Updating super fund service provider agreements for CPS 230

CPS 230 takes effect on 1 July 2025, but not necessarily for existing agreements with material service providers. Certain provisions concerning business continuity arrangements for super funds with less than $30 billion in funds under management also have a deferred commencement date.

CPS 230 will ultimately replace SPS 231, which is APRA’s current set of prudential standards that have applied to material outsourcing arrangements since 2013. All new agreements with material service providers will indeed have to comply with CPS 230 from 1 July 2025. However, for material service provider agreements that are already on foot on 30 June 2025, super funds will have until the next renewal or 1 July 2026 (whichever happens first) to bring them into compliance with CPS 230.

It is true that there are numerous aspects of CPS 230 which go much further than predecessor prudential standards. CPS 230 has seen risk teams invest considerable effort in mapping their fund’s critical operations, understanding dependencies, defining the limits of their tolerances for outages and the minimum service levels that could be maintained even during a disruption.

However, it is often overlooked that there are also areas where CPS 230 does not go much farther than predecessor prudential standards. This should be a source of comfort and perspective. The requirements for material service provider agreements are a good example.

For outsourcing agreements that were already compliant with SPS 231, the amendments required to bring those agreements into line with CPS 230 are limited in number. Broadly speaking, those agreements need to be amended by the next renewal or by 1 July 2026 (whichever happens first) to address the following issues if they are not already covered by the agreement:

• Allowing the trustee to terminate if the arrangement is no longer consistent with its duty to act in the best financial interests of members.

• Allowing the trustee to partially terminate the agreement.

• Addressing force majeure events by specifying which clauses would continue to apply in those situations. This is linked to the service provider’s business continuity arrangements (which are not specifically referred to in CPS 230), because adequate business continuity arrangements should mean a broader set of services can continue to be provided through a force majeure situation.

CPS 230 leaves scope to take a commercial approach to partial terminations. CPS 230 does not say that super funds must have complete flexibility to pick-and-choose particular clauses to terminate. CPS 230 does not mean that a super fund needs flexibility to terminate their obligation to pay fees while leaving their vendor obliged to continue providing services.

CPS 230 does not prohibit commercial parties from agreeing break-fees in the event of unexpected or early terminations.

Some types of agreements are naturally suited to partial terminations. Several examples follow.

In the investment manager context - If the manager is responsible for managing several portfolios, it is uncontroversial their appointment in respect of some portfolios may be terminated while their appointment continues for other portfolios. Most investment management agreements permit the trustee to remove assets from the manager’s portfolio at any time, which is a de facto partial termination.

In the custody context - It is not controversial for the trustee to have a right to terminate adjacent services provided by the custodian – such as currency trading and hedging or securities lending. Assets can be removed from the custodian’s custody, which is a de facto termination right. For many years, custody agreements have permitted the custodian to change the markets in which they provide services and a right for the trustee to do the same would be evolutionary not revolutionary.

In the IT context - If there is a master service agreement in place that covers numerous statements of work, an ability to terminate particular statements of work is effectively a partial termination right. Similarly, an ability to reduce the number of software licences or seats would be a de facto partial termination right.

Many assume CPS 230 is an uplift on SPS 231 in every respect. This can lead to a view that focussing solely on CPS 230 will be sufficient, even if the agreement is executed before 30 June 2025, based on the assumption that CPS 230 goes above and beyond SPS 231. However, there are some requirements which are specifically imposed by SPS 231 which are not specifically included in CPS 230. For example, SPS 231 specifically requires the inclusion of contractual provisions dealing with the following issues which are not specifically required by CPS 230:

• an indemnity by the service provider covering liabilities arising from their subcontractors (whereas CPS 230 requires the service provider to accept responsibility for their sub-contractors, without requiring this to be in the form of an indemnity)

• insurance

• reviews

• business continuity management

• the form in which data is kept

• confidentiality, privacy and security of information (noting funds now manage these issues under CPS 234).

The above kinds of provisions are not necessarily contentious and are often relatively straight forward inclusions. Nevertheless, it is important to ensure any new material service provider agreements executed before 1 July 2025 do comply with SPS 231 too and not just CPS 230.

A related question that can arise is whether new agreements (which will be executed before 1 July 2025) should also meet the requirements of CPS 230 from the outset or whether it is preferable to defer the CPS 230 compliance work. This is a judgment call. The duration of the agreement is a key consideration. If the agreement is expected to continue beyond 1 July 2026, it follows that the agreement will eventually need to be brought into compliance with CPS 230 (i.e. by 1 July 2026) in which case it will probably be more efficient to do that work at the outset. For short-term appointments that are expected to end before 1 July 2026, if there is resistance from the service provider, a commercial decision might be made to avoid the burden of negotiating partial termination rights and a right to terminate in members’ best financial interests, because the agreement will expire before those sorts of provisions would become mandatory.

We have seen some agreements that aim to hard-wire definitions and concepts from SPS 231 into the agreement so that those definitions and concepts continue to apply to the agreement after SPS 231 has been replaced by CPS 230.

There is no legal requirement for a material service provider agreement to continue complying with or referring to SPS 231 once 1 July 2025 has passed and compliance with CPS 230 has been achieved, generally speaking.

For super funds that have negotiated indemnities with their service providers covering sub-contractors (as required by SPS 231), it may be desirable to ensure indemnity remains in the agreement rather than adopting the non-indemnity alternative permitted by CPS 230. Similarly, because SPS 231 requires the outsourcing agreement to include provisions dealing with insurance and periodic reviews, a super fund may be well advised to cling to any historical provisions dealing with those topics that are particularly slanted in their favour – for example, benchmarking provisions.

There may also be historical provisions governing the appointment of sub-contractors, agents and delegates that are particularly advantageous to the super fund that are not specifically required by CPS 230. It is conceivable that a super trustee’s duty to act in the best financial interests of members may mean that some pre-CPS 230 clauses should continue applying post-CPS 230.

Subject to the above observations, most super funds will make a clean break from the historical requirements of SPS 231 once beyond 1 July 2025 and having achieved compliance with CPS 230.

The treatment of fourth parties under CPS 230 can be a source of considerable confusion. The focus on understanding fourth party risks from an operational risk perspective can lead to expansive contractual drafting and protracted negotiations. This can lead to stalemates and protracted negotiations. To clear these impasses, it can help to understand what is actually required by CPS 230 and what is not.

First, it is worth pointing out there are only two explicit references to ‘fourth parties’ in CPS 230. They both arise in connection with paragraph 48(c) of CPS 230. That paragraph requires a super fund to have a policy outlining its approach to managing risks concerning fourth parties that their material service providers rely upon to deliver critical operations. The second (and only other explicit reference) to fourth parties appears in the footnote to paragraph 48(c) which merely states that a fourth party is another party that a service provider relies upon.

CPS 230 mainly sees fourth party risks as an issue for trustees to deal with in their risk management processes and not necessarily as an issue having to be addressed in material service provider agreements. It is also worth noting that paragraph 48(c) is focused on fourth parties that a service provider relies upon to provide critical operations. Not every sub-contractor used by a material service provider is necessarily involved in delivering critical operations. It follows that super funds are not obliged to have policies for managing risks from every category of fourth party.

Even though there are only two explicit references to fourth parties in CPS 230, other parts of CPS 230 do refer to service providers of service providers.

There are only two explicit requirements under CPS 230 concerning fourth parties with which material service provider agreements must specifically comply, plus a possible third indirect requirement.

1. There must be a contractual provision that requires the main service provider to notify the super fund of any other material service provider it materially relies upon to service the super fund (noting that this merely requires notification, not trustee approval, and is subject to a qualitative materiality threshold): para 54(d).

2. There must be a contractual provision that requires the main service provider to accept responsibility for liability for sub-contractor failure (noting this need not be in the form of an indemnity): para 54(e).

3. While not a specific contractual requirement per se, since super funds are required by paragraph 59(b) to notify APRA before entering into a material offshoring arrangement, typically a super fund will understandably want to include a contractual provision requiring advance notification if any subcontractors commence operating in (new) offshore jurisdictions, together with adequate information to understand the offshoring risk.

There are no other specific contractual requirements for material service provider agreements with respect to fourth parties. Provisions dealing with issues beyond those listed above are a discretionary risk management choice for super funds, as part of their:

• Policies and processes for managing fourth party risks as required by paragraph 48(c) (and indirectly by general provisions like paragraphs 12 and 56) of CPS 230.

• Pre-appointment due diligence on service providers for the purposes of paragraph 53(b) of CPS 230, which must include assessing risks from their service provider’s service providers.

• CPS 234 compliance.

While it is true that prudent risk management may well require some risk-related information to be gathered in connection with fourth parties, it is equally true that CPS 230 leaves super funds with flexibility and discretion as to how, when and to what extent those risk management and due diligence exercises are carried out. It may be that this culminates in contractual provisions being proposed and included. It is valid context to bear in mind that such provisions would not be mandatory inclusions like the examples set out above. There is appropriate scope for common-sense balances to be struck.