DORA Threat-Led Penetration Testing (TLPT): Who Must Do It and How

What TLPT is

Under Article 26 of DORA (Regulation (EU) 2022/2554), identified financial entities must carry out advanced testing by means of TLPT at least every three years, though the authority can change the frequency for a given entity. Each test covers several or all critical or important functions and is performed on live production systems. The entity identifies the systems, processes and technologies supporting those functions, including those outsourced to ICT providers, and the authority validates the scope.

Microenterprises and the entities that use DORA's simplified framework (Article 16(1)) are excluded from TLPT (Article 26(1)).

Who must do it

Commission Delegated Regulation (EU) 2025/1190 sets the criteria. TLPT authorities must require TLPT from certain categories unless their assessment shows the entity's impact, financial stability concerns or ICT risk profile do not justify it (Article 2(2)), including:

credit institutions identified as global or other systemically important institutions (G-SIIs and O-SIIs), or part of one;
payment institutions that exceeded €150 billion of payment transactions in each of the two preceding calendar years;
electronic money institutions above €150 billion of payment transactions or €40 billion of outstanding electronic money in each of the two preceding years;
central securities depositories and central counterparties;
certain trading venues and other categories listed in the Regulation.

Beyond those, authorities assess any financial entity against impact and systemic factors, such as size, interconnectedness, criticality and substitutability of its services, and ICT risk factors, such as its threat landscape, dependence on ICT, architecture complexity, use of ICT providers and detection maturity (Article 2(1)). In practice, the authority tells you if you are selected.

How a TLPT runs

Phase	What happens	RTS article
Preparation	A control team at the entity is set up, scope agreed and validated by the authority, risk management and testers selected	4 to 9
Threat intelligence	The threat intelligence provider analyses generic and sector-specific threats and produces targeted intelligence and scenarios for the entity	10
Red team test	Testers attack live production systems following the scenarios; the active phase lasts at least 12 weeks	11
Closure	Red team report within 4 weeks of the active phase, blue team report within 10 weeks, then replay of attacks and purple teaming to learn from the test	12
Remediation	Remediation plan and documentation to the authority within 8 weeks of the closure notification	13
Attestation	The authority issues an attestation that the test met the requirements, allowing mutual recognition	14; DORA 26(7)

The entity remains fully responsible throughout, applies risk management controls to protect data, assets and critical functions during the test (DORA Article 26(5)), and must ensure the participation of ICT providers in scope (Article 26(3)).

Who may test

Testers must be of the highest suitability and reputability, have specific expertise in threat intelligence, penetration testing and red teaming, be certified by an accreditation body or follow formal codes of conduct, provide independent assurance on managing the test's risks, and carry professional indemnity insurance (DORA Article 27(1)). Internal testers need the authority's approval and sufficient resources, and the threat intelligence provider must be external (Article 27(2)). Entities using internal testers must contract external testers every three tests, and significant credit institutions may only use external testers (Article 26(8)).

Contracts matter: for services supporting critical or important functions, DORA requires your ICT providers to participate and fully cooperate in your TLPT (Article 30(3)(d)). See the Article 30 contract checklist.

Not selected? What you still test

Most financial entities will never run a TLPT, but all except microenterprises need a digital operational resilience testing programme, with tests by independent parties and yearly tests of all systems supporting critical or important functions (Articles 24 and 25). Those tests include vulnerability scans, scenario-based tests and penetration tests. See how to scope a penetration test.

DORA Threat-Led Penetration Testing (TLPT): Who Must Do It and How

What TLPT is

Who must do it

How a TLPT runs

Who may test

Not selected? What you still test

Sources

Related tools

DORA Compliance Checker

Vendor Risk Assessment