How to comply with article T.1 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with article T.1 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThe trap is not failing a TLPT, it is assuming you are not subject to one. Many CSSF-regulated entities presume they are not significant and skip any preparation, when identification is in fact a decision of the TLPT authority (CSSF under Article 46 of DORA, working with the BCL through the TIBER-LU framework). The CSSF first penalises lack of anticipation: an identified entity that discovers its obligation too late, a poorly mapped scope of critical functions, or ICT providers overlooked even though they fall within the test under circulars 22/806 and 25/882.The criteria that pull you into TLPT scopeSize and market share: systemically important credit institutions, transaction volumes, total balance sheet.Risk profile and interconnection: CSDs, CCPs, trading venues, infrastructures whose failure spreads through the system.Systemic importance: certain payment and e-money institutions, significant insurance and reinsurance undertakings.Critical or important functions: they form the core of the scope, tested in live production, not in a staging environment.Frequency: a TLPT at least every three years, unless the TLPT authority decides otherwise.ICT outsourcing chain: providers under RTS 2025/532 are folded into the test scope and the remediation feeding circular 20/750.How Luxgap automates this riskOur Luxgap TLPT Scope Radar continuously determines whether you cross the TLPT identification threshold and maps your critical-function perimeter before the CSSF does it for you. The tool cross-references your regulatory registers (CSSF reporting, the DORA information register of ICT providers), your Active Directory, your Microsoft Defender and Azure Sentinel feeds, and your application mapping to reconstruct the real chain of critical functions in production.Computes a TLPT eligibility score from the quantitative and qualitative criteria of RTS 2025/1190 (size, risk profile, systemic importance) and alerts as soon as a threshold approaches.Automatically maps critical or important functions and links them to live production systems, with no manual questionnaire.Detects the ICT providers in the DORA register that enter test scope under RTS 2025/532 and circulars 22/806 and 25/882.Generates a TIBER-LU scoping file aligned with the Implementation Document revised on 20 June 2025, anticipating white team, red team and threat intelligence.Tracks the three-year cycle and schedules remediation milestones feeding ICT risk management under circular 20/750.Produces a timestamped PDF report opposable to the CSSF, demonstrating your eligibility assessment and perimeter coverage.Available alongside a Luxgap CISO mandate or as a dedicated SaaS module depending on your perimeter. Request a tailored quote and our teams prepare a demonstration on your real perimeter, with a free blind audit within 48h to measure your exposure before any engagement.

Which financial entities are subject to TLPT

They trust us

Before we chat