Artificial Intelligence Governance & Readiness
The artificial intelligence (AI) hype machine was firing on all cylinders in 2024, with bold predictions about how financial services might be revolutionised by those institutions that embrace the integration of AI technologies into their operations.
Regulators have not been sitting on their hands, with the Australian Securities and Investments Commission (ASIC) publishing a report on its findings from a review into the use of AI by 23 AFS licensees and credit licensees.
The report focused on the identification and mitigation of consumer risk, and governance arrangements. ASIC’s findings revealed nearly half of the assessed licensees did not have policies in place that considered consumer fairness or bias, and even fewer had policies governing the disclosure of AI use to consumers.
As financial institutions move towards greater integration of AI-related technologies in operations, it is important for serious consideration to be given to establishing governance arrangements that will promote the responsible use of AI in decision making and facilitate better management of the risks associated with AI enabled operations.
Moving towards greater transparency about the use of AI technology should also be on the agenda of financial institutions and information-driven organisations. Parliament passed the Privacy and Other Legislation Amendment Bill 2024 in November 2024. This legislation will require that privacy policies contain disclosures about the extent of any use of personal information for decision making that is automated by use of a computer program, where the decision could reasonably be expected to affect the rights or interests of the individual.
The privacy policy disclosure obligation doesn’t commence until 11 December 2026, but there’s plenty to do in the meantime to focus on better understanding AI use cases and the resulting changes to risk frameworks and policies.
Scams Prevention Framework
Regulators and lawmakers are increasingly concerned about the risks that malicious actors pose to Australians through heightened scam activity. There are legislative and regulatory changes afoot which will warrant attention from the superannuation and financial services sector.
The Scams Prevention Framework Bill 2024 was introduced to parliament in early November, before being referred to the Senate Economics Legislation Committee. The Committee is expected to issue its report and recommendations in early February. The bill seeks to impose obligations to prevent and respond to scams on designated sectors. The Bill would designate social media/advertising companies, banks, and telecommunications providers upfront, but financial services and the superannuation sector are likely to be designated at a future point. The Scams Prevention Framework would consist of:
1. Overarching principles (SPF principles) that apply to regulated entities;
2. Sector-specific codes (SPF codes) that apply to regulated entities in certain regulated sectors;
3. Rules (SPF rules) to support the effective operation of the framework;
4. A multi-regulator framework (with the ACCC being the default, unless another regulator is designated for the sector);
5. Regulatory and enforcement mechanisms, including a two-tier civil penalty framework; and
6. Dispute resolution mechanisms (with AFCA being the external dispute resolution body).
Principles-based regulation would provide flexibility for regulated entities and regulators to adapt to an evolving scams threat environment. The principles would require each regulated entity to document and implement governance arrangements to combat scams and take reasonable steps to prevent, detect, report, disrupt, and respond to scams relating to, connected with, or using the entity’s regulated service.
The reasonable steps part is important. It is up to regulated entities to determine the steps that they will take to prevent, detect, report, disrupt, and respond to scams in relation to their services. Prudent organisations will be taking a proactive approach to ensuring that they understand the scams threat environment for their business and design a framework that is fit for purpose and adaptable.
For trustees of superannuation funds, there are existing regulatory expectations in the form of SPG 223 Fraud Risk Management, which already suggest that trustees to have systems for identifying, assessing, managing, mitigating and monitoring material risks that include fraud related risk.
Now is the time to review existing fraud risk related frameworks to ensure that these remain fit for purpose in the evolving threat environment, and aligned with the Scams Prevention Framework principles which will apply to superannuation in due course.
Payday Super Planning
Payday Super is coming, and there will be plenty of work to do in preparation for a 1 July 2026 commencement date. At face value, the reforms are simple enough. Employers will be required to make superannuation guarantee contributions at the same time as related wages for that pay cycle are paid. The intended impact is that superannuation guarantee contributions are received in an employee’s superannuation account within 7 calendar days of payday. Presently, employers are only required to make superannuation guarantee contributions in quarterly instalments.
There are several important related changes which will require planning and consideration:
1. The deadline for trustees of superannuation funds to allocate contributions will reduce from 20 business days down to three business days. This is likely to require that administration and clearing house contracts are revisited to ensure appropriate service arrangements and levels are in place;
2. SuperStream data and payment standards will be revised to allow for the New Payments Platform (NPP) to be used to make payments (rather than the EFT system). This is significant, as the NPP allows for complex data to be integrated within the payment transaction itself. This could create significant efficiencies over reconciling data and payments. It also means that payments will process almost instantly; and
3. There will be heavier penalties for employers that do not comply, but discounted penalties for employers who self-report non-compliance will make monitoring of compliance important for employers and trustees of superannuation funds with employer-sponsors.
The adoption of these changes will require cooperation between trustees of superannuation funds, administration service and software providers, clearing house and gateways, and payroll software providers. There is an opportunity for industry leaders to get started on developing better integrated and more efficient operations.
Key Contributors:
This article was produced as part of The Quarterly – Q2 FY25 by Jonathan Steffanoni, Managing Partner of Legal & Prudential Advisors.
For more information about anything you’ve read here, or if you have a more general inquiry, please contact us.