crypto-asset service providers or their branches for their own account; (m) payment transactions and related services between a parent undertaking and its subsidiary or between subsidiaries of the same parent undertaking, without any intermediary intervention by a payment service provider other than an undertaking belonging to the same group, and the collection of payment orders on behalf of a group by a parent undertaking or its subsidiary for onward transmission to a payment service provider. (n) professional physical transport of banknotes and coins, including their collection, processing and delivery; (o) cash-to-cash currency exchange operations where the funds are not held on a payment account. 3. Titles II and III apply to payment transactions in the currency of a Member State where both the payer’s payment service provider and the payee’s payment service provider are, or the sole payment service provider in the payment transaction is, located within the Union. 4. Title II, except for Article 13(1), point (b), Article 20, point (b)(v) and Article 24, point (a), and Title III, except for Articles 67 to 72, apply to payment transactions in a currency that is not the currency of a Member State, where both the payer’s payment service provider and the payee’s payment service provider are, or the sole payment service provider in the payment transaction is, located within the Union, in respect to those parts of the payments transaction which are carried out in the Union. 5. Title II, except for Article 13(1), point (b), Article 20, point (b)(v) and point (e)(viii) and Article 24, point (a), and Title III, except for Article 28(2) and (3), Articles 50, 57, 62, 63 and 67, Article 69(1), and Articles 75 and 78, apply to payment transactions in all currencies where only one of the payment service providers is located within the Union, in respect to those parts of the payments transaction which are carried out in the Union. 6. Member States may exempt institutions referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU from the application of all or part of the provisions of this Regulation. 7. By [ OP please insert the date= one year after the date of entry into force of this Regulation], the EBA shall issue Guidelines in accordance with Article 16 of Regulation (EU) No 1093/2010, addressed to the competent authorities designated under this Regulation, on the exclusion for payment transactions from the payer to the payee through a commercial agent referred to in paragraph 2, point (b) of this Article. 8. The EBA shall develop draft Regulatory Technical Standards to specify the conditions of the exclusions referred to in paragraph 2, point (j). The EBA shall take into account the experience acquired in the application of the EBA guidelines of 24 February 2022 on the limited network exclusion under Directive (EU) 2015/2366. The EBA shall submit the Regulatory Technical Standards referred to in the first subparagraph to the Commission by [ OP please insert the date= one year after the date of entry into force of this Regulation]. Power is delegated on the Commission to adopt the Regulatory Technical Standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. 9. Member States shall notify to the Commission the provisions of its law which it adopts pursuant to paragraph 6, by the date of application of this Regulation, and, without delay, any subsequent amendment affecting them. ## Article 3 - Definitions For the purposes of this Regulation, the following definitions apply: (1) ‘home Member State’ means home Member State as defined in Article 2, point (1), of Directive XXX [PSD3]; (2) ‘host Member State’ means host Member State as defined in Article 2, point (2), of Directive XXX [PSD3]; (3) ‘payment service’ means any business activity set out in Annex I of Directive XXX [PSD3]; (4) ‘payment institution’ means a payment institution as defined in Article 2, point (4), of Directive XXX [PSD3]; (5) ‘payment transaction’ means an act of placing, transferring or withdrawing funds, based on a payment order placed by the payer, or on his behalf, or by the payee, or on his behalf, irrespective of any underlying obligations between the payer and the payee; (6) ‘initiation of a payment transaction’ means the steps necessary to prepare the execution of a payment transaction, including the placement of a payment order and the completion of the authentication process; (7) ‘remote initiation of a payment transaction’ means a payment transaction for which a payment order is placed via the internet; (8) ‘execution of a payment transaction’ means execution of a payment transaction as defined in Article 2, point (6) of [PSD3]; (9) ‘payment system’ means a funds transfer system with formal and standardised arrangements and common rules for the processing, clearing or settlement of payment transactions; (10) ‘payment system operator’ means the legal entity legally responsible for operating a payment system; (11) ‘payer’ means a natural or legal person who holds a payment account and places or allows a payment order from that payment account, or, where there is no payment account, a natural or legal person who places a payment order; (12) ‘payee’ means a natural or legal person who is the intended recipient of funds which are the subject of a payment transaction; (13) ‘payment service user’ means a natural or legal person making use of a payment service or of an electronic money service in the capacity of payer, payee, or both; (14) ‘payment service provider’ means a body as referred to in Article 2(1) or a natural or legal person benefiting from an exemption pursuant to Articles 34, 36 and 38 of Directive (EU) [PSD3]; (15) ‘payment account’ means an account held by a payment service provider in the name of one or more payment service users which can be used for the execution of one or more payment transactions and allows for sending and receiving funds to and from third parties; (16) ‘payment order’ means an instruction by a payer or payee to its payment service provider requesting the execution of a payment transaction; (17) ‘mandate’ means the expression of authorisation given by the payer to the payee and (directly or indirectly via the payee) to the payer’s payment service provider allowing the payee to initiate a payment transaction for debiting the payer’s specified payment account and to allow the payer’s payment service provider to comply with such instructions; (18) ‘payment instrument’ means an individualised device or devices and/or set of procedures agreed between the payment service user and the payment service provider which enables the initiation of a payment transaction; (19) ‘account servicing payment service provider’ means a payment service provider providing and maintaining a payment account for a payment service user; (20) ‘payment initiation service’ means a service to place a payment order at the request of the payment service user with respect to a payment account held at another payment service provider; (21) ‘account information service’ means an online service where a provider, accesses one or several payment accounts held by the payment service user with one or several account servicing payment service providers that are accessible online in order to provide a service of aggregation or consolidation of payment account data to the payment service user or to transmit the data to another entity that will provide that service to the payment service user; (22) ‘payment initiation service provider’ means a payment service provider providing payment initiation services; (23) ‘account information service provider’ means a payment service provider providing account information services; (24) ‘consumer’ means a natural person who, in payment service contracts covered by this Regulation, is acting for purposes other than his or her trade, business or profession; (25) ‘framework contract’ means a payment service contract which governs the future execution of individual and successive payment transactions and which may contain the obligation and conditions for setting up a payment account; (26) ‘money remittance’ means money remittance as defined in Article 2(22) of PSD3; (27) ‘direct debit’ means a payment service for debiting a payer’s payment account, where a payment transaction is initiated by the payee on the basis of a mandate given by the payer to the payee, to the payee’s payment service provider or to the payer’s own payment service provider; (28) ‘credit transfer’ means a payment service, including instant credit transfers, for crediting a payee’s payment account with a payment transaction or a series of payment transactions from a payer’s payment account by the payment service provider which holds the payer’s payment account, based on an instruction given by the payer; (29) ‘instant credit transfer’ means a credit transfer which is executed immediately, 24 hours a day and on any calendar day; (30) ‘funds’ means central bank money issued for retail use, scriptural money and electronic money, including electronic money tokens; (31) ‘value date’ means a reference time used by a payment service provider for the calculation of interest on the funds debited from or credited to a payment account; (32) ‘reference exchange rate’ means the exchange rate which is used as the basis to calculate any currency conversion cost and which is disclosed by the payment service provider or comes from a publicly available source; (33) ‘reference interest rate’ means the interest rate which is used as the basis for calculating any interest to be applied and which comes from a publicly available source which can be verified by both parties to a payment service contract; (34) ‘authentication’ means a procedure which allows the payment service provider to verify the identity of a payment service user or the validity of the use of a specific payment instrument, including the use of the user’s personalised security credentials; (35) ‘strong customer authentication’ means an authentication which is based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data; (36) ‘technical service provider’ means a provider of services which, although not being payment services, support the provision of payment services, without entering at any time into possession of the funds to be transferred; (37) ‘personalised security credentials’ means personalised features provided by the payment service provider to a payment service user for the purposes of authentication; (38) ‘sensitive payment data’ means data which can be used to carry out fraud, including personalised security credentials; (39) ‘unique identifier’ means a combination of letters, numbers or symbols specified by the payment service provider to the payment service user and to be provided by the payment service user to identify unambiguously another payment service user or the payment account of that other payment service user for a payment transaction; (40) ‘means of distance communication’ means a method which, without the simultaneous physical presence of the payment service provider and the payment service user, may be used for the conclusion of a payment services contract; (41) ‘durable medium’ means any instrument which enables the payment service user to store information addressed personally to that payment service user in a way accessible for future reference for a period of time adequate to the purposes of the information and which allows the unchanged reproduction of the information stored; (42) ‘microenterprise’ means an enterprise which at the time of conclusion of the payment service contract is an enterprise as defined in Article 1 and Article 2(1) and (3) of the Annex to Recommendation 2003/361/EC; (43) ‘business day’ means a day on which the payment service provider of the payer or of the payee involved in the execution of a payment transaction is open for business to execute a payment transaction other than instant credit transfers; (44) ‘agent’ means an agent as defined in Article 2, point (28), of Directive XXX [PSD3]; (45) ‘branch’ means a branch as defined in Article 2, point (29), of Directive XXX [PSD3]; (46) ‘group’ means a group as defined in Article 2, point (30), of Directive XXX [PSD3]; (47) ‘digital content’ means goods or services which are produced and supplied in digital form, the use or consumption of which is restricted to a technical device and which do not include in any way the use or consumption of physical goods or services; (48) ‘acquiring of payment transactions’ means a payment service provided by a payment service provider contracting with a payee to accept and process payment transactions, which results in a transfer of funds to the payee; (49) ‘issuing of payment instruments’ means a payment service by a payment service provider contracting to provide a payer with a payment instrument to initiate and process the payer’s payment transactions; (50) ‘electronic money’ means electronically, including magnetically, stored monetary value which is issued on the receipt of funds for the purpose of making payment transactions and which is accepted by other natural or legal persons than the issuer; (53) ‘commercial trade name’ means the name which is commonly used by the payee in the trade and marketing of its business to identify itself to the payer; (54) ‘ATM deployer’ means an ATM deployer as defined in Article 2, point (38), of Directive XXX [PSD3]; (56) ‘merchant-initiated transaction (MIT)’ means a payment transaction where the payer has given a mandate authorising the payee to place a payment order for a payment transaction or a series of payment transactions through a particular payment instrument that is issued to be used by the payer to place payment orders for the payment transactions, where the mandate is based on an agreement between the payer and the payee for the provision of products or services, and where those transactions do not need to be preceded by a specific action of the payer to trigger their initiation by the payee; (57) ‘mail order or telephone order transaction (MOTO)’ means a payment transaction for which payment orders are placed by the payer with modalities other than the use of electronic platforms or devices, such as paper-based payment orders, mail orders or telephone orders, irrespective of whether or not the execution of the transaction is performed electronically; (58) ‘aggregated mid-market exchange rate’ means a rate that represents the mid-point between the buy and sell prices of a currency pair in the foreign exchange market, and that is calculated by combining data from multiple sources to provide an accurate and real-time reflection of the market conditions; (59) ‘periodic penalty payments’ means periodic pecuniary enforcement measures, aimed at ending ongoing breaches of this Regulation or breaches of any decisions issued by a competent authority on the basis of this Regulation and compelling the natural or legal person to return to compliance with the infringed provisions or decisions; (60) ‘electronic money token’ means an electronic money token as defined in Article 3(1), point (7), of Regulation (EU) 2023/1114; (61) ‘crypto-asset service’ means a crypto-asset service as defined in Article 3(1), point (16), of Regulation (EU) 2023/1114; (62) ‘providing transfer services for crypto-assets on behalf of clients’ means providing transfer services for crypto-assets on behalf of clients as defined in Article 3(1), point (26), of Regulation (EU) 2023/1114; (63) ‘crypto-asset service provider’ means a crypto-asset service provider as defined in Article 3(1), point (15), of Regulation (EU) 2023/1114; (64) ‘self-hosted address’ means a self-hosted address as defined in Article 3, point (20), of Regulation (EU) 2023/1113; (65) ‘custodial wallet’ means a crypto-asset wallet address where a crypto-asset service provider ensures the safekeeping or controlling, on behalf of its client, of crypto-assets or of the means of access to such crypto-assets, where applicable in the form of private cryptographic keys; (66) ‘payment card scheme’ means a payment card scheme as defined in Article 2, point (16), of Regulation (EU) No 2015/751; (67) ‘processing’ means processing as defined in Article 2, point (27), of Regulation (EU) No 2015/751; (68) ‘processing entity’ means a processing entity as defined in Article 2, point (28), of Regulation No (EU) 2015/751.