On 11 September, the Pensions Regulator (TPR) published a market oversight report on administrator relationships, the latest development in its increased recognition of the importance of the role of both in-house and third-party pension administrators in delivering good outcomes for members.

Background to the Report

Since 2019, the Pensions Regulator (TPR) has been increasingly proactively engaging with administrators in defined benefit, defined contribution and public sector pension schemes. In 2022, the Pensions Regulator (TPR) created an “administrator relationships” function, with a focused responsibility on direct engagement with third-party pension administrators on a voluntary basis. This allowed TPR to develop a better understanding of market challenges and administration risk. The initial focus was on five key areas:

  • Systems and processes
  • Data quality
  • Trustee focus, understanding and willingness to pay
  • Member engagement and communication
  • Pension dashboard readiness

However, since 2023 and with the increased number of schemes moving to third-party administrators via buy-out, the role of administrators has further evolved, and administrators are increasingly recognised as a vital player in the effective delivery of member benefits.

TPR launched a new phase of their voluntary engagement initiative in September 2024, and engaged with 15 pension administrators with the aim of deepening the understanding of risks and challenges faced by administrators and to identify potential areas for improvement.

The Report published by TPR on 11 September 2025 summarises TPR’s findings and shares key insights from the year-long engagement with administrators.

Four Key Themes

TPR’s engagement with administrators which ranged in size, ownership structures, service types (in-house and third-party) and market type (defined benefit and defined contribution), and engagement focused on four key themes:

1. Financial sustainability

    The Report indicates that TPR observed ongoing investment in operations, ownership structures, technology, and enhancements to business models throughout the market. Persistent challenges include attracting and retaining skilled employees, as well as continued underinvestment in administrative services.

    2. Technology and innovation

        TPR acknowledged that outdated legacy systems present significant challenges by hindering automation and increasing the risk of errors, while also noting the considerable financial and time commitments required for technological updates. The Report highlighted ongoing modernisation efforts and increased investment in technology and systems. Enhancing member engagement has become a key focus for administrators, who are adopting innovations such as mobile applications, biometric identification checks, and customised retirement journey planning.

        Data quality also remained a continuing concern, and TPR reiterated its importance in relation to pension dashboards, transfers between providers and for ongoing broader scheme operations. 

        3. Risk and change management

          The Report also noted that pension administrators face complex rules, evolving technology, and higher member expectations. Many firms are effectively managing risk through governance models like the 'three lines of defence' and tools such as live risk dashboards. Change management is increasingly proactive, with dedicated teams anticipating legal impacts, planning resources, and streamlining system updates.

          Ongoing regulatory developments, such as pensions dashboards and the abolition of the Lifetime Allowance, require quick responses and new skills. In response, some firms are establishing dedicated change management teams, pursuing additional funding, and engaging in closer collaboration with industry groups.

          4. Cyber resilience

            Cyber resilience continues to be a critical focus for trustees and administrators, particularly following several significant cyber-attacks. While TPR’s Report reflects notable progress, it also identifies key practices and areas where further development is required for administrators currently lacking these controls. Recommended measures include:

            • Integration of cyber risks into overall business risk planning with defined leadership accountability;
            • Adopting recognised standards such as ISO27001, Cyber Essentials, and the NIST framework;
            • Incorporating multi-factor authentication, strong password policies, and role-based (rather than blanket) access permissions;
            • Mandatory staff cyber training, ongoing phishing tests, vetting, and physical security assessments;
            • Incident response planning and documenting processes for lessons learned, preparation of member communications and ongoing focus on emerging threats;
            • Use of real-time threat detection systems;
            • Regularly testing business continuity plans, recovery strategies and real-life scenarios against industry standards; and
            • Ongoing supplier management.

            Conclusion and Next Steps

            This Report highlights the importance of robust governance and recognises the crucial contributions of administrators in facilitating members' access to the benefits that they are entitled to, and has been welcomed by the industry. Trustees require assurances, whether managing ongoing schemes or overseeing member transitions to insurers via buy-outs, that the schemes will be properly administered on an ongoing basis, thereby enabling trustees to fulfil their responsibilities effectively and with confidence.

            TPR has confirmed that it will continue to prioritise administration and will take a number of steps to do so, including:

            • The development of a new administration strategy;
            • Continuing direct engagement with a variety of administrators;
            • Setting expectations of trustees through updates to TPR’s existing administration guidance;
            • Promoting and supporting collaboration with the industry and between trustees and administrators; and
            • Providing feedback to the Department of Work and Pensions to help shape future legislation.

            Implications for Trustees and Advisers

            The key actions for Trustees at this stage focus on the reassessment of any administrator contracts and SLAs; a renewed prioritisation of data quality and cyber resilience; ongoing administrator engagement (including increased engagement as part of pension dashboards); and ensuring governance structures remain fit for purpose.

            If you would like to discuss any of the issues raised in this blog, please contact a member of the pensions team or your usual Brodies contact.

            Contributors

            Juliet Bayne

            Partner

            Ellie McWilliams

            Senior Solicitor