Source: OJ L, 2025/1190, 18.6.2025

Current language: EN

Article 8 Specificities for pooled or joint TLPTs


Summary What does Article 8 of the RTS on threat-led penetration testing say?

This article serves as a bridging provision that connects the general TLPT procedural steps (laid out in Articles 9 to 15) to the specific scenarios where multiple financial entities are involved in a joint or pooled TLPT.

It establishes two default rules: first, that each participating financial entity must individually follow the full procedural sequence, and second, that where multiple TLPT authorities are involved, any reference to "the TLPT authority" throughout Articles 9 to 15 should be read as referring to the lead TLPT authority.

Both rules can be displaced — the first by a decision of the lead TLPT authority, and the second by other provisions within the regulation itself.

Important points:

  • Follow each procedural step in Articles 9 to 15 individually, even when participating in a joint or pooled TLPT, unless the lead TLPT authority decides otherwise.
  • In joint or pooled TLPTs involving multiple TLPT authorities, the lead TLPT authority assumes the role of "the TLPT authority" for the purposes of Articles 9 to 15.
  • This article directly links to Article 16, which governs how joint and pooled TLPTs are organised and how a lead TLPT authority is determined.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

    1. Unless otherwise decided by the lead TLPT authority, where several financial entities, identified in accordance with Article 16(2) or (4), are involved in a pooled or joint TLPT, each financial entity shall follow each of the steps set out in Articles 9 to 15.

    1. Unless otherwise provided in this Regulation, where several TLPT authorities are involved in a joint TLPT or in a pooled TLPT, as referred to in Article 16(3) or 16(5), references in Articles 9 to 15 to the ‘TLPT authority’ shall be understood as a reference to the lead TLPT authority for such pooled or joint TLPT.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod