The risks keeping APRA's new deputy chair up at night

The Australian Prudential Regulation Authority's (APRA) new deputy chair David Bradbury said the risks that keep him awake at night are those with the potential to threaten the financial stability of the super system or cause catastrophic losses for members.

Giving his first address in the new role at the Financial Services Council (FSC) Retirement Summit, Bradbury said APRA is open to adjustments in current regulations that disincentivise investments by super funds in improving the safety of member savings.

"We should be prepared to consider whether any aspects of the current regulatory architecture disincentivise these important investments and I encourage you to let me know if you think there are areas where we do not currently have the settings right and where adjustments could be made," he said.

"Given the collective nature of these threats, resilience demands a collective or 'Team Australia' approach, within superannuation, across the financial system and among the service providers on which the system depends."

He noted cyber vulnerabilities, combined with increasingly sophisticated AI-enabled attacks, could create a pathway for criminals or a malicious foreign actor to reach directly into the retirement savings of ordinary Australians.

"In the worst case, someone who has spent a lifetime building up their super, could see those savings disappear in a matter of moments," he said.

"This would be a tragedy for the individual concerned, but it would also be particularly challenging for the system if it happened on a large scale, placing enormous pressure on existing compensation mechanisms."

He said awareness is no longer enough and institutions need to know their prevention, detection and response controls will work, and that they can manage a crisis and recover when threats move quickly through shared dependencies.

Bradbury added learnings should flow across the financial system.

"Banks, superannuation trustees and other regulated entities all have experience to share, whether in cyber defence, fraud, identity protection, operational recovery or the safe use of AI. We should be sharing not just warnings about emerging threats, but what has actually worked and what has not," he said.