DORA, market dynamics and what’s ahead

Regulatory requirements and compliance issues continue to drive the pensions market. Having reached the end of a three-year regulatory cycle since the introduction of the IORP II Directive in April 2021, the latest regulatory hurdle is the Digital Operations Resilience Act (DORA), for which the Pensions Authority has now published its guidance.

The Digital Operations Resilience Act (DORA)

DORA is an EU-wide set of regulations on digital operational resilience that will fully apply from 17 January 2025. It will affect all occupational pension schemes with 15 or more members. 

Schemes with 16-99 members will have reduced compliance requirements, while those with 100 or more members will need to meet all DORA requirements.

The main requirements for trustees, as set out in the Pensions Authority’s information note, will include:

• Documenting and maintaining a comprehensive information and communications technology (ICT) risk management framework, including ICT business continuity plans, and other policies and controls as part of the overall risk management system.

• Identifying all sources of ICT risk and cyber threats on a continuous basis, with ongoing monitoring of the security and functioning of relied-on ICT systems.

• Effective management of ICT third-party risks, ensuring that key contractual provisions with service providers are in place as set out in Article 30 of DORA.

• Maintaining a register of information on all contractual arrangements on the use of ICT services provided by third-party providers.

• Managing and reporting major ICT-related incidents to the Pensions Authority and keeping a record of significant cyber threats.

• Testing ICT systems supporting critical or important functions at least yearly.

For defined contribution schemes, you can outsource DORA compliance by moving to a Master Trust, as is done with IORP II compliance. However, for defined benefit schemes, DORA presents another set of regulations to comply with, adding another layer of complexity. 

Market dynamics

The increasing demands and complexities of scheme compliance continue to prompt many employers to reconsider their future pension strategy. They see the time and effort spent on IORP II compliance, along with the future commitments required to remain compliant in the evolving regulatory environment, as a distraction from more important issues. Compliance is taking up significant amounts of time for both trustees and employers. 

Defined contribution (DC) market trends

In the DC market, Master Trusts continue to grow, and a steady stream of employers is assessing the benefits of moving to a Master Trust structure. The continuing increase in legislative requirements, combined with the benefits being realised by employers who have moved to a Master Trust structure, are driving this trend. Common feedback is that it’s possible to meet the regulatory standards, though doing so takes significant time – with little additional value for members. Some of the key benefits for both employers and employees that are emerging following the transition to a Master Trust are:

• lower member costs

• greater focus on engagement

• better use of data as a means of driving strategy.

Defined benefit (DB) market trends

We’re seeing companies with multiple DB schemes – such as those with separate staff and management schemes and those that acquired schemes through their M&A activity – contemplate pension scheme consolidation as an immediate strategic step in their overall journey plan. Consolidation lets them streamline their efforts in governance, compliance, funding and risk management. 

Given the current regulatory environment, now may be the right time for employers to consider consolidation if they haven’t already.

The recent favourable economic conditions have left many DB schemes in strong funding positions. As a result, against the backdrop of increasing compliance and regulatory requirements, we’re seeing employers and trustees taking this opportunity to reduce their levels of risk being taken and to reassess their journey plans. 

While some companies are winding up their existing DB schemes, others are considering securing bulk annuities as a step towards a full exit. This has led to increased demand for bulk annuity transactions across the Irish market. While deferred annuities are still not available here, several bulk annuity providers are developing deferred annuity solutions, and we expect schemes will be able to transact by the first quarter of 2025.

Companies should also consider the accounting impact and treatment of any scheme transaction from a corporate reporting perspective. This treatment will vary based on the accounting standard the company adheres to, and the specific actions it is planning. Accounting results can be counterintuitive, so signalling this to stakeholders is an important step to consider.