Highlights

  • RBA Assistant Governor Brad Jones identified the combination of major financial market disruptions and operational failures as an emerging risk for Australia's financial system.
  • Concentration among superannuation administrators and custody service providers could create shared operational vulnerabilities across multiple funds.
  • Artificial intelligence is accelerating both offensive and defensive cybersecurity capabilities, increasing the importance of operational resilience.
  • Recent regulatory stress testing suggests the superannuation sector remains reasonably resilient to substantial financial stress, although combined operational and market shocks present additional challenges.

Australia's superannuation sector faces an increasingly complex operational risk environment as financial institutions become more dependent on interconnected technology systems and specialised service providers.

During a panel discussion at the Super and Wealth Summit in Melbourne on 26 October 2026, Reserve Bank of Australia (RBA) Assistant Governor (Financial System) Brad Jones discussed how cybersecurity incidents and operational failures could amplify financial market stress.

Jones identified the possibility of significant financial disruptions occurring alongside major operational incidents as an important consideration for regulators and superannuation funds.

His remarks highlighted the need to assess financial resilience and operational preparedness together, particularly as Australia's retirement savings system continues to expand.

Why Operational Resilience Matters for Superannuation

Superannuation funds rely on a range of operational systems to manage member accounts, process transactions, administer investments and meet payment obligations.

These activities depend on reliable technology infrastructure and services provided by external organisations.

Operational disruptions can affect a fund's ability to perform essential functions, even where its underlying investments remain financially sound.

Jones highlighted concentration in parts of the superannuation service-provider industry, including fund administration and custody services.

Where multiple funds depend on a relatively small number of providers, an incident affecting one provider could create difficulties across several institutions.

This makes the management of shared operational dependencies relevant to financial system stability.

Concentrated Service Providers Create Common Vulnerabilities

Service-provider concentration can introduce risks that extend beyond individual superannuation funds.

Administrators support member records and transaction processing, while custody providers perform important functions associated with safeguarding and administering investment assets.

When several funds rely on the same operational infrastructure, disruptions can potentially affect multiple organisations simultaneously.

Such dependencies may become particularly important during periods of increased transaction activity or financial market volatility.

Jones indicated that the RBA is attentive to this concentration and its implications for financial system resilience.

However, the panel discussion did not identify individual service providers as financially unstable or specify any imminent operational failure.

The concern relates to how concentrated infrastructure could transmit disruption if a significant incident occurred.

Artificial Intelligence Changes the Cybersecurity Environment

Artificial intelligence is introducing additional considerations for financial sector cybersecurity.

Jones described AI as an accelerant of operational risks that have received increasing regulatory attention over recent years.

He explained that technological development is strengthening both offensive and defensive capabilities.

The Assistant Governor characterised this development as an arms race, reflecting the rapid evolution of the tools available to attackers and financial institutions.

AI-enabled technologies can support the identification of suspicious activity and the analysis of complex security information.

At the same time, increasingly sophisticated malicious activity can place greater demands on cybersecurity systems and operational controls.

Jones's remarks suggest that regulators are focusing on how financial institutions manage these changing technological risks.

What Happens When Financial and Operational Shocks Overlap?

A central concern raised during the discussion was the potential interaction between financial market stress and operational disruption.

During periods of market volatility, superannuation funds may need to respond quickly to changes in asset prices, liquidity requirements and investment exposures.

These conditions can increase the importance of timely access to financial infrastructure and reliable transaction processing.

An operational incident occurring at the same time could complicate a fund's ability to manage investment positions or meet financial obligations.

Jones identified this combination of risks as an area requiring greater attention.

The concern is not limited to the direct impact of an operational failure. It also includes the possibility that an incident could make an existing financial disruption more difficult to manage.

What Did the RBA Say About Current Financial Resilience?

The RBA and the Australian Prudential Regulation Authority have undertaken stress testing of the superannuation sector over recent years.

Jones indicated that the results generally suggest the sector is reasonably positioned to withstand significant financial market stress under current conditions.

He also highlighted the stabilising role superannuation funds played during previous market disruptions.

In 2008 and 2020, the sector acted as a net buyer of domestic equities, providing investment demand during periods of market weakness.

However, the Assistant Governor distinguished this historical resilience from future challenges arising from structural changes and operational dependencies.

Financial stress testing provides important information about portfolio and liquidity risks, while operational resilience introduces additional considerations.

Australia's Growing Superannuation Sector Increases the Importance of Preparedness

Australia's superannuation industry manages more than AUD 4.4tn in assets, making its stability important to the broader financial system.

As the sector expands, its operational infrastructure supports an increasingly substantial volume of retirement savings and investment activity.

Jones also highlighted changes in withdrawal patterns, foreign exchange hedging liquidity requirements and growing ownership of domestic assets.

These developments could increase the complexity of managing financial obligations during periods of market stress.

The interaction between financial and operational risks therefore becomes increasingly relevant as funds manage larger portfolios and evolving member requirements.

What Operational Risks Will Remain in Focus?

Several areas identified in the discussion are relevant to the sector's future resilience.

These include the concentration of essential service providers, the evolution of cybersecurity threats and the ability of funds to respond when financial market disruptions occur alongside operational incidents.

The increasing use of artificial intelligence adds another dimension to the management of financial technology risks.

Jones's remarks did not suggest that the superannuation sector was currently experiencing a systemic operational crisis.

Instead, they emphasised the importance of understanding vulnerabilities before they develop into more substantial financial stability problems.

Key Insights

The RBA's latest discussion highlights the growing relationship between cybersecurity, operational infrastructure and financial market resilience.

Although current stress-testing assessments indicate that Australia's superannuation sector is generally positioned to manage substantial financial stress, concentrated service-provider dependencies and evolving cyber threats introduce additional risks.

Jones identified the combination of major market volatility and a significant operational incident as an important scenario for financial institutions to consider.

As Australia's retirement savings system continues to expand, operational continuity, liquidity management and cybersecurity capabilities will remain central to assessments of financial stability.

Q1. What operational risks did the RBA identify for superannuation funds?

Assistant Governor Brad Jones highlighted concentrated service providers, cybersecurity threats and the possibility of operational disruptions occurring during financial market stress.

Q2. Why is service-provider concentration a concern?

When multiple superannuation funds depend on the same administrators or custody providers, a disruption affecting those services can potentially affect several funds.

Q3. How does artificial intelligence influence cybersecurity risks?

AI is accelerating both offensive and defensive capabilities, changing the nature and complexity of cybersecurity threats faced by financial institutions.

Q4. Are Australian superannuation funds financially resilient?

Jones indicated that recent regulatory stress testing generally suggests the sector is reasonably positioned to withstand substantial financial market stress under current conditions.

Q5. Why are combined financial and operational shocks important?

An operational disruption during financial market volatility could complicate transaction processing, liquidity management and the response to changing market conditions.