Who must undertake TLPT

TLPT under DORA is not an obligation that falls on every financial entity in the same way. It applies to financial entities that are designated for threat-led testing under the applicable framework, with designation reflecting factors such as the importance of the entity, its role in the financial system and the criticality of the functions it performs. A firm therefore begins by establishing whether it has been designated, rather than by assuming that a TLPT exercise is either required or unnecessary. That question is answered through the framework and through engagement with the relevant authorities, not through a firm's own preference.

Designation carries practical consequences. A designated firm must prepare for an exercise that tests live production, work with independent testers, involve the authorities as the framework requires, and act on the findings through a remediation plan. A firm that is not designated may still carry out penetration testing and other resilience testing, and good practice may point in that direction, but that testing is not TLPT in the framework sense unless it follows the TLPT arrangements. Keeping that distinction clear avoids both understatement and overstatement in board reporting and supervisory discussions.

Designation is a supervisory judgement, not a self assessment. Authorities consider the entity and the functions it provides, and they apply the criteria set out in the framework. A large retail bank that processes a high volume of customer payments presents a different profile from a small specialist firm whose failure would affect a narrow set of clients, and the framework allows that difference to be reflected. The result is a targeted regime: intensive, production based testing where the stakes justify it, and proportionate testing elsewhere.

Many financial firms operate as part of a group, with shared platforms, central security teams and common suppliers. Designation may sit at the level of an individual entity, while the systems that support its critical functions sit in a parent company or a group service company. That separation creates coordination work: the designated entity remains responsible for its own TLPT, even when the test touches group infrastructure or staff who do not report to it directly.

Group arrangements should therefore be settled before scoping begins. Agreements should cover access to systems, the involvement of group security staff, the handling of findings that affect other group entities, and the protection of confidential information. Without those agreements, a test can stall when it reaches a shared platform, or findings can be diluted because no single entity accepts ownership. The designated entity should be able to show that it directed the exercise and owned the outcome, rather than merely hosting a group project.

Suppliers do not remove a firm's responsibility. Where a critical function depends on a cloud provider, a payment processor or a software supplier, the designated firm still owns the TLPT obligation and the remediation that follows. The supplier's cooperation is essential, because the test may need to touch supplier systems or observe supplier responses, but the accountability remains with the financial entity. Contracts and testing agreements should therefore anticipate TLPT, including notice, safeguards and the handling of findings that concern supplier controls.

A firm that is not designated should not describe its testing as TLPT under the framework, even if its penetration testing is thorough. Accurate labelling matters for supervisors, auditors and customers, and it prevents a routine test from being mistaken for a framework exercise. At the same time, non-designation is not a reason to neglect testing. Vulnerability scanning, penetration testing, scenario exercises and incident rehearsals all remain relevant, and they can be shaped by threat intelligence even when they do not follow the full TLPT arrangements.

Non-designated firms can also prepare for possible future designation by building the habits TLPT requires: mapping critical functions, maintaining threat intelligence, keeping an inventory of suppliers, and tracking remediation to completion. If designation later arrives, the firm will not be starting from a blank page. If it does not, the firm will still have a stronger resilience programme. The key is proportionality: testing that matches the firm's risk, without claiming a framework status it does not hold.

A firm can test its own understanding by asking a short set of questions. Has designation been confirmed in writing through the applicable route, and is that confirmation filed where the board and auditors can find it? Does the testing programme distinguish TLPT from other forms of testing, using the correct label for each? Are group and supplier arrangements in place before the next cycle begins? Is there a named owner for designation, scoping and remediation, and a deputy who can act when that owner is absent?