Industry tensions over who will lead on cyber governance standards

The Financial Services Council has criticised the Association of Superannuation Funds of Australia for engaging in anti-competitive behaviour, after applying to the country’s consumer watchdog for an exemption to negotiate with third-party vendors on behalf of all super funds.

The pressure to uplift standards came after cyberattacks last April on Insignia Financial, AustralianSuper, Australian Retirement Trust, Rest and Hostplus exposed gaps across major funds and platforms.

The government told the major superannuation associations to uplift cyber resilience, writing to the Financial Services Council, Super Members Council and the Association of Superannuation Funds of Australia to promote a “unified and coordinated industry response to cyber risks” and encouraged the industry to align to the initiatives being pursued by ASFA and the FSC.

“Multiple approaches to addressing this issue have the potential to create unnecessary uncertainty in response to an incident, which would be undesirable,” the letter from Minister for Financial Services Daniel Mulino, seen by Professional Planner, said.

“As part of the next phase of this work, I would be grateful if you could work collaboratively with your superannuation association counterparts to promote a unified approach to cyber resilience is adopted and that you keep me updated of progress in this regard.”

Mulino told Professional Planner in a statement that the government sees a leadership opportunity for industry associations to collaborate in the interests of the sector and drive a more unified and coordinated response to cyber resilience.

“Since the cyber security incident in April last year, superannuation funds and regulators have taken steps to improve the cyber resilience of superannuation funds,” Mulino said.

“Superannuation funds have a legal responsibility to protect the retirement savings of millions of Australians.”

The unified response is required as the various associations, while having member overlap, represent different cohorts.

The FSC membership includes retail super funds and platforms, as well as the major advice licensee owners; SMC represents industry funds while ASFA’s membership includes a mix of both retail and industry funds.

Concerns were raised by the FSC after it was blocked from negotiating with CI-ISAC (the Critical Infrastructure Information Sharing and Analysis Centre) over exclusivity arrangements with ASFA.

“More recently, the FSC is concerned by apparent price negotiations between ASFA and CI-ISAC before ACCC authorisation has been issued to permit collective dealing with a chosen service provider, raising competition law concerns for participating funds,” FSC chief executive Blake Briggs said in a statement.

Australia’s competition law prohibits competitors from negotiating services collectively or exchanging certain information with one another, with some exemptions, and ASFA has sought authorisation from the ACCC to negotiate on behalf of the industry.

ASFA applied to the ACCC for authorisation to exchange information through cyber and financial crime information sharing platforms for the purposes of identifying and responding to cyber and financial crime threats across the superannuation industry on behalf of itself, superannuation funds, industry associations and service providers to superannuation funds.

This authorisation, which would only apply for five years, included the ability to collectively negotiate with third parties to set up the information sharing platforms. A decision on the exemption is expected to be made in the next couple of months.

ASFA’s framework, SC3, covers four areas: an intelligence sharing platform, a cyber incident playbook, regular sector-wide response exercises to test that coordination and specialist forums and working groups.

ASFA said that participation in their scheme would be voluntary and that there is no requirement to be an ASFA member to participate.

A submission from the Department of Home Affairs advocated for ASFA’s application, saying it broadly aligned with the intent of the Government’s 2023-2030 Australian Cyber Security Strategy to strengthen industry collaboration and improve threat information sharing across the economy.

The FSC has developed its own cyber framework, the Australian Superannuation Cybersecurity Forum, and Briggs said that major gaps in the superannuation industry’s cybersecurity framework would emerge if it were controlled by any single association. 

“The government and regulators have made it clear that protecting superannuation consumers from cybersecurity threats is too important to be captured by the interests of any individual sector or association,” Briggs said.

“The FSC’s position is that cybersecurity should be a collaborative effort across superannuation funds and industry bodies.

“The FSC encourages ASFA to take a collaborative approach and not seek to establish exclusive control over Australian superannuation cybersecurity infrastructure. Superannuation funds and associations working together will result in stronger protections for consumers.”

The Super Members Council, whose membership consists of industry funds, wrote to the consultation throwing its support behind ASFA, as did multiple ASFA members.

However, other parties in the system had concerns about ASFA leading the way; the SMSF Association told the ACCC it should not authorise the current application.

“This point is particularly important for SMSFs, which have distinct structural characteristics compared to APRA-regulated funds,” the SMSF Association submission said.

“SMSFs are limited to six members, with individuals acting as both members and trustees of the fund, operating their own bank accounts and facing cyber risks more akin to individuals than large entities. These differences underscore the need for a coordinated, sector-wide response that reflects all parts of the system.”

Briggs said the FSC has sought to lead a collaborative approach by forming the Australian Superannuation Cybersecurity Forum, which would be free for all superannuation funds and has over 30 funds and service providers participating, including SMC and ASFA.

“The FSC has also consulted with the forum on the development of a cyber incident playbook, to support coordination during a cyber incident,” Briggs said.

“The FSC encourages the sector to develop a culture of trust between funds, underpinned by the merit-based selection of an ISAC service to share information during an incident, with coordination responsibility shared across the three peak bodies – FSC, ASFA and SMC.”