Check against delivery

Acknowledgements

I would like to begin this afternoon by acknowledging the Bunurong people of the Kulin nation and their ongoing connection to and custodianship of the lands on which we meet today and paying my respects to elders past and present.

I’d also like to begin by acknowledging Margaret Cole. Being the last time I may be on a stage with Margaret, I actually wanted to take a moment to formally recognise her significant contributions as a regulator, not just here domestically but internationally as a regulator.

Thinking domestically, “the Margaret Cole era” has indeed been a transformational one for APRA. Whether holding underperforming funds accountable through the mandatory performance testing or putting more data in the hands of customers and indeed developing that relationship that ASIC and APRA share. She’s been pivotal, certainly for my part in that journey, so thank you. It has been an honour to work alongside you.

Introduction

The last time we were here, I remember all the delegates ranking their priority issues for the year ahead. You might remember it was a really long list, and I remember that scams and fraud were somewhere near the bottom. You might remember I found that pretty interesting because I was up here at the time telling you – I’ll admit – pretty sternly that you needed to look at your controls.

Fast forward two months and a number of super funds were hit with cyber-attacks^[1]. We saw up to 9000 member accounts impacted, and more than half a million dollars of customers’ money stolen.^[2]

I think it was an important reminder of just how big of a business superannuation is now. Around $4.5 trillion in assets as of last September^[3]. That makes it a very big target for bad actors. It also means it now comes with very big obligations.

And if you want to meet these obligations to members and markets, your size means you actually now need to think differently about your role in the system.

Custodians of confidence

Look at it this way. By 2030, industry projects that Australia’s superannuation pool could be approaching $6 trillion dollars, which is more-or-less where the banks are today.^[4], ^[5]

So, it's not a moonshot to say that super will one day – and one day not too far away - be the biggest part of our economy.

That will make you stewards of more than Australia’s retirement future – but of our economic future too. Custodians of stability and confidence.

In a lot of ways, the shoe already fits. Look at the role super has played in private markets. As our work as shown prudentially regulated super is one of the safer and more common ways for Australians to access private markets.

But in other ways of course, there are still growing pains. Take our current review into how trustees use complaints to identify and address service issues as an example.

I stress it’s still very early days in this review. But already, a tale of two cities is emerging. Some trustees are streets ahead in terms of how they identified issues from complaints. And well done to you. Others are lagging behind.

And like what we’ve seen with the Retirement Income Covenant implementation, size is not a predictor of success.

Incredibly, five of the 10 trustees we are looking at in depth have not identified a single systemic issue from analysis of their complaints data over our period of review. So, let’s just sit with that for a minute. These trustees received thousands of complaints but told us they haven’t identified one single systemic issue through regular review of complaint data? Really? And at least one trustee failed to analyse their complaints data at all. 

Okay so why does this matter? Well, aside from it being an enforceable requirement to regularly analyse complaint data, complaints are, of course, a free source of intelligence. You don’t need an expensive consultant to tell you you’ve got a problem. Your customers are telling you, loud and clear through complaints. And listening and responding to them is customer service 101. 

What’s become really clear to me over the past few years is that right across the superannuation system and sector there is a need to invest in governance, capability, skills, systems, and operations to deliver on the promise of super to Australians and move towards best practice.

You only need to look to the ASX for a cautionary tale on what happens when your investment and aspiration doesn’t match your role in the system. The ASX is one of the most critical limbs of Australia’s financial services, but it’s failed to deliver on its promise to its customers because it has looked backward, not forward, whilst seeing its issues separately rather than listening to customers and bringing them together, for best practice.

We are all one system. Every part of the system has its gaps – platforms, industry, retail, specialists, everyone. And it will require action from everyone – from all of us – to address.

The low-hanging fruit

It’s absolutely true that some of the challenges you are facing are complex. I don’t deny that at all. But it’s also true that there’s plenty of low hanging fruit. And at the risk of triggering déjà vu for all of us in this room, one of the ripest areas for early action remains scams.

Last year, Scamwatch received more than 800 reports related to superannuation, with more than $22 million lost.

We recently benchmarked the websites of 47 superannuation funds against the big 4 banks when it came to scam communications. Banks such as NAB, ANZ, CBA, and Westpac generally scored pretty positive results over 80% of the time.

Which is probably not surprising given they now have to protect Australians from scams by law.

Super funds, on the other hand, mostly scored between 40 and 60% – so not even a passing grade in some cases. And some of it is really basic stuff. For instance:

• Only 9 funds clearly defined a scam
• One third of funds failed to provide messaging on common signs of a scam
• Only 4% - so two funds who might have links to other financial services - offered members fraud or scam alert subscriptions, and
• Only one in five super fund websites provided a dedicated telephone or email contact for members to report potential scams or fraud.

Again, why does this matter when super is only one link in the chain? Well, remember your role in the system as trusted stewards. Your website is your front door for your customers. It’s the first place they’ll go for information if worried about their super, because they trust you. You are their trustees.

Absolutely it’s not the job of the board, of yourselves, to write websites. But it is absolutely and unequivocally your job to oversee risk. More than that, it’s absolutely your job to hold management accountable for identifying and managing risk effectively. And with the amount of super in the system, this is a risk that anyone can see coming. The place to start to manage it is by having a scams strategy.

At this point, I want to note with cautious optimism the work underway among some of your industry groups, including the Financial Services Council’s Scam and Fraud Prevention Exchange in collaboration with the Super Members Council, and ASFA’s new scams and fraud tool kit. I ask you though to keep lifting on this in 2026 and evolve the collaboration and toolkits into safer customer outcomes.

Looking forward

We know this audience likes to hear what our priorities are. So what else are we looking at this year? Our priorities in superannuation are largely consistent with our priorities from last year, because there is more to do – and in fact, there’s more we’re concerned about – when it comes to supporting better outcomes in member services and in retirement.

I’ve already mentioned how we will shine a spotlight on how trustees are using complaints to identify and drive systemic improvements, as you are required to by law.

We will also follow up and follow through on our death benefits review to work to determine if you’re making progress on our recommendations. We will not rest on our laurels on this work, and we would encourage you not to rest on your laurels either.

We will continue to disrupt harmful superannuation switching behaviours.

And we will hold trustees accountable for ensuring the Retirement Income Covenant finally moves beyond implementation to delivery, for the benefit of those four million people who will be in the retirement phase of super over the next decade.

Looking then to markets, we will continue to drive transparency and consistency in fair outcomes in all capital markets, public and private, including where they intersect with superannuation.

And we’ll continue our related important work on superannuation financial reporting and audit surveillance to ensure confidence and transparency regarding the investment of Australians’ retirement savings. This includes bringing forward our review of RG97 to ensure the guidance remains robust and relevant for 2027 and beyond.

Our enforcement focus will continue to be holding super trustees to account for member service failures.

We will continue to target those responsible for the collapse of the Shield and First Guardian Master Funds through a new and dedicated enforcement priority in 2026.

As always, we will have an enduring enforcement focus on market integrity matters across all market types – all the market types you are some of the biggest investors into.

Finally, we will be increasing our enforcement focus on poor private credit practices, following our work on evolving capital markets. The stop orders we issued last year were only the beginning. This year, we’re ratcheting up, with more on this to follow soon.

Conclusion

So, we think all of this will help deliver what we have laid the foundation for in the past two years – a step-change in superannuation.

A change that will ultimately enable confident and informed participation, and transparency and efficiency for members and markets.

Let’s not all re-trade on the momentum from last year. In 2026, it’s time to step it up and see it through.

Thank you to Aleks and Conexus for the invitation to speak today. As always, I welcome your questions.

[1] Australian superannuation funds hit by cyber attacks, with members' money stolen - ABC News

[2] Super cybersecurity attack: Funds propose real-time platform to combat cybercrime

[3] APRA releases superannuation statistics for September 2025 | APRA

[4] Australia’s superannuation system estimated to grow to around $5.6 trillion in 2030 in Super Members Council’s, ‘Retirement revolution: Super’s coming of age’, August 2025.

[5] Banks currently hold about 42% of the $14 trillion in assets in the Australian financial system, according to the Reserve Bank of Australia’s October Stability Review, which equates to approximately $5.8 trillion in assets. (3. Resilience of the Australian Financial System | Financial Stability Review – October 2025 | RBA)