Pensions Essentials - September 2025

The Pensions Act 2004 requires trustees to “establish and operate an effective system of governance including internal controls” which is “proportionate to the size, nature, scale and complexity of [their] activities”. The Pensions Regulator is required to issue a code of practice and regulations set out what that code of practice must cover. This includes the need for schemes with 100 members or more to carry out and document an Own Risk Assessment (ORA) which covers a variety of things, including how the trustees:

• integrate the ORA into scheme management and decision-making;
• assess the effectiveness of their risk-management systems;
• prevent conflicts, where key functions are outsourced to a party also used by the employer or to its employees; 
• assess the funding needs of the scheme;
• assess risks to members, taking into account, where applicable, indexation and benefit reduction mechanisms; and
• assess new or emerging ESG risks.

More detail about the Pensions Regulator’s expectations in relation to ORAs, including the documentation required, is set out in the General Code of Practice.

The first ORA must be completed within 12 months of the last day of the first scheme year beginning after 28 March 2024 (the date the General Code came into force) – so for a scheme with a year-end of 31 March, this would be before 31 March 2026. There are other possible deadlines in the regulations, but these are likely only to be relevant for new schemes in practice (although the wording is not very clear). 

This means that ORA deadlines are now coming up, so trustees need to consider what action they need to take. The documentation required is significant, which means compliance cannot be left to the last minute.

In November 2021, regulations came into force which set out additional conditions that trustees needed to ensure were satisfied before they could comply with a statutory transfer request from a member. The intention was to provide members with additional protection from scams. Prior to this, trustees had fairly limited grounds on which to refuse to make a statutory transfer.

In the absence of any statutory protection against scams, in February 2013 the Pensions Regulator issued guidance to trustees and providers about the dangers of pensions liberation and scams, and about the due diligence which could be undertaken to identify them, together with “scorpion leaflets” aimed at members. The Ombudsman has previously regarded the issue of this guidance as marking a change in industry good practice and the levels of due diligence expected from trustees.

Determination: A recent determination looks at the legal obligations of transferring trustees. A complaint was brought by a member in relation to a transfer of his benefits to a small self-administered scheme in 2014. The member was provided with the scorpion leaflet, confirmed he had read it and explained his reason for the transfer. Checks were also done to ensure the receiving scheme was registered. The member claimed that the transferring trustee should have done more due diligence and warned him that the receiving scheme could be a scam.

The Ombudsman said that on a transfer to another occupational pension scheme, transferring trustees must check that a receiving scheme was actually an occupational pension scheme and that it was registered with HMRC. They also needed to ensure that the member was in receipt of earnings from any source (although it was suggested that an upcoming determination might challenge the interpretation of this requirement). Where contracted-out benefits were being transferred, checks would also be needed to ensure that contracting-out requirements were complied with. The transfer in this case took place before both the introduction of the new transfer conditions in 2021 and the requirement (from 6 April 2015) to check that a member has received “appropriate independent advice” on a transfer from a DB scheme to a DC scheme in excess of £30,000. 

Having complied with these requirements, the question then was whether it was mandatory for transferring trustees to also conduct the due diligence set out in the scams guidance, and whether any failure to do so created a cause of action for the member. The Ombudsman determined that there was no legislative or regulatory obligation to follow the guidance and the due diligence checklist in it or to provide members with a copy of the scorpion leaflet. There was also no general, common law or equitable duty of care that required such due diligence to be carried out.

If the transferring trustees had voluntarily assumed the responsibility to investigate the receiving scheme and warn the member should anything untoward arise from that investigation, and had assured the member that this would happen, those trustees could be under a duty to take reasonable steps in so doing. However, merely attempting to implement the guidance behind the scenes would not be enough for these purposes.

The Ombudsman noted that there could be different obligations owed to, and therefore different complaint outcomes for, a member who had transferred from an occupational pension scheme compared to one who had transferred from a personal pension scheme, as a result of the different regulatory regimes that apply to each type of scheme. 

This is a helpful determination for trustees facing complaints from members in relation to pre-2021 transfers to scam or liberation vehicles. 

Scheme rescue: Administrators were appointed in relation to the sponsoring employer of the Edinburgh Woollen Mill Scheme in 2020. The employer and other group companies were subsequently sold to Purepay. The Regulator was contacted by the trustee’s covenant adviser in October 2020, who expressed concerns about a lack of information regarding the employer’s current financial position and the risk of insolvency . On investigation, the Regulator found significant dividends were paid by the employer to the parent company during 2020 and identified other concerns.

The scheme entered a PPF assessment period, but in 2021, Purepay proposed a scheme rescue. The Regulator, alongside the trustee and the PPF, entered into negotiations and it was agreed that Purepay would take over as the scheme’s statutory employer through a scheme apportionment arrangement and that it would pay £7 million to the scheme. A recovery plan was also agreed, along with a suite of covenant protections.

The Regulator cautions that sponsoring employers must keep trustees fully up to date with their financial position and prospects, particularly when they are facing financial distress.

Employer-related investment: The employer in relation to the Worthington Employee Pension Top Up Scheme entered administration in 2019 and was dissolved in January 2022. In December 2019, the Regulator received a report from the insolvency practitioner about suspected employer-related investments (ERI) involving most of the scheme’s assets. As well as investigating three trustees in relation to the ERI breaches, the Regulator also investigated a professional adviser, on the basis that he encouraged and assisted the trustees with the prohibited loans.

Breaching the ERI restrictions can attract criminal sanctions, and prosecutions were brought against two of the trustees and the professional adviser. One trustee was given a 10-month prison sentence, suspended for 12 months, and ordered to complete 150 hours of unpaid work and pay £1,000 in prosecution costs. Proceedings were dropped against the second trustee, and the professional adviser died before the case reached court. The third trustee was fined a total of £29,000.

The Regulator says that ERI restrictions are crucial in ensuring the security of scheme funds and protecting members’ interests and it is committed to taking swift and decisive action when they are breached. Employers, trustees and scheme advisers should be aware of and follow the ERI guidance.

Contribution notice: DFL was bought by CW and EW for £1 in 2008. Following concerns being reported to the Regulator by the scheme’s independent trustee, it concluded that between 2008 and 2019 money was extracted from DFL while its pension scheme was in deficit. The Regulator sought payments by way of contribution notices from CW and EW and two family members, PW and AP. CW and EW agreed to pay £2 million to the scheme and PW later also made a payment. AP appealed the imposition of a contribution notice on the basis she had not known what was going on, although she had been a director and knew that her shares in DFL’s parent company had been purchased with funds from DHL. 

The Upper Tribunal held that the sale of AP’s shares using sponsoring employer funds did detrimentally affect in a material way the likelihood of accrued scheme benefits being received. It was not reasonable for AP to have acted in the way that she did. She was a director of DFL and should not have allowed it to weaken its resources in the way it did without making sure that the interests of all stakeholders were protected. She did not ask any questions or take any advice with a view to discharging that responsibility.

The Upper Tribunal also said that it should have due regard to the amount of the contribution notice imposed by the Regulator but still had to reach its own conclusions as to what a reasonable amount would be. The Tribunal increased the amount of the contribution notice to reflect the whole of the proceeds AP received on her shares. However, it was then reduced to reflect amounts which she had paid to her children to satisfy an undertaking to her parents (when they gave her the shares) and tax which she had paid. 

It is also worth noting that unusually in this case, the employer continued to trade and, although the scheme was in significant deficit, it continued to pay out the benefits that were due. However, both the Regulator and the Upper Tribunal still considered that it was reasonable to impose contribution notices against former directors and shareholders.

The Pensions Regulator recognises pension administration as a critical driver of good outcomes for members. With increasing regulatory demands, technological transformation, and rising member expectations, the role of administrators is critical. Therefore, in September 2024, the Regulator launched a voluntary engagement initiative with 15 administrators, covering a range of sizes, ownership models and service types (including in-house teams) and both the DB and DC market.

The Regulator has now reported its insights and findings, which are divided into four key themes:

• Financial sustainability: After years of underinvestment, the market is seeing increased investment in technology upgrades, AI, and people, but more work is required. Recruiting and retaining staff remains difficult.
  
  As the market continues to evolve, administrators should assess their strategic position and align business models with future demand. Trustees should support this by recognising the strategic value of administration and encouraging investment in innovation and resilience.
• Technology and innovation: With increasing demands on them, pension administrators are modernising systems and rethinking service delivery. Efforts are underway to modernise and/or integrate systems like administration, payroll, and member portals. However, outdated systems remain a significant challenge, hindering automation, limiting scalability, and increasing the risk of errors.
  
  Trustees and administrators should focus on providing a high-quality member-centric experience, with good governance and transparent reporting. This focus needs to be embedded in administration contracts, which should be periodically reviewed to ensure they remain suitable. Consideration should be given to the service level agreements, to ensure they prioritise accuracy and member experience, not just focus on speed.
  
  Trustees and administrators should also plan the likely impact of the pensions dashboards on administration services and review whether current administration service, member engagement strategies and member interaction channels are likely to remain effective and be capable of handling significantly increased demand.
• Risk and change management: The report sets out some good examples of risk and change management practices which the Regulator says that others can learn from. It also says that they should be built into everyday operations.
• Cyber resilience: The report highlights examples of good cyber security practices but says that consistent industry-wide cyber security certification is lacking. There are also gaps in business continuity planning, with communication protocols and executive oversight sometimes missing or lacking supporting documentation, and these should be addressed.

The Regulator expects administrators and trustees to reflect on these findings and work together to identify ways to improve administrative practices to better serve members. Improving data should be a priority for all and administrators and trustees should prioritise investment in technology, systems and data.

In addition, the Regulator is developing a new administration strategy to further support the industry.

The alert says that a common theme has been identified in Action Fraud reports which relates to attempts to gain unauthorised access to members’ accounts. The methods identified include:

• Hacking members’ email accounts: obtaining access to correspondence between the member and the scheme and then impersonating the member to change details of the member’s bank account to access funds.
• Accessing members’ account information: setting up fake pension accounts in the member’s name and moving funds from the real account to the fake account.
• Deceased members’ funds: diverting funds to an alternative bank account without the next of kin’s knowledge. 

To combat these new types of fraud, the Regulator recommends educating members by telling them about the importance of online security and ensuring their pension account details are up to date. It is suggested that schemes should signpost members to the City of London Police Identity fraud guidance and the Stop! Think Fraud website. Trustees and administrators should also review the measures in place to prevent identity fraud, including member identity and verification checks.