Your result
You are in the group authorities designate from. Today you have no TLPT obligation.
By entity type, by where you are authorised and by size, you fit inside the set from which competent authorities pick which entities have to run a TLPT. Fitting does not mean being picked.
Who has to run one is determined by the competent authority, entity by entity. Article 26(8), third subparagraph, of DORA puts it plainly: competent authorities shall identify the financial entities that are required to perform threat-led penetration tests. Article 2 of the TLPT RTS sets out the criteria they use: impact, systemic character and ICT risk profile. There is no threshold you cross on your own and no public list you sign up to.
The notification arrives in writing from your competent authority and is addressed to the entity, not to a person. If nobody in the entity has received it, you have not been identified. And once it arrives you notice: Article 9(2) of the RTS gives you three months to submit the project charter, the control team lead’s details, the communication channels and the test code name. If it had arrived, the organisation would know.
We did not ask about your size because in your case it changes nothing. Article 3, point 60, of DORA excludes trading venues, central counterparties, trade repositories and central securities depositories from the definition of microenterprise. That exit does not exist for you.
What you can do today, without depending on anyone else:
- Check the threshold above against your own figures. It is the first criterion your authority looks at.
- Review the contractual requirements with your ICT providers, which is the part of DORA that already applies to you today.
- If what you want to know is how long your team would take to detect someone inside, that is measured by a red team, regulation or no regulation.
This is not legal advice. It is the regulation read against your answers, with the articles cited so you can check it yourself. Your competent authority is the one who decides.
Your result
You have been notified. From here the calendar is set by the regulation.
From the notification onwards, the test has to meet Article 26 of DORA and Delegated Regulation (EU) 2025/1190, the TLPT regulatory technical standards. The clocks already running, with the article for each one so you do not have to take our word for it:
- Three months from the notification to submit the project charter, the control team lead’s details, whether you will use internal or external testers, the communication channels and the test code name (Article 9(2) of the RTS).
- A control team made up of your own staff, with its lead, formed after the authority validates that initiation information (Article 9(4)).
- A test manager and at least one substitute, appointed by the authority. Not by the entity and not by the provider (Article 3(2)).
- An active red team testing phase of at least 12 weeks (Article 11(5)).
- Replay and purple teaming within ten weeks of the end of the active phase (Article 12(5)).
- The attestation is issued by the authority, not by the provider, and it does not move the responsibility for the impact of the test away from you (Article 26(7) of DORA).
- And the test repeats at least every three years (Article 26(1) of DORA).
On who you can hire.
Article 27(1) of DORA does not say who gets tested: it sets the bar the testers have to clear. It asks for the highest suitability and reputation; technical and organisational capabilities with demonstrated specific expertise in threat intelligence, penetration testing and red team testing; certification by an accreditation body in a member state or adherence to formal codes of conduct or ethical frameworks; an independent assurance or audit report; and professional indemnity insurance covering the risks of misconduct and negligence. Article 7 of the RTS adds the specific documentation your control team will have to keep on file for each provider, including CVs, certifications and references from previous engagements. Ask whoever pitches you to set it out in writing. Us first.
Where we stand.
Of that bar, there are two we can evidence today: the independent assurance or audit report of point (d), and the professional indemnity insurance covering misconduct and negligence of point (e). The rest we cannot vouch for today. So we are not going to tell you we can run your regulated TLPT, or that we clear the Article 27 bar.
What we do run is unregulated red team work: measuring how long your team takes to detect and contain someone already inside. It is a different product, bought for a different reason. If that is what you are after, write to [email protected].
This is not legal advice. It is the regulation read against your answers, with the articles cited so you can check it yourself. Your competent authority is the one who decides.
Your result
A TIBER exercise can be exactly how your TLPT gets carried out. Your competent authority is the one who determines that.
TIBER-EU and DORA TLPT are not two separate worlds. Article 26(11) of DORA instructs the European Supervisory Authorities to develop the TLPT technical standards in accordance with the TIBER-EU framework. And the TIBER-EU framework updated in February 2025 says it from the other side: the TLPT-related requirements under DORA are included in its testing process, so that an entity completing a test under a national or European-level implementation of TIBER-EU will be DORA TLPT-compliant, provided it fulfils the formal requirements set by the competent authorities. That same framework adds that when it is used for TLPT obligations under DORA, the respective TLPT authorities are considered TIBER authorities for that test.
In other words: the same exercise can be voluntary, or it can be your regulated TLPT. What changes is not the method, it is the heading it runs under, and the authority determines that. Not the provider, and not you.
The useful question is this one, and it is yours to ask:
Ask your test manager, or the authority team running the exercise, whether your test is being carried out as your DORA TLPT or outside it. The answer determines the regulation’s deadlines, who signs the attestation, and whether the test counts towards the at-least-every-three-years cycle of Article 26(1).
On TIBER-ES specifically.
Its owning authority is the Banco de España, with the participation of the CNMV and the DGSFP when the entities to be tested fall within their respective areas of competence. The published implementation guide is dated January 2022 and describes participation as voluntary, but it predates DORA, the TLPT technical standards and the February 2025 update of TIBER-EU. Do not read that guide as putting your exercise outside DORA.
Where we stand.
Of the requirements Article 27(1) of DORA places on testers, there are two we can evidence today: the independent assurance or audit report of point (d), and the professional indemnity insurance covering misconduct and negligence of point (e). That is why we are not going to tell you we can run a regulated TLPT for you. Unregulated red team work we do run, and it is a different product.
This is not legal advice. It is the regulation read against your answers, with the articles cited so you can check it yourself. Your competent authority is the one who decides.
Your result
DORA applies to you. TLPT does not.
Article 26(1) of DORA leaves microenterprises outside the TLPT obligation, together with the entities in Article 16(1), first subparagraph. DORA defines microenterprise in Article 3, point 60: "a financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million". Based on your answers, that is where you are. You are not part of the group authorities designate from.
The rest of DORA does apply to you: ICT risk management, major incident reporting, digital operational resilience testing, and the contractual requirements with your ICT providers.
And the underlying question does not depend on DORA.
The reasons a red team gets bought with no regulation involved are usually these four:
- A board question about ransomware readiness.
- A new SOC, in-house or outsourced, that you want to prove works.
- A large client asking for it in their supplier due diligence.
- An incident in your sector that has changed the conversation internally.
If you want to measure detection and response, a red team does that. If what you need is coverage over a specific surface, the answer is a pentest. Tell us which fits at [email protected].
This is not legal advice. It is the regulation read against your answers, with the articles cited so you can check it yourself. Your competent authority is the one who decides.
Your result
You are in the simplified framework. TLPT does not concern you.
Article 26(1) of DORA excludes from the TLPT obligation the entities referred to in Article 16(1), first subparagraph. That subparagraph names small and non-interconnected investment firms, payment institutions exempted under Directive (EU) 2015/2366, institutions exempted under Directive 2013/36/EU for which the member state has decided not to apply the option in Article 2(4), electronic money institutions exempted under Directive 2009/110/EC, and small institutions for occupational retirement provision. Based on your answers, you are in that group.
What does apply to you is the simplified ICT risk management framework of Article 16 and the contractual requirements with your ICT providers.
And the underlying question does not depend on DORA.
The reasons a red team gets bought with no regulation involved are usually these four:
- A board question about ransomware readiness.
- A new SOC, in-house or outsourced, that you want to prove works.
- A large client asking for it in their supplier due diligence.
- An incident in your sector that has changed the conversation internally.
If you want to measure detection and response, a red team does that. If what you need is coverage over a specific surface, the answer is a pentest. Tell us which fits at [email protected].
This is not legal advice. It is the regulation read against your answers, with the articles cited so you can check it yourself. Your competent authority is the one who decides.
Your result
DORA does not apply to you.
Article 2(3)(e) of DORA leaves outside the regulation "insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries that are microenterprises or small or medium-sized enterprises". DORA defines those three sizes in Article 3, points 60, 63 and 64: a medium-sized enterprise is one that employs fewer than 250 persons and has an annual turnover not exceeding EUR 50 million and/or an annual balance sheet not exceeding EUR 43 million. Based on your answers you are inside that group, so neither the regulation nor TLPT binds you.
Two things worth keeping in mind:
- If you work for entities that are subject to DORA, their contractual requirements for ICT providers can reach you through the contract even though the regulation does not bind you directly.
- Other security regulation may apply to you by another route. This test only looks at DORA.
And the underlying question still stands: if someone got into your network today, how long would it take you to see it? That is measured the same way, regulation or no regulation. Write to [email protected].
This is not legal advice. It is the regulation read against your answers, with the articles cited so you can check it yourself. Your competent authority is the one who decides.
Your result
DORA does not apply to you.
Article 2(3)(c) of DORA leaves outside the regulation "institutions for occupational retirement provision which operate pension schemes which together do not have more than 15 members in total". Based on your answers that is your case, so neither the regulation nor TLPT binds you.
Two things worth keeping in mind:
- If you work for entities that are subject to DORA, their contractual requirements for ICT providers can reach you through the contract even though the regulation does not bind you directly.
- Other security regulation may apply to you by another route. This test only looks at DORA.
And the underlying question still stands: if someone got into your network today, how long would it take you to see it? That is measured the same way, regulation or no regulation. Write to [email protected].
This is not legal advice. It is the regulation read against your answers, with the articles cited so you can check it yourself. Your competent authority is the one who decides.
Your result
You are inside DORA, but on the other side of the contract.
ICT third-party service providers are point (u) of Article 2(1). And there is a detail in the text worth knowing: paragraph 2 of that same article reserves the name "financial entities" for points (a) to (t). You are not one, and TLPT is an obligation of the financial entity, not of the provider. What reaches you is something else:
- The contractual requirements your financial clients have to carry into the contracts they sign with you.
- If the European Supervisory Authorities designate you a critical ICT third-party service provider, you enter the Oversight Framework, with a Lead Overseer assigned.
- If a client of yours is identified for a TLPT, the scope can reach the services you provide to them. Article 26(3) requires the financial entity to take the necessary measures to secure your participation, and Article 26(4) provides that in certain cases you contract the tester directly yourselves, for a pooled test covering several financial entities. That is negotiated and documented before it starts, not during.
The useful part:
If you sell to the financial sector, what usually unblocks a supplier due diligence is being able to show a recent offensive test against the service you provide, with the report and the fixes verified. Write to [email protected].
This is not legal advice. It is the regulation read against your answers, with the articles cited so you can check it yourself. Your competent authority is the one who decides.
Your result
DORA is not about you.
DORA applies to the entity types listed in its Article 2(1), all of them in the financial sector, plus ICT third-party service providers. If you are not on that list, neither the regulation nor TLPT binds you.
It can still reach you through contracts: if you sell to banking, insurance or markets, your clients are subject to it and will pass security requirements on to you. And other regulation may apply to you by another route, because this test only looks at DORA.
The underlying question holds with no regulation involved: how long would your team take to detect someone inside? That is exactly what a red team measures. Write to [email protected].
This is not legal advice. It is the regulation read against your answers, with the articles cited so you can check it yourself. Your competent authority is the one who decides.
Your result
With no EU authorisation, DORA does not bind you directly.
DORA is addressed to entities authorised or registered in the European Union. With no EU authorisation or registration, the regulation does not bind you on its own, and the Article 26 TLPT identification does not reach you either.
Two routes by which it can still reach you:
- Through contracts, if you provide services to EU financial entities or they provide them to you.
- Through the group, if you have or authorise a subsidiary or a branch in a member state. At that point the entity to look at is the European one, and this test gives a different answer.
And the underlying question does not change country: if someone got into your network today, how long would it take you to see it? Write to [email protected] and we will look at it.
This is not legal advice. It is the regulation read against your answers, with the articles cited so you can check it yourself. Your competent authority is the one who decides.
The threshold your authority looks at first
Article 2(2) of Delegated Regulation (EU) 2025/1190 requires authorities to demand a TLPT from a closed list of entities, unless their own assessment of impact, financial stability and ICT risk profile says it is not justified. It is not automatic and the notification is still needed, but it is the criterion applied before any other, and you can check it against your own figures today.
Credit institutions identified as global systemically important institutions (G-SIIs) or as other systemically important institutions (O-SIIs) under Article 131 of Directive 2013/36/EU, and those forming part of a G-SII or an O-SII.
Payment institutions with payment transactions totalling more than EUR 150 billion in each of the two calendar years preceding the assessment. Electronic money institutions, with that same transaction threshold or with electronic money outstanding totalling more than EUR 40 billion. For account information service providers, Article 2(2) sets no threshold of their own: they are assessed under the general criteria of paragraph 1.
Central securities depositories and central counterparties are on the list with no threshold: all of them. Trading venues with an electronic trading system are in if they hold the largest national market share by turnover in one of the instrument categories listed in point (f), or more than 5% of Union-wide share, in each of the two preceding calendar years. For trade repositories, paragraph 2 sets no threshold of their own.
Insurance and reinsurance undertakings meeting all three criteria of point (g): gross written premiums above EUR 1.5 billion, technical provisions above EUR 10 billion, and, for those pursuing only life activities or both life and non-life, total assets exceeding 3.5% of the sum of total assets of insurance and reinsurance undertakings established in the member state. Within that subset, the obligation is triggered if any of these three also applies: gross written premiums above EUR 3 billion, technical provisions above EUR 30 billion, or total assets above 10% of that same sum. Point (g) is densely drafted: if your figures are anywhere near those numbers, read it directly.
For your type, Article 2(2) sets no threshold of its own. You are assessed under the general criteria of paragraph 1: size, interconnectedness, the critical nature and substitutability of your services, the complexity of your business model, membership of a systemic group, and on the ICT side your risk profile, your threat landscape, how far your critical functions depend on ICT systems, and the maturity of your detection and response.
Who governs your case, in Spain
Article 46 of DORA splits supervision by entity type, referring to the sectoral rules for each figure. One nuance worth having clear before the table: for TLPT the authority may not be the same one. Article 1, point 7, of the RTS defines the TLPT authority as any of three things: the single public authority a member state designates under Article 26(9) of DORA; the authority to which tasks are delegated under Article 26(10); or any of the authorities in Article 46. And Article 16(6) of the RTS expressly contemplates the two being different and having to share information.
The Banco de España. If the bank is classified as significant within the Single Supervisory Mechanism, the supervisor is the European Central Bank (Article 46(a)).
The Banco de España (Article 46(b), referring to Article 22 of Directive (EU) 2015/2366).
The Banco de España, which in Spain supervises issuers of asset-referenced tokens and e-money tokens under MiCA (Article 46(d)).
The CNMV (Article 46(c)).
The CNMV (Article 46(i) and (j)).
The CNMV for central securities depositories, central counterparties and trading venues (Article 46(e), (f) and (g)). For trade repositories, point (h) refers to Article 22 of Regulation (EU) No 648/2012, which designates a national authority, and in Spain that is the CNMV. Bear in mind that registration and day-to-day supervision of trade repositories under EMIR sit with ESMA, so here you can have two counterparts.
The CNMV, the competent authority in Spain for MiCA compliance by crypto-asset service providers (Article 46(d)).
The CNMV (Article 46(p)).
It depends which of the four you are. For credit rating agencies, Article 46(n) refers to Article 21 of Regulation (EC) No 1060/2009, which is ESMA. For securitisation repositories, point (q) refers to Articles 10 and 14(1) of Regulation (EU) 2017/2402, which is also ESMA. Administrators of critical benchmarks (point (o)) and data reporting service providers (point (g)) are split between ESMA and the national authority depending on the case. Tell us which one you are and we will pin it down.
The Directorate General for Insurance and Pension Funds, the DGSFP (Article 46(k)).
The DGSFP (Article 46(l)).
The DGSFP (Article 46(m)).
And for TIBER-ES: the owning authority of the framework is the Banco de España, with the participation of the CNMV and the DGSFP when the entities to be tested fall within their respective areas of competence.
Your competent authority is the sectoral supervisor of that member state, not the Spanish one. The Spanish split gives you a reference for how this is usually structured: banking and payments with the central bank, markets and investment with the securities supervisor, insurance and pensions with the insurance supervisor.
The entity to look at is the European one, and its competent authority is that of the member state where it is authorised.
Where each piece comes from: Regulation (EU) 2022/2554 (DORA), Articles 2, 3, 16, 26, 27 and 46. Delegated Regulation (EU) 2025/1190, the TLPT regulatory technical standards, Articles 1, 2, 3, 7, 9, 11, 12 and 16. The European Central Bank’s TIBER-EU framework, updated on 11 February 2025. The Banco de España’s TIBER-ES implementation guide, January 2022.
