DORA TLPT eligibility workflow

Under DORA Article 26, financial entities identified for TLPT carry out advanced threat-led penetration testing at least every three years, with the competent authority able to adjust frequency based on risk profile and operational circumstances. The selection decision is authority-led: Member States may designate a single public authority for TLPT matters, and delegated tasks do not remove the relevant competent authority role where tasks remain with it.

Build the eligibility file around the authority that can act on the entity. Record the entity's DORA financial-entity type, home Member State, competent authority, any designated TLPT authority, and whether any tasks have been delegated to another national authority. For significant credit institutions and cross-border entities, record the Union or national supervisory links instead of assuming a single local contact.

The 2025 TLPT RTS gives the selection structure. TLPT authorities assess impact, systemic character, and ICT risk profile. Impact and systemic factors include size, services across one or more Member States, interconnectedness with other financial entities, criticality or importance of services for the financial sector, substitutability, business-model complexity, and group-level systemic character where ICT systems are shared.

The RTS then names categories that must perform TLPT unless the authority's overall assessment shows the TLPT is not justified. Those categories include G-SIIs, O-SIIs and entities in those groups, certain high-volume payment and e-money institutions, central securities depositories, central counterparties, qualifying electronic trading venues, and qualifying insurance or reinsurance undertakings. Use those criteria as evidence categories, not as a guarantee of selection or exclusion.

Once a TLPT authority notifies a financial entity that a TLPT is to be carried out, the 2025 RTS requires initiation information within three months and a management-body-approved scope specification document within six months. That scope document must list all critical or important functions identified by the financial entity and explain why each function is included or excluded.

Readiness evidence should therefore exist before notification. Keep a current inventory of critical or important functions, supporting ICT systems, outsourced or intra-group ICT services, jurisdictions where systems are used, and preliminary confidentiality, integrity, authenticity, and availability flags. Where a third-party or intra-group provider supports a critical or important function, record how participation, safeguards, pooled testing, or joint testing would be handled.

A DORA TLPT is not ordinary vulnerability scanning. The TLPT authority participates in all phases, validates key documentation, and can prevent contracting where selected providers do not meet DORA, RTS, or lawful national-security requirements. The financial entity remains responsible for the impact of the test even when providers and ICT third-party service providers participate.

For group, cross-border, joint, or pooled testing, identify the lead TLPT authority and the other TLPT authorities that may participate as observers or test managers. If the entity uses shared ICT systems, an ICT intra-group service provider, or a third-party provider used by multiple financial entities, record why an individual, joint, or pooled TLPT is appropriate and how the scope remains effective.