I need to bring my Luxembourg organisation into compliance with article 2 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapArticle 2 of the TLPT RTS sets the entry gate of the whole regime: knowing whether you are an entity required to perform TLPT. The classic trap is to assume the threshold is purely quantitative (market share, EUR 150 billion of payment transactions) when the CSSF, acting as the TLPT authority under Article 46 of DORA, combines those thresholds with a qualitative assessment of systemic character and ICT risk profile. Entities that believe they are out of scope because they sit below a numerical threshold can be pulled back in through the interconnectedness, substitutability or ICT detection maturity criteria, and those that fail to prepare their self-assessment file end up unable to engage with the CSSF and the BCL during the TIBER-LU scoping.The criteria the CSSF actually crosses before designating youThe Article 2(1) assessment blends two families of factors. These are the ones that tip an entity into scope:The size and market share at national and Union level, comparing your services to those of similar entities (Art. 2(1)(a)(i)).The interconnectedness with other financial sector entities and membership of a systemic group sharing ICT systems (Art. 2(1)(a)(ii) and (vi)).The dependence of critical or important functions on ICT systems and the complexity of your architecture (Art. 2(1)(b)(iii) and (iv)).The reliance on ICT third-party service providers, the quantity and type of contractual arrangements, including intra-group (Art. 2(1)(b)(v), read with RTS 2025/532 and CSSF circulars 22/806 and 25/882).The maturity of real-time detection: permanent monitoring, detection, analysis and response to ICT events (Art. 2(1)(b)(viii)).Crossing the sectoral thresholds: G-SII / O-SII, EUR 150 billion of payment transactions, EUR 40 billion of outstanding electronic money, CSDs, central counterparties and dominant trading venues (Art. 2(2)).The line of argument before the CSSF is twofold: either demonstrate that your impact and risk profile do not justify a TLPT, or, if designated, prove that your test scope properly covers your critical functions in live production and your included ICT providers.How Luxgap automates this riskOur Luxgap TLPT Scope Predictor turns uncertainty about your TLPT status into an opposable self-assessment file, mapped criterion by criterion onto Article 2 of RTS 2025/1190. The tool aggregates your regulatory data (G-SII / O-SII status, payment transaction volumes, outstanding electronic money), your ICT mapping (Microsoft Defender, Azure Sentinel, CrowdStrike, Wazuh) and your third-party provider register from Odoo and your contracts, to compute a TLPT designation probability score without asking your CISO to fill in a single spreadsheet.Automatically calculates your position against the quantitative thresholds of Article 2(2) (G-SII, O-SII, EUR 150 billion, EUR 40 billion) from your prudential reporting.Evaluates the qualitative impact and systemic character factors (size, interconnectedness, substitutability, ...

EU frameworkGDPR NIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 26/906 CSSF 25/892 CSSF 25/893 CSSF 26/915 CSSF 20/758 CSSF 18/698 CSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Article 2

Identification of financial entities required to perform TLPT

Commission Delegated Regulation (EU) 2025/1190 on threat-led penetration testing (TLPT) under DORA · UE 2025/1190

Identification of financial entities required to perform TLPT

1. TLPT authorities shall assess whether any financial entity is required to perform TLPT, taking into account the impact of those financial entities, their systemic character and their ICT risk profile, on the basis of all of the following criteria:

(a)

impact-related and systemic character related factors:

(i)	the size of the financial entity, determined on the basis of whether the financial entity provides financial services in one or more Member States and by comparing the activities of the financial entity to those of other financial entities providing similar services;

(ii)	the extent and nature of the interconnectedness of the financial entity with other financial entities in the financial sector in one or more Member States;

(iii)

the criticality or importance of the services that the financial entity provides to the financial sector;

(iv)	the substitutability of the services that the financial entity provides;

(v)	the complexity of the business model of the financial entity and the related services and processes;

(vi)	whether the financial entity is part of a group of systemic character at Union or national level in the financial sector and sharing ICT systems;

(b)

ICT risk-related factors:

(i)	the risk profile of the financial entity;

(ii)	the threat landscape of the financial entity;

(iii)

the degree of dependence of critical or important functions or their supporting functions of the financial entity on ICT systems and processes;

(iv)	the complexity of the ICT architecture of the financial entity;

(v)	the ICT services and functions supported by ICT third-party service providers, and the quantity and type of contractual arrangements with ICT third-party service providers or ICT intra-group service providers;

(vi)	the outcomes of any supervisory reviews relevant for the assessment of the ICT maturity of the financial entity;

(vii)

the maturity of ICT business continuity plans and ICT response and recovery plans;

(viii)

the maturity of the operational ICT security detection and mitigation measures, including the ability to:

(1)	monitor the financial entity’s ICT infrastructure on a permanent basis;

(2)	detect ICT-related events in real time;

(3)	analyse the events referred to in point (2);

(4)	respond to the events referred to in point (2) in a timely and effective manner;

(ix)	whether the financial entity is part of a group active in the financial sector at Union or national level that shares ICT systems.

For the purposes of point (a)(i), the TLPT authority shall, where possible, consider:

(a)	the market share position of the financial entity at Union and national level;

(b)	the range of activities offered by the financial entity;

(c)	the market share of the services provided by the financial entity or of the activities undertaken at Union and national level.

For the purposes of point (a)(v), the TLPT authority shall, where possible, consider:

(a)	whether the financial entity operates more than one business model;

(b)	the interconnectedness of different business processes and the related services.

2. TLPT authorities shall require all of the following financial entities to perform TLPT, unless the assessment referred to in paragraph 1 in respect of a financial entity indicates that its impact, the financial stability concerns relating to that financial entity, or its ICT risk profile, does not justify the performance of a TLPT:

(a)

credit institutions that meet any of the following conditions:

(i)	they have been identified as global systemically important institutions (G-SIIs) in accordance with Article 131 of Directive 2013/36/EU of the European Parliament and of the Council (7);

(ii)	they have been identified as other systemically important institutions (O-SIIs) in accordance with Article 131 of Directive 2013/36/EU;

(iii)

they are part of a G-SIIs or O-SIIs;

(b)	payment institutions that exceeded in each of the 2 calendar years preceding the assessment by the TLPT authority EUR 150 billion of total value of payment transactions as defined in Article 4, point (5), of Directive (EU) 2015/2366 of the European Parliament and of the Council (8);

(c)

electronic money institutions that exceeded in each of the 2 calendar years preceding the assessment by the TLPT authority either EUR 150 billion of total value of payment transactions as defined in Article 4, point (5), of Directive (EU) 2015/2366 or EUR 40 billion of total value of the amount of outstanding electronic money;

(d)	central securities depositories;

(e)	central counterparties;

(f)

trading venues with an electronic trading system that meet any of the following criteria:

(i)

the trading venue has the highest market share in terms of turnover at national level in each of the 2 calendar years preceding the assessment by the TLPT authority in any of the following:

(1)	transferable securities as defined in Article 4(1), point (44)(a), of Directive 2014/65/EU of the European Parliament and of the Council (9);

(2)	transferable securities as defined in Article 4(1), point (44)(b), of Directive 2014/65/EU;

(3)	derivatives as defined in Article 2(1), point (29), of Regulation (EU) No 600/2014 of the European Parliament and of the Council (10);

(4)	structured finance products as defined in Article 2(1), point (28), of Regulation (EU) No 600/2014;

(5)	emission allowances as referred to in Section C, point (11), of Annex I to Directive 2014/65/EU;

(ii)

the trading venue has a market share in terms of turnover at Union level that exceeds 5 % in each of the 2 calendar years preceding the assessment by the TLPT authority in any of the following:

(1)	shares in companies and other securities equivalent to shares in companies, partnerships or other entities, and depositary receipts in respect of shares;

(2)	bonds or other forms of securitised debt, including depositary receipts in respect of such securities;

(3)	derivatives as defined in Article 2(1), point (29), of Regulation (EU) No 600/2014,

(4)	structured finance products as defined in Article 2(1), point (28), of Regulation (EU) No 600/2014;

(5)	emission allowances as referred to in Section C, point (11), of Annex I to Directive 2014/65/EU;

(g)

insurance and reinsurance undertakings that meet all the following criteria:

(i)	they have a gross written premium (GWP) that exceeds EUR 1 500 000 000;

(ii)	they have technical provisions that exceed EUR 10 000 000 000;

(iii)

insurance undertakings that pursue only life activities or that pursue both life and non-life activities and that have total assets that exceed 3,5 % of the sum of the total assets valuated in accordance with Article 75 of Directive 2009/138/EC of the European Parliament and of the Council (11) of the insurance and reinsurance undertakings established in the Member State.

For the purposes of (f)(ii), where the trading venue is part of a group sharing ICT systems or the same ICT intra-group service provider, the turnover of the securities and derivatives contracts on all trading venues pertaining to the same group and established in the Union shall be considered.

For the purposes of point (g), TLPT authorities shall identify a subset of all insurance and reinsurance undertakings by applying the criteria laid down in points (g)(i), (ii), and (iii). Insurance and reinsurance undertakings included in that subset shall be required to perform TLPT where they also meet any of the following criteria:

(a)	gross written premium (GWP) that exceeds EUR 3 000 000 000;

(b)	technical provisions that exceed EUR 30 000 000 000;

(c)	total assets that exceed 10 % of the sum of the total assets valuated in accordance with Article 75 of Directive 2009/138/EC of the insurance and reinsurance undertakings established in the Member State.

3. Where more than one financial entity belonging to the same group and sharing ICT systems, or where more than one financial entity using the same ICT intra-group service provider, meet the criteria set out in paragraph 2, the TLPT authorities of those financial entities shall, in accordance with Article 16(2), decide whether the requirement to perform TLPT on an individual basis is relevant for those financial entities.

Where the TLPT authority of the parent undertaking of a group of financial entities referred to in the first subparagraph is different from the TLPT authorities of the financial entities of the group, that authority shall be consulted by the TLPT authorities of the financial entities belonging to that group on whether it is appropriate to perform TLPT on an individual basis.

Luxembourg specificity

TIBER-LU Implementation Document (BCL et CSSF), révisé le 20 juin 2025

In Luxembourg, the competent TLPT authority is the CSSF, which runs the TIBER-LU framework jointly with the BCL. The TIBER-LU Implementation Document, revised on 20 June 2025 and aligned with TIBER-EU (ECB version of 11 February 2025), sets out the arrangements for designation, scoping and conduct of the test (red team, blue team, white team, threat intelligence) on critical functions in live production. Remediation from the test feeds ICT risk management under CSSF circular 20/750, while the inclusion of ICT providers in scope relies on CSSF circulars 22/806 and 25/882.

Luxgap practice: anticipate the Article 2 assessment by building your self-assessment file aligned with the TIBER-LU Implementation Document now, so you engage the CSSF and the BCL from a documented position rather than a reactive one.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Article 2 of the TLPT RTS sets the entry gate of the whole regime: knowing whether you are an entity required to perform TLPT. The classic trap is to assume the threshold is purely quantitative (market share, EUR 150 billion of payment transactions) when the CSSF, acting as the TLPT authority under Article 46 of DORA, combines those thresholds with a qualitative assessment of systemic character and ICT risk profile. Entities that believe they are out of scope because they sit below a numerical threshold can be pulled back in through the interconnectedness, substitutability or ICT detection maturity criteria, and those that fail to prepare their self-assessment file end up unable to engage with the CSSF and the BCL during the TIBER-LU scoping.

The criteria the CSSF actually crosses before designating you

The Article 2(1) assessment blends two families of factors. These are the ones that tip an entity into scope:

The size and market share at national and Union level, comparing your services to those of similar entities (Art. 2(1)(a)(i)).
The interconnectedness with other financial sector entities and membership of a systemic group sharing ICT systems (Art. 2(1)(a)(ii) and (vi)).
The dependence of critical or important functions on ICT systems and the complexity of your architecture (Art. 2(1)(b)(iii) and (iv)).
The reliance on ICT third-party service providers, the quantity and type of contractual arrangements, including intra-group (Art. 2(1)(b)(v), read with RTS 2025/532 and CSSF circulars 22/806 and 25/882).
The maturity of real-time detection: permanent monitoring, detection, analysis and response to ICT events (Art. 2(1)(b)(viii)).
Crossing the sectoral thresholds: G-SII / O-SII, EUR 150 billion of payment transactions, EUR 40 billion of outstanding electronic money, CSDs, central counterparties and dominant trading venues (Art. 2(2)).

The line of argument before the CSSF is twofold: either demonstrate that your impact and risk profile do not justify a TLPT, or, if designated, prove that your test scope properly covers your critical functions in live production and your included ICT providers.

How Luxgap automates this risk

Our Luxgap TLPT Scope Predictor turns uncertainty about your TLPT status into an opposable self-assessment file, mapped criterion by criterion onto Article 2 of RTS 2025/1190. The tool aggregates your regulatory data (G-SII / O-SII status, payment transaction volumes, outstanding electronic money), your ICT mapping (Microsoft Defender, Azure Sentinel, CrowdStrike, Wazuh) and your third-party provider register from Odoo and your contracts, to compute a TLPT designation probability score without asking your CISO to fill in a single spreadsheet.

Automatically calculates your position against the quantitative thresholds of Article 2(2) (G-SII, O-SII, EUR 150 billion, EUR 40 billion) from your prudential reporting.
Evaluates the qualitative impact and systemic character factors (size, interconnectedness, substitutability, membership of a group sharing ICT systems) via a grid structured on Article 2(1)(a).
Measures the maturity of your real-time detection by querying Defender, Sentinel and CrowdStrike on your permanent monitoring, detection and response capability (Art. 2(1)(b)(viii)).
Scans your ICT third-party provider register and correlates the quantity and type of contractual arrangements with the requirements of CSSF circulars 22/806 and 25/882 and RTS 2025/532.
Produces a timestamped PDF report opposable to the CSSF and the BCL, evidencing your Article 2 self-assessment and framing the TIBER-LU scope if you are designated.
Feeds your ICT risk management under CSSF circular 20/750 by posting remediation results into your register.

Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS building block depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free blank audit within 48h to measure your TLPT exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Identification of financial entities required to perform TLPT

They trust us

Before we chat