Bank Pentest Requirements | Permissions, Evidence & DORA Scope

Separate the testing objective from the regulatory label

Start by identifying why the bank needs testing and which internal, contractual or regulatory requirement the work should support. A conventional pentest does not automatically satisfy a formal TLPT process. Agree the relevant authority and scope with your responsible teams, then translate the objective into permitted testing and required evidence.

Document the systems, environments and third parties that authorise the work.
Make payment restrictions, stop contacts and evidence handling explicit.
State the intended assurance use and the limits of the report.

Prepare the provider questions · Draft an evidence-led scope

Applicability comes before the label

DORA applies to covered financial entities, while statutory TLPT is a specific advanced-testing process for identified entities. A bank penetration test can support the broader testing programme without being a DORA TLPT. PCI DSS may be relevant to cardholder-data scope; GDPR and supervisory expectations require separate consideration.

Record the legal entity, services, jurisdictions, data categories and contractual commitments. Confirm the current official text and authority guidance with the responsible legal or compliance team. The same technology may support organisations with different obligations.

What a technical test can contribute

Scoped observations can support security-risk decisions and demonstrate whether selected controls work as expected. Evidence needs dates, systems, identities and limitations. A finding register helps connect remediation to accountable owners; it does not assess every governance, contractual or organisational duty.

Use the relevant primary sources

DORA general testing and statutory TLPT are distinct. PCI DSS scope and assessment expectations should be confirmed with the responsible programme or assessor. A generic penetration test should never be labelled a complete compliance certification.

Keep assurance boundaries explicit

Report what was tested, what was not tested and what relied on a supplied starting point. If authority coordination, an independent assessment or a formal attestation is required, treat it as its own process. The sample report is educational evidence of format, not evidence that a real organisation complies.

Primary sources

General information, not a compliance opinion. Confirm legal applicability and testing requirements for your entity and jurisdiction.