art_27__para_1

Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (Text with EEA relevance) · European Union

1. Financial entities shall only use testers for the carrying out of TLPT, that: are of the highest suitability and reputability; possess technical and organisational capabilities and demonstrate specific expertise in threat intelligence, penetration testing and red team testing; are certified by an accreditation body in a Member State or adhere to formal codes of conduct or ethical frameworks; provide an independent assurance, or an audit report, in relation to the sound management of risks associated with the carrying out of TLPT, including the due protection of the financial entity’s confidential information and redress for the business risks of the financial entity; are duly and fully covered by relevant professional indemnity insurances, including against risks of misconduct and negligence.

← Article 27 · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-12 · Text as adopted (Official Journal); later amendments are not incorporated in this text.