DORA: TLPT RTS now in force — what the CSSF expects

DORA: the TLPT RTS is in force — what the CSSF expects

On 13 February 2025, the Commission adopted Delegated Regulation (EU) 2025/1190 specifying TLPT (Threat‑Led Penetration Testing) under DORA. Published in the OJ on 18 June 2025, it applies in Luxembourg under the CSSF as the national “TLPT authority”.

The matter

Delegated Regulation (EU) 2025/1190 of 13 February 2025 “specifies the criteria” to identify financial entities required to conduct a TLPT, sets conditions for using internal testers, defines scope and methodology, and organises cooperation and mutual recognition among authorities. It complements Article 26 of DORA (Reg. (EU) 2022/2554) and was published in the Official Journal on 18 June 2025. For selecting entities, the text includes objective thresholds: e.g., payment institutions “exceeding, in each of the two calendar years preceding the assessment, EUR 150 billion in total value of payment transactions”, or certain insurers above 3.5% of national aggregated assets. It also introduces “joint” or “pooled” TLPT mechanisms and clarifies end‑to‑end test governance. See OJ: Delegated Regulation (EU) 2025/1190. (eur-lex.europa.eu)

In Luxembourg, the CSSF confirms it is the “TLPT authority” for supervised financial entities, pursuant to Article 46 DORA, and that the TIBER‑LU framework (with the BCL) was revised in light of DORA. See CSSF page “ICT and cyber risk – DORA entities” and the “TIBER‑LU Implementation” document dated 20 June 2025. (cssf.lu)

Legal reasoning

• Legal basis. DORA mandates a resilience testing programme (Art. 25) and, for “designated” entities (excluding micro‑enterprises and the lighter regime under Art. 16), advanced tests “at least every three years” via a TLPT (Art. 26(1)). Competent authorities identify entities to be subject to TLPT based on impact, financial stability and ICT risk profile (Art. 26(8)). Consolidated text: Reg. (EU) 2022/2554. (eur-lex.europa.eu)
• Application specifications. Delegated Regulation (EU) 2025/1190 sets out:
  • Indicative categories and thresholds that “call for” a TLPT (e.g., CSDs, CCPs, G‑SII/O‑SII credit institutions; large payment providers > EUR 150bn/year; large insurers). It also details the TLPT authority’s assessment before confirming the testing obligation. (eur-lex.europa.eu)
  • Conditions to use internal testers: prior approval, dedicated resources, independence, and mandatory external TI provider. (eur-lex.europa.eu)
  • Scope and phase‑by‑phase methodology (threat intelligence, scenario design, live execution on production, closure and remediation), management of the uninformed blue team, and evidence keeping. (eur-lex.europa.eu)
  • Cooperation and mutual recognition for “joint/pooled” TLPTs when multiple authorities are involved (useful for LU–BE–FR–DE cross‑border groups), with a lead authority. (eur-lex.europa.eu)
• Harmonised EU stance. The RTS builds on joint ESA work (EBA/EIOPA/ESMA) in agreement with the ECB, published in the Final Report on 17 July 2024. It confirms alignment with TIBER‑EU and the triennial minimum frequency embedded in DORA. See ESMA release and Final Report JC 2024‑29. (esma.europa.eu)
• Luxembourg competence. Article 46 DORA designates the sector authority; the CSSF explicitly positions itself as national “TLPT authority”, with BCL/CSSF interplay for TIBER‑LU. CSSF refs. (cssf.lu)

Important note: the internal topic list mentions “DORA Art. 30 — TLPT”. In law, TLPT sits under Article 26; Article 30 concerns ICT subcontracting. Firms should cite the exact article to shape their roadmap and controls. (eur-lex.europa.eu)

What changes in practice

• Who will likely be “designated” in Luxembourg in 2026–2027?
  • Significant banks (SSM) and Luxembourg O‑SIIs; CSD/CCP where applicable.
  • Payment/e‑money providers exceeding EUR 150bn flows over 2 calendar years; major trading venues; insurers reaching the 3.5% national assets threshold. Final case‑by‑case decision by the CSSF as TLPT authority. (eur-lex.europa.eu)
• Frequency and timeline. Once designated, the entity must perform a TLPT at least every three years, adjustable by the authority based on risk. The OJ 2025/1190 and DORA Art. 26 confirm the pace. (esma.europa.eu)
• Expected method. Tests rely on “real” threat intelligence, run in production, and target “critical functions”. The RTS enables “pooled” TLPTs on common dependencies (e.g., the same intra‑group cloud/ICT provider), useful for LU–BE–FR–DE groups. (eur-lex.europa.eu)
• Local governance. The CSSF expects alignment with TIBER‑LU and the ability to evidence full‑cycle control (scoping, scenario, ROE, execution, remediation, evidence). Its site sets out the TLPT authority role and links to the refreshed TIBER‑LU document. (cssf.lu)

Practical example. A banking IFM classified as an O‑SII running mass payments and using a shared SOC could be designated for TLPT: the CSSF may require a test covering the “instant SEPA payment + online banking” journey, injecting TTPs observed against European actors, executing in production off‑peak, and delivering a time‑bound remediation plan with evidence of effectiveness.

Common pitfalls

1. Mixing up DORA Art. 26 (TLPT) and Art. 30 (subcontracting). Result: wrong roadmap (contracts instead of testing). Check citations and tie each requirement to the precise article. (eur-lex.europa.eu)
2. Counting a past TIBER as the “first DORA TLPT” without a gap analysis. The RTS grants no automatic credit: you must evidence equivalence to 2025/1190 (scope, governance, evidence) or the authority may require a new test. (eur-lex.europa.eu) — In practice, a cybersecurity audit gap review streamlines readiness.
3. Scope too narrow. The RTS requires a risk‑based justification for selecting “critical functions” and dependency chains (including ICT providers). Limiting to the web channel without IAM, payments, logging and recovery may fail mutual recognition. (eur-lex.europa.eu)
4. Misusing internal testers. Allowed but constrained: prior approval, independence, dedicated resources and mandatory external TI provider. Lacking an external cyber‑threat intelligence provider invalidates the setup. (eur-lex.europa.eu)
5. Forgetting the cross‑border angle. LU groups with BE/FR/DE activities should plan inter‑authority coordination and target a “joint/pooled” TLPT for mutual recognition and to avoid duplicates. (eur-lex.europa.eu)

Official sources

• Delegated Regulation (EU) 2025/1190 (TLPT RTS) — OJ of 18 June 2025: EUR‑Lex 32025R1190. Examples on thresholds and TLPT governance. (eur-lex.europa.eu)
• DORA — Regulation (EU) 2022/2554 (Articles 26 and 46): EUR‑Lex 32022R2554. Minimum “at least every three years” and entity identification. (eur-lex.europa.eu)
• ESAs — Final Report “JC 2024‑29” on TLPT RTS (17/07/2024): ESMA — JC 2024‑29; ESMA release on the “second batch” under DORA: ESMA news. (esma.europa.eu)
• CSSF — “ICT and cyber risk – DORA entities” (TLPT authority) and TIBER‑LU Implementation (20/06/2025): cssf.lu, TIBER‑LU. (cssf.lu)

In short, the TLPT framework is now set and enforceable. Luxembourg executives and CISOs should assess whether they are “designable”, build a triennial plan aligned with 2025/1190, and prepare a TIBER‑LU execution “recognisable” by the CSSF — with evidence. For an overview of DORA operational resilience and local implications, see DORA in Luxembourg.

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.