DORA TLPT eligibility workflow

Under DORA Article 26, Article 16 entities and microenterprises do not enter the TLPT selection process. Other financial entities identified for TLPT carry out advanced threat-led penetration testing at least every three years, with the competent authority able to adjust frequency based on risk profile and operational circumstances. The selection decision is authority-led: Member States may designate a single public authority for TLPT matters, and delegated tasks do not remove the relevant competent authority role where tasks remain with it.

Build the eligibility file around the authority that can act on the entity. Record the entity's DORA financial-entity type, home Member State, competent authority, any designated TLPT authority, and whether any tasks have been delegated to another national authority. For significant credit institutions and cross-border entities, record the Union or national supervisory links instead of assuming a single local contact.

The 2025 TLPT RTS gives the selection structure. TLPT authorities assess impact, systemic character, and ICT risk profile. Impact and systemic factors include size, services across one or more Member States, interconnectedness with other financial entities, criticality or importance of services for the financial sector, substitutability, business-model complexity, and group-level systemic character where ICT systems are shared.

The RTS then names categories that must perform TLPT unless the authority's overall assessment shows the TLPT is not justified. They include G-SIIs, O-SIIs and entities in those groups; payment institutions exceeding EUR 150 billion of payment transactions in each of the previous two calendar years; and electronic money institutions exceeding, in each of those years, either EUR 150 billion of payment transactions or EUR 40 billion of outstanding electronic money. Central securities depositories and central counterparties are also listed.

Electronic trading venues qualify through national highest-turnover or Union market-share tests in specified instrument classes. Insurance and reinsurance undertakings first enter a subset only if gross written premium exceeds EUR 1.5 billion, technical provisions exceed EUR 10 billion, and, for life-only or combined life and non-life undertakings, assets exceed 3.5% of the relevant Member State total. An undertaking in that subset must then meet at least one higher threshold: gross written premium above EUR 3 billion, technical provisions above EUR 30 billion, or assets above 10% of the relevant Member State total. Use the exact RTS calculations and reference years; category membership is not an automatic selection because the TLPT authority still applies the paragraph 1 assessment.

Once a TLPT authority notifies a financial entity that a TLPT is to be carried out, the 2025 RTS requires initiation information within three months and a management-body-approved scope specification document within six months. That scope document must list all critical or important functions identified by the financial entity and explain why each function is included or excluded.

Readiness evidence should therefore exist before notification. Keep a current inventory of critical or important functions, supporting ICT systems, outsourced or intra-group ICT services, jurisdictions where systems are used, and preliminary confidentiality, integrity, authenticity, and availability flags. Where a third-party or intra-group provider supports a critical or important function, record how participation, safeguards, pooled testing, or joint testing would be handled.

A DORA TLPT is not ordinary vulnerability scanning. The TLPT authority participates in all phases, validates key documentation, and can prevent contracting where selected providers do not meet DORA, RTS, or lawful national-security requirements. The financial entity remains responsible for the impact of the test even when providers and ICT third-party service providers participate.

For group, cross-border, joint, or pooled testing, identify the lead TLPT authority and the other TLPT authorities that may participate as observers or test managers. If the entity uses shared ICT systems, an ICT intra-group service provider, or a third-party provider used by multiple financial entities, record why an individual, joint, or pooled TLPT is appropriate and how the scope remains effective.