1. Executive Summary
In Australian Securities and Investments Commission v United Super Pty Ltd [2025] FCA 1453, O’Callaghan J imposed pecuniary penalties totalling $23.5 million on United Super Pty Ltd, the trustee of the Construction and Building Unions Superannuation Fund, commonly known as Cbus Super.
The proceeding concerned unreasonable delays in processing death, terminal illness and total and permanent disability claims between October 2022 and 12 November 2024. United Super admitted that it failed to do all things necessary to ensure that the financial services covered by its AFSL were provided efficiently, honestly and fairly, contrary to ss 912A(1)(a) and 912A(5A) of the Corporations Act 2001 (Cth). It also admitted two contraventions of the breach-reporting obligation in ss 912DAA(1) and 912DAA(7).
Approximately 7,402 claimants and beneficiaries did not have their claims processed within a reasonable timeframe. United Super agreed to provide approximately $32 million in compensation for premiums and fees that would otherwise have been avoided, the time value of delayed benefits and associated financial harm.
The Court found that United Super failed to:
- adequately monitor and manage the performance of its outsourced administrator, Australian Administration Services Pty Ltd;
- maintain accurate and complete data about the volume and age of claims;
- take all reasonable steps to ensure claims were processed within a reasonable period; and
- provide its committees with sufficient information and oversight to identify and address the delays promptly.
The case reinforces that outsourcing claims administration does not transfer the trustee’s statutory responsibility. An AFSL holder remains accountable for the accuracy of management information, the effectiveness of remediation measures and the performance of outsourced service providers. The Court stated that responsibility for outsourced elements of financial services remains with the licensee and is not delegable.
In addition to the penalty, United Super was ordered to:
- publish an adverse publicity notice;
- undertake an independently assessed compliance program;
- report on implementation of recommendations; and
- pay $500,000 towards ASIC’s costs.
2. Citation and Context
Case: Australian Securities and Investments Commission v United Super Pty Ltd
Neutral citation: [2025] FCA 1453
Court: Federal Court of Australia
Judge: O’Callaghan J
Date: 25 November 2025
File: VID 1226 of 2024
Hearing date: 13 November 2025
Procedural posture: Agreed facts and admissions, declarations, pecuniary penalties, compliance orders, adverse publicity and costs.
United Super was the trustee of the Construction and Building Unions Superannuation Fund. It had outsourced administration and related services to Australian Administration Services Pty Ltd under an administration agreement dated 23 December 2020.
ASIC commenced the proceeding on 12 November 2024. The parties subsequently filed a statement of agreed facts and admissions under s 191 of the Evidence Act 1995 (Cth) and jointly proposed the relief ultimately accepted by the Court.
3. Claims-Handling Failures
The claims concerned:
- death benefits;
- terminal illness benefits; and
- total and permanent disability benefits.
United Super was aware from at least November 2022 that its administrator was not meeting agreed service levels and that claim backlogs were causing substantial processing delays. Although United Super worked with the administrator on remedial measures, it knew those measures were not achieving the intended result.
By early 2023, the claims data disclosed serious and prolonged delays. As at 27 February 2023, the average processing time was:
- 400 days for death claims; and
- 315 days for TPD claims.
Between 27 March and 1 May 2023:
- between 438 and 479 death claims had been open for more than 360 days; and
- between 382 and 409 TPD claims had been open for more than 360 days.
The Court accepted that, apart from genuinely complex claims and delays attributable to claimants, the processing times were unreasonable.
4. Outsourcing and Governance Failures
United Super retained ultimate responsibility for the administration services performed by Australian Administration Services.
The admitted failures included:
Inadequate performance management
United Super did not adequately monitor and manage the administrator’s performance under the administration agreement, despite repeated failures to meet claims-processing service levels.
Incomplete and inaccurate data
United Super did not ensure that it held accurate and complete data necessary to determine:
- the total number of open claims;
- the age of each claim;
- the size of the backlog; and
- whether claims were being processed within a reasonable period.
Without reliable data, the trustee and its committees could not exercise effective oversight or assess the success of proposed remediation.
Ineffective remediation
United Super accepted a claims re-engineering plan proposed by the administrator. By January 2023, it was apparent that the plan was not adequately addressing the failures. United Super could have implemented a replacement plan, exercised contractual audit rights or appointed an independent expert, but did not do so in a timely way.
Insufficient board and committee oversight
Relevant committees did not receive all information necessary to determine whether claims were being processed within a reasonable period or to take prompt corrective action.
The risk committee eventually re-rated the “Insurance Offerings” material risk from medium to high in August 2023, after substantial delays had already persisted for many months.
5. Contraventions
| Act | Provision | Obligation | Conduct | Count | Finding |
|---|---|---|---|---|---|
| Corporations Act 2001 (Cth) | 912A(1)(a), 912A(5A) | Do all things necessary to ensure licensed financial services are provided efficiently, honestly and fairly | Failures in oversight, claims data, outsourced administration, remediation and governance | 1 course of conduct | Established |
| Corporations Act 2001 (Cth) | 912DAA(1), 912DAA(7) | Report a reportable situation to ASIC within 30 days after the licensee first has reasonable grounds to believe it has arisen | Failure to report after reasonable grounds arose on 1 February 2023 | 1 | Established |
| Corporations Act 2001 (Cth) | 912DAA(1), 912DAA(7) | Same | Failure to report after reasonable grounds arose on 20 June 2023 | 1 | Established |
The Court made declarations recording one contravention arising from the claims-handling course of conduct and two separate breach-reporting contraventions.
6. Efficiently, Honestly and Fairly
O’Callaghan J confirmed that s 912A(1)(a) requires competence, capability, ethical soundness and fairness in the provision of licensed financial services.
The obligation may overlap with other statutory obligations, but it operates independently. Conduct can contravene s 912A(1)(a) even where it is not dishonest in the criminal sense.
The Court also confirmed:
“Ultimate responsibility for elements of financial services which are outsourced remains with the licensee.”
The obligation is therefore not delegable: at [30].
Operational significance
A trustee cannot satisfy s 912A(1)(a) merely by:
- entering into a detailed outsourcing agreement;
- receiving periodic service reports;
- imposing contractual service levels; or
- requesting remediation plans.
The trustee must test whether the information is complete and accurate, assess whether remedial measures are working and escalate promptly when performance remains inadequate.
7. Breach Reporting
First breach-reporting contravention
At an executive risk committee meeting on 1 February 2023, United Super had information indicating that:
- significant numbers of claims were not being processed within a reasonable period;
- claim volumes and administration complaints had increased substantially;
- additional staff were required;
- the administrator had failed to meet service levels;
- backlogs had not been cleared; and
- incoming claims were not being processed within reasonable timeframes.
The Court accepted that United Super had reasonable grounds by that date to believe a reportable situation had arisen. A report was due by 3 March 2023, but United Super did not lodge it until 5 August 2023.
Second breach-reporting contravention
On 5 June 2023, the spouse of a deceased member contacted ABC Radio Melbourne and described a 15-month delay in processing a death benefit claim.
United Super’s resulting investigation identified systemic weaknesses, significant processing delays and numerous complaints. By 20 June 2023, United Super had reasonable grounds to believe that a further reportable situation had arisen. It was required to report by 20 July 2023 but did not do so until 5 August 2023.
Compliance significance
The statutory trigger is not certainty that a significant breach has occurred. The obligation arises when the licensee has reasonable grounds to believe that a reportable situation has arisen.
Risk committees and compliance teams should therefore assess whether:
- available data indicates systemic delay or control failure;
- a remediation program is not working;
- complaint trends corroborate operational failures; and
- separate developments constitute separate reportable situations.
8. Customer Harm and Remediation
Approximately 7,402 claimants and beneficiaries were affected by claims-processing delays and have been or were scheduled to be compensated.
The estimated compensation of approximately $32 million included:
- premiums;
- administration fees;
- asset-based fees that would otherwise have been avoided; and
- the time value of delayed claim payments.
The delays also caused consequential harm, including:
- inability to meet mortgage, rental and other financial commitments;
- inability to pay medical and living expenses;
- depletion of personal savings;
- borrowing from family and friends;
- mortgage redraws;
- reliance on social security or public donations;
- additional legal and administrative expenses; and
- emotional distress during periods of bereavement, injury and financial hardship.
United Super had remediated most affected claimants by the time of judgment and indicated that outstanding remediation would be completed by December 2025.
9. Pecuniary Penalties
The $23.5 million total penalty comprised:
| Contravention | Penalty |
|---|---|
| Section 912A(1)(a) claims-handling contravention | $11 million |
| First breach-reporting contravention | $5 million |
| Second breach-reporting contravention | $7.5 million |
| Total | $23.5 million |
The higher penalty for the second breach-reporting failure reflected the fact that United Super had further and more direct evidence of systemic problems after the June 2023 investigation.
Aggravating considerations
The Court considered:
- the two-year duration of the principal contravention;
- the number of affected claimants and beneficiaries;
- the severity and vulnerability of the circumstances;
- the substantial financial and emotional harm;
- the trustee’s awareness of poor administrator performance;
- ineffective remediation and escalation;
- repeated breach-reporting failures; and
- United Super’s position as trustee of a very large superannuation fund.
Mitigating considerations
The Court also considered:
- United Super’s admissions;
- cooperation with ASIC;
- corrective action and systems improvements;
- substantial remediation;
- the absence of material profit from the conduct; and
- the joint resolution of the proceeding.
10. Orders and Remedies
| Order or remedy | Legal basis | Amount or scope |
|---|---|---|
| Declaration — efficiently, honestly and fairly | Sections 912A(1)(a), 912A(5A) | Claims-handling failures from October 2022 to 12 November 2024 |
| Declarations — breach reporting | Sections 912DAA(1), 912DAA(7) | Two contraventions |
| Pecuniary penalty | Section 1317G | $23.5 million |
| Adverse publicity | Section 1101B | Public website notice for at least 90 days and member portal notice for at least 180 days |
| Compliance program | Section 1101B | Independent assessment by Grant Thornton and Ashurst Risk Advisory |
| Remediation assessment | Section 1101B | Review of whether an appropriate remediation program is in place |
| Implementation statement | Court order | Report to ASIC identifying recommendations implemented or not implemented |
| Costs | Court order | $500,000 |
11. Compliance Program
United Super was required to engage Grant Thornton and Ashurst Risk Advisory to assess whether it had:
- appropriate systems, policies and procedures to ensure death and TPD claims are processed within a reasonable time; and
- an appropriate remediation program for affected members, beneficiaries and deceased estates.
United Super must provide the resulting reports to ASIC and explain:
- which recommendations were implemented;
- which recommendations were not implemented; and
- why any recommendation was not implemented.
This requirement turns external assurance into an accountable implementation process rather than a one-off review exercise.
12. Governance and Compliance Significance
Trustees retain accountability for outsourced claims handling
Claims administration may be performed by an external provider, but the trustee must retain:
- reliable performance data;
- audit and access rights;
- escalation authority;
- contingency plans;
- effective committee oversight; and
- responsibility for customer outcomes.
Data quality is a legal control
Without complete and accurate claims data, a trustee cannot determine:
- whether delays are reasonable;
- whether service levels are being met;
- the scale of customer harm;
- whether a breach is reportable; or
- whether remediation is effective.
Remediation plans require effectiveness testing
The existence of a recovery or re-engineering plan does not establish compliance. Management must monitor whether the plan is clearing backlogs and improving processing times. Where it is not working, the trustee must intervene and adopt a different course.
Claims involving death and disability require heightened governance
Delays in death, terminal illness and disability claims expose members and beneficiaries to acute financial and emotional harm. Trustees should classify these processes as high-risk customer journeys requiring senior oversight and rapid escalation.
Breach-reporting decisions should be evidence-led
A breach-reporting assessment should not be deferred until the full cause or affected population is known. Management information indicating significant delays, recurring complaints and failed remediation may provide reasonable grounds to believe that a reportable situation has arisen.
13. Risk Management and Compliance Recommendations
| Audience | Control type | Legal rationale | Risk indicator | Practical control |
|---|---|---|---|---|
| Trustee board | Governance | Outsourcing does not remove trustee accountability | Persistent claims backlog | Board-approved claims risk appetite and escalation limits |
| Claims committee | Detective | Claims must be processed within a reasonable period | High aged-claim volumes | Weekly age-profile and exception reporting |
| Outsourcing management | Preventative | Trustee must monitor administrator performance | Repeated service-level failure | Contractual intervention, audit and step-in rights |
| Data governance | Preventative | Accurate data is required for oversight and breach assessment | Conflicting or incomplete claims reports | Trustee-controlled claims data repository and reconciliation |
| Risk committee | Governance | Failed remediation requires escalation | Backlog reduction plan misses milestones | Mandatory escalation and alternative recovery plan |
| Compliance | Detective | Reasonable grounds trigger breach reporting | Complaints, delays and failed controls indicate systemic issues | Time-bound breach assessment with documented reasoning |
| Internal audit | Detective | Provider reporting may be incomplete | Trustee relies solely on administrator data | Independent file and population testing |
| Remediation | Corrective | Delays cause financial and non-financial harm | Claim exceeds reasonable processing period | Automatic compensation and harm assessment |
| Member services | Preventative | Poor communication amplifies distress | Long intervals without claimant updates | Minimum communication frequency and case ownership |
| Executive management | Governance | Committees require sufficient information | Reporting omits age, complexity or cause | Standardised end-to-end claims dashboard |
14. Recommended Next Steps
Superannuation trustees should:
- establish a single, independently reconciled claims register;
- monitor claim age by type, complexity, administrator and stage;
- set escalation thresholds for claims approaching or exceeding reasonable timeframes;
- use contractual audit and intervention rights when service levels fail;
- ensure recovery plans have measurable milestones and replacement triggers;
- provide boards and committees with complete data on claims, complaints and customer harm;
- assess breach-reporting obligations as soon as reasonable grounds arise;
- review whether separate operational developments require separate breach reports;
- compensate members and beneficiaries for avoidable fees, delay and consequential loss; and
- independently validate that claims and remediation reforms operate effectively.
This analysis is suitable for internal legal and compliance review, but implementation decisions should be confirmed against the complete orders, agreed facts, outsourcing arrangements and current superannuation claims-handling requirements.