Recital 57

Threat-Led Penetration Testing in the Home Member State Unofficial title

Financial entities involved in cross-border activities and exercising the freedoms of establishment, or of provision of services within the Union, should comply with a single set of advanced testing requirements (i.e. TLPT) in their home Member State, which should include the ICT infrastructures in all jurisdictions where the cross-border financial group operates within the Union, thus allowing such cross-border financial groups to incur related ICT testing costs in one jurisdiction only.

https://dora.digiphile.law/recital/recital-57.html

Text as at 2 November 2026.

This is an unofficial convenience version of the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in November 2026.