Welcome to your weekly update from the Allen & Overy Pensions team, covering all the latest legal and regulatory developments in the world of workplace pensions.
This week we cover the following topics: TPR report on Capita cyber security incident; DWP guidance on dashboard connection deferrals; Auto-enrolment: alternative quality requirements for workplace pension schemes; Auto-enrolment: annual review of trigger and thresholds.
TPR report on Capita cyber security incident
The Pensions Regulator (TPR) has published a regulatory intervention report into the cyber security incident that affected Capita in 2023, describing how it worked with Capita and with the schemes it administered. The report sets out lessons learned from the incident, including the complexity, time and resource required to identify exfiltrated data – TPR notes that trustees should not wait for these investigations to be resolved before contacting members, if there is a reasonable chance that their data is at risk. TPR also reminds trustees that they may continue to have responsibility for data stored by third parties such as previous administrators, even if those third parties are no longer involved with the scheme.
The report includes a list of key steps for trustees to take in the event of a cyber security incident, together with links to useful resources. TPR also reminds trustees about its updated guidance (link here) and its request that schemes should report significant cyber security incidents to TPR on a voluntary basis.
Read the regulatory intervention report.
DWP guidance on dashboard connection deferrals
The government has published guidance on deferred connection to pensions dashboards. There are limited circumstances in which trustees may apply to defer connection to the digital architecture by up to 12 months after the deadline of 31 October 2026. Broadly, these are that before 9 August 2023, the scheme had either embarked on a transfer of data to a new administrator or begun the process of retendering the administration of the scheme, where the timetable would conflict with the connection deadline. In addition, it would have to be shown that compliance with the deadline would be disproportionately burdensome or would put members’ personal data at risk. The latest possible date to make an application for deferral is 8 August 2024.
Read the guidance.
Auto-enrolment: alternative quality requirements for workplace pension schemes
The government has published the findings of its 2023 review of the alternative quality requirements for DB and hybrid schemes being used for auto-enrolment, including the quality test for collective DC schemes for the first time. No changes are proposed as a result of the review, but there will be a further consultation in connection with the expansion of auto-enrolment and the government will consider the scope for proportionate easements at that time.
Read the government response.
Auto-enrolment: annual review of trigger and thresholds
The earnings trigger, which is one of the criteria determining who is eligible to be auto-enrolled into a workplace pension, and the qualifying earnings band in respect of which contributions are made, are both reviewed annually to determine whether they remain appropriate. The latest annual review confirms that, for 2024/25 the earnings trigger will remain the same (£10,000). The qualifying earnings band will also remain static (being the band of earnings between £6,240 and £50,270), but the government intends to remove the lower earnings limit at the earliest opportunity, so that qualifying earnings start from the first £1 of pay.
Read the review.
