How to comply with article T.7 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with article T.7 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapMutual recognition is an option, not an automatic right. The trap that the CSSF and the BCL sanction in practice is the cross-border group entity that assumes a TLPT run by the parent under a foreign authority covers its Luxembourg critical functions by default. If the tested scope does not cover the critical functions operated or supervised in Luxembourg, or if the lead TLPT authority has not formally validated the recognition, the entity remains liable to redo the test. The duplication avoided cannot be declared: it must be documented, critical function by critical function.The practical traps of cross-border and pooled testingBelieving a pooled group TLPT covers every entity when the scoping (Article 26 DORA) did not include the specific critical functions of the Luxembourg subsidiary.Overlooking the prior approval of the lead TLPT authority and its coordination with the CSSF, which conditions the validity of mutual recognition.Launching a joint test on a common critical ICT third-party provider without the proper contractual framework (subcontracting RTS 2025/532, CSSF circulars 22/806 and 25/882), exposing the confidentiality of results between competing entities.Forgetting that the remediation arising from the pooled test must feed the individual ICT risk management of each entity (CSSF circular 20/750), not stay at consolidated level.Underestimating the BCL's role in the TIBER-LU framework (Implementation Document revised on 20 June 2025) when coordinating white teams across several jurisdictions.How Luxgap automates this riskOur Luxgap TLPT Recognition Orchestrator eliminates the cross-border grey zone by mapping, critical function by critical function, what a foreign test actually covers and what still has to be tested in Luxembourg. The tool cross-references your DORA critical functions register, your ICT provider information register (RTS 2025/532 format) and the scoping reports of group TLPTs to produce an opposable coverage matrix, aligned with the TIBER-EU methodology revised on 11 February 2025 and the TIBER-LU framework.Automatically detects Luxembourg critical functions not covered by a foreign TLPT by comparing scoping perimeters against your DORA register entries.Generates the mutual recognition request file ready to submit, with a map of the authorities involved (CSSF, BCL, lead TLPT authority).Identifies critical ICT third-party providers common to several group entities and proposes a joint test setup compliant with circulars 22/806 and 25/882.Compartmentalises results per entity to preserve confidentiality between subsidiaries during a pooled TLPT, with a timestamped access log.Distributes each remediation finding to the individual ICT risk management of each entity, in line with circular 20/750.Produces a timestamped and sealed PDF report, opposable to the CSSF, demonstrating that the invoked mutual recognition truly covers the regulatory perimeter.Available as a complement to a Luxgap CISO mandate or as...

Mutual recognition and cross-border pooled testing

They trust us

Before we chat