APRA has highlighted cyber security, AI oversight, geopolitical risks, and system stress testing as key concerns for superannuation and banks.
The Australian Prudential Regulation Authority (APRA) has urged superannuation funds to accelerate their investment in cyber resilience, warning that many still fall short of expected standards in protecting sensitive member data and high-risk transactions.
Executive director of cross-industry risk, Chris Gower, told the RMA CRO Conference that strengthening cyber resilience remains a top supervisory priority.
He pointed to Prudential Standard CPS 234, in force since 2019, as the benchmark for information security.
“While we have observed much progress since then, the pace of improvement has been slower than expected or required, especially given the worsening threat landscape and the clear expectations of the community that their data and funds are protected,” Gower said.
“APRA has repeatedly made clear to industry that appropriate investment in cyber preparedness is non-negotiable.”
Gower stressed that robust authentication controls are central to this preparedness and cited that recent cyber attacks exposed that “many super funds weren’t meeting the expected standards”, particularly in regard to protecting “sensitive member data and high-risk transactions”.
APRA’s June letter reinforced its expectations around information security, and the regulator is now reviewing responses from funds, Gower added.
On artificial intelligence, APRA plans to step up monitoring by reviewing practices across larger institutions.
“We remain of the view that our existing regulatory framework is sufficient to capture the use of AI by banks, insurers and super funds, and have no new regulations planned,” Gower said.
“However, such is the speed with which AI adoption is progressing we must keep a close eye on developments and an open mind about what is needed to protect the community and financial stability.”
Gower also highlighted rising geopolitical risks, stating that APRA, alongside the Council of Financial Regulators, has developed a “dedicated geopolitical risk workplan” to prepare for “severe but plausible” scenarios.
These could expose Australian institutions through traditional financial channels or less direct threats such as sanctions enforcement or foreign interference, according to Gower.
“Giving due regard to these wider vulnerabilities will be an important part of risk management for financial institutions going forward,” he said.
At the system level, APRA has launched its first stress test examining interconnections between the banking and superannuation sectors.
The inaugural scenario, presented in April, simulated significant market disruption, including volatility in foreign exchange rates, combined with an operational risk component.
“The stress experienced by banks and super funds under the scenario, and their response to managing it, will help us explore the impacts of liquidity stress in banking and super, and how their actions may amplify shocks to the financial system,” Gower said.
APRA expects initial findings later this year, followed by a second phase.
