How to comply with article 6 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with article 6 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 6 of the TLPT RTS covers pooled or joint tests, where several financial entities share a critical ICT provider or common infrastructure and mutualise a TLPT exercise. The trap the CSSF and the BCL sanction under the TIBER-LU framework: believing that sharing the test removes the duty to run your own risk assessment. Each control team remains individually responsible for its own assessment and its own risk management measures, even when a designated entity leads the collective risk. Authorities flag the absence of a dedicated risk file for each participating entity, or the reverse: a designated entity that never documents the joint risks of the mutualised exercise.The dual responsibility to documentEach financial entity produces its own risk assessment and its own mitigation measures (art. 6(1)), even within a joint or pooled test.The designated entity (art. 16(3)(b) of the RTS or art. 26(4) of DORA) additionally assesses the risks arising from the involvement of multiple entities in the same TLPT.The control teams of the involved entities must cooperate with the designated entity's team to identify potential joint risks (contagion, shutdown of a shared service, cross-entity data exposure).The scope includes shared critical ICT providers, in line with CSSF circulars 22/806 and 25/882 on ICT outsourcing and RTS 2025/532.Post-test remediation feeds each entity's ICT risk management (CSSF circular 20/750), not only that of the leading entity.The blind spot: without traceability of the cooperation between control teams, it becomes impossible to demonstrate to the CSSF that joint risks were identified before the red team launched against live production.How Luxgap automates this riskOur Luxgap Pooled TLPT Risk Orchestrator makes the responsibility gap between entities impossible: it maintains in parallel the dedicated risk file of each participating entity AND the joint risk register led by the designated entity, with a time-stamped audit trail of every exchange between control teams. The tool connects to your ICT risk repositories (20/750 register), your DORA outsourcing register and your collaboration tools (M365, Teams) to show in real time who assessed what, and when.Generates each participating entity's individual article 6(1) risk assessment, pre-filled from its existing ICT register, with no re-keying.Maps the critical ICT providers shared across entities via the outsourcing register (RTS 2025/532, circulars 22/806 and 25/882) and flags common contagion points.Produces the designated entity's joint risk register (art. 16(3)(b) RTS, art. 26(4) DORA) and traces each contribution from cooperating control teams.Alerts instantly on Teams when a participating entity has not validated its own assessment before the TLPT launch window.Feeds remediation findings automatically back into each entity's ICT risk management process (CSSF circular 20/750), not just the leader's.Produces a time-stamped, sealed PDF file, enforceable bef...

Risk management for pooled or joint TLPTs

They trust us

Before we chat