How to comply with recital 3 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with recital 3 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapRecital 3 is often overlooked by entities that assume they fall outside the TLPT scope because they are not on the nominative list (credit institutions, payment institutions, electronic money institutions, central counterparties, central securities depositories, trading venues, insurers and reinsurers). Yet it explicitly opens the door to a discretionary designation by the CSSF, the TLPT authority within the meaning of Article 46 of DORA, based on qualitative criteria. A CSSF-regulated fintech or a crypto asset service provider authorised under Article 59 of MiCA (Regulation 2023/1114) can therefore be required to undergo a TLPT despite believing it was out of scope, and find itself with no red team capability or threat intelligence process on the day of notification.The indicators that trigger a TLPT designationThe recital requires the CSSF and the BCL to carry out an overall, cross-sector and objective assessment. In practice, an entity must anticipate its own exposure against the following factors:The ICT risk profile and ICT maturity, assessed via CSSF circular 22/806 and circular 20/750 (ICT risk management).The entity's impact on the Luxembourg financial sector and financial stability concerns.The critical or important nature of the functions operated, tested in live production during the TLPT.The inclusion of ICT providers in the test scope, in line with CSSF circular 25/882 and the outsourcing RTS 2025/532.The emergence of new participants, including MiCA crypto asset providers, whose growing systemic importance is explicitly targeted.The logic runs both ways: the assessment aims to identify entities for which a TLPT is appropriate, but also to limit the framework to those for which it is justified. The TIBER-LU framework (BCL and CSSF), whose Implementation Document was revised on 20 June 2025, operationalises this methodology aligned with TIBER-EU.How Luxgap automates this riskOur Luxgap TLPT Scope Predictor turns designation uncertainty into a timestamped, opposable probability score that tells you whether the CSSF is likely to bring you into the TLPT scope before its letter even arrives. The tool aggregates your ICT risk profile from your DORA registers, your incident reports, your critical function mapping and your connected ICT providers (Microsoft Defender, Azure Sentinel, CrowdStrike, eBRC, LuxConnect) to reconstruct the cross-sector indicators scrutinised by the CSSF and the BCL.Calculates a TLPT designation probability score based on the qualitative criteria of recital 3, cross-referenced with your sectoral impact and ICT maturity.Automatically detects critical and important functions from your DORA register of information and CSSF circular 22/806.Integrates ICT providers into the simulated scope in line with CSSF circular 25/882 and RTS 2025/532, and identifies coverage gaps.Specifically alerts MiCA-authorised crypto asset service providers (Article 59) about their growing exposure to future designation.Produ...

Recital 3

They trust us

Before we chat