Superannuation (prudential standard) determination No. 7 of 2012 - Prudential Standard SPS 521 - Conflicts of Interest

Relevant duty (paragraph 6(a)): any duty owed by the RSE licensee or a responsible person to beneficiaries or to any other person. This is deliberately broad, extending beyond the SIS Act duties to include contractual, fiduciary and statutory duties arising under other laws (for example, directors’ duties under the Corporations Act, or duties under trust law). The concept is not limited to duties to beneficiaries; duties to other parties (such as shareholders, members of a corporate group, creditors or counterparties) are also captured. This is because a conflict can arise between duties owed to different persons.

Relevant interest (paragraph 6(b)): any interest, gift, emolument or benefit, whether pecuniary or non-pecuniary, directly or indirectly held by the RSE licensee, an associate, or a responsible person, that the licensee determines to be relevant under paragraph 16. The inclusion of non-pecuniary interests (such as family relationships, personal friendships, professional affiliations or ideological alignments) makes the scope of this concept extremely wide. Indirect interests mean that a beneficial interest held through a trust or an entity in which the person controls votes could be captured. The determination of relevance turns on whether the interest “might reasonably be considered to have the potential to have a significant impact on the capacity” to act in beneficiaries’ best interests.

Conflict (paragraph 7): four types are identified. (a) conflict between duties owed to beneficiaries and duties owed to any other person; (b) conflict between interests of beneficiaries and duties owed to any other person; (c) conflict between an interest of the licensee, associate or responsible person or employee, and the licensee’s duties to beneficiaries; and (d) conflict between an interest of the licensee, associate, responsible person or employee, and the interests of beneficiaries. The first two types focus on duties, the latter two on interests. Importantly, the conflict can be between the interest of an employee (not just a responsible person) and beneficiaries. This means that ordinary staff with no decision-making authority can create a conflict if they have a side interest. The standard does not require that the conflict be actual; potential conflicts are also captured.

Conflicts management framework (paragraph 9): the “totality of systems, structures, policies, processes and controls” that identify, assess, mitigate, manage and monitor all conflicts. This is the overarching architecture. It must be appropriate to the size, business mix and complexity of the licensee’s operations (paragraph 14). The framework must provide “reasonable assurance” of identification and management (paragraph 15). The phrase “reasonable assurance” is a standard of confidence that is less than absolute certainty but more than a mere hope. It implies systematic controls, not ad hoc judgment.

Register of relevant duties and register of relevant interests (paragraphs 15(c) and (d)): these are living documents that must be kept up to date. They are not merely lists; they must be used as operational tools. The registers feed into the monitoring and review processes. Paragraph 18(f) requires the conflicts management policy to include processes for developing and maintaining these registers.

Operationally independent (paragraph 20): the triennial comprehensive review must be conducted by persons who are not involved in the day-to-day management of the conflicts framework. This does not necessarily require an external party; internal audit or a separate business unit with no line responsibility for the framework may qualify, provided they are appropriately trained and competent. However, the independence test is likely to be interpreted strictly by APRA, and many licensees will engage external consultancies or law firms for the review.

Responsible person (paragraph 6, footnote 2): this term is defined in the SIS Act and includes directors, executive officers, and any person who makes decisions that affect the whole or a substantial part of the business. The standard’s use of the term is consistent with that definition. The standard also extends some obligations (such as the duty to understand the conflicts framework) to all employees, not just responsible persons.

The concept of “relevant business units” (paragraph 17) requires the framework to be operationalised across the entire licensee, not just the compliance team. This means front-office, investment, legal, HR, procurement and any other unit must have processes and controls for monitoring compliance.

The primary addressees are RSE licensees - the entities that hold an Australian Prudential Regulation Authority (APRA) licence to operate a superannuation fund. As at mid-2024 there are approximately 120 RSE licensees, ranging from large multi-billion dollar public offer funds to small single-employer corporate funds. The compliance burden is not uniform: paragraph 14 permits proportionality - the framework must be “appropriate to the size, business mix and complexity” - but the minimum requirements (policy, registers, roles, reviews) apply to all. For a small corporate fund with few members and a simple investment strategy, the cost per member of building and maintaining a framework may be significantly higher than for a large fund that can spread fixed costs.

The board of each RSE licensee is directly responsible for approving the conflicts management framework and policy, and for ensuring that responsible persons and employees understand their obligations (paragraphs 8, 10, 11). This imposes on individual directors a non-delegable duty to oversee conflicts. Given the breadth of the framework, directors must satisfy themselves that the systems are adequate, which may require specialist training or external advice. The board must also approve appointment procedures requiring incoming responsible persons to disclose all relevant duties and interests (paragraph 12). This creates a procedural hurdle to recruitment.

Responsible persons (directors, executives, key decision-makers) are personally affected. They must disclose all relevant duties and interests prior to appointment and on an ongoing basis as circumstances change. They must understand the conflicts management framework and their obligations. Their personal interests (including non-pecuniary ones) must be entered into the register.

All employees of the RSE licensee are affected, even if they have no managerial role. Paragraph 11 requires the board to take steps to ensure that all employees understand the need to identify potential conflicts, the circumstances that might give rise to a conflict, and the content of the framework. Paragraph 18 lists controls applying to “all responsible persons and all employees”. Employees must comply with the conflicts management policy. Employees’ interests can give rise to conflicts under paragraph 7(d) (conflict between an employee’s interest and beneficiaries’ interests). For example, a call-centre employee who receives a commission from an external financial adviser for referring a member would have a relevant interest if it is determined to be significant enough. The standard forces the licensee to capture these interests.

Associates of the RSE licensee are brought into the net. “Associate” is defined broadly in the SIS Act and typically includes related bodies corporate, partners, and entities in a position to influence the licensee. Interests of associates are captured as relevant interests (paragraph 6(b)). Conflicts can arise between an associate’s interest and beneficiaries’ interests or duties (paragraph 7(c) and (d)). For licensees that are part of a financial group, this captures conflicts across the group - for example, an asset management arm that also manages the fund’s portfolio; or an in-house bank that provides treasury services. Paragraph 13 specifically addresses group policies and functions, requiring board approval.

Existing and prospective service providers and advisers are indirectly affected. Paragraph 19 requires the conflicts management policy to include processes for identifying conflicts arising from the licensee’s relationship with them. This means a service provider (such as an investment manager, custodian, administrator, or auditor) may be required to disclose its own conflicts to the licensee. The standard does not impose a direct obligation on the service provider, but the licensee must extract that information contractually or through due diligence.

Beneficiaries (fund members) are the ultimate intended beneficiaries of the standard, but their rights are not directly enforceable under SPS 220. They benefit from the priority rule being backed by process controls. However, they also bear the cost of compliance indirectly through higher fees or lower net returns, particularly in smaller funds where fixed compliance costs are concentrated.

Board duties. The board must approve the conflicts management framework (paragraph 8) and the conflicts management policy (paragraph 18). It is “ultimately responsible for the development and maintenance” of the framework (paragraph 10). It must take all reasonable steps to ensure that responsible persons and all employees understand the need to identify conflicts, the circumstances that give rise to them, the content of the framework, and their obligations (paragraph 11). It must have appointment procedures requiring incoming responsible persons to disclose all relevant duties and interests (paragraph 12). Where the licensee uses group policies, the board must approve that use and ensure appropriate regard to the licensee’s specific requirements (paragraph 13). The board must also consider the results of the annual review (paragraph 23) and presumably the triennial review. These duties are not delegable; the board as a whole must be satisfied.

Duty to have a conflicts management policy. The policy must be board-approved and must include controls and processes for: (a) identifying and monitoring all potential and actual conflicts; (b) avoiding conflicts where required; (c) managing conflicts in accordance with the priority rule; (d) taking appropriate action when a conflict arises, including ongoing evaluation and escalation; (e) recording conflicts in minutes; and (f) processes for developing and maintaining the registers (paragraph 18). Additionally, the policy must include processes for undertaking regular and thorough enquiry to identify conflicts arising from relationships with service providers and advisers (paragraph 19).

Duty to maintain registers. The licensee must keep an up-to-date register of relevant duties (paragraph 15(c)) and an up-to-date register of relevant interests (paragraph 15(d)). The process for determining whether a duty or interest is relevant must be documented (paragraph 16). The threshold for relevance is whether the duty or interest “might reasonably be considered to have the potential to have a significant impact on the capacity of the RSE licensee, the associate or responsible person … to act in a manner that is consistent with the best interests of beneficiaries.” This is a forward-looking, reasonable person test. The licensee must make a judgment, and that judgment must be defensible if challenged by APRA.

Duty to review. The licensee must ensure a comprehensive review of the conflicts management framework by operationally independent, appropriately trained and competent persons at least every three years (paragraph 20). The scope must have regard to size, business mix, complexity, changes to operations and external environment (paragraph 21). The review must consider whether all relevant duties and interests have been identified and addressed, the level of compliance, and any non-compliance including steps to improve (paragraph 22). Additionally, an annual review must be conducted and reported to the board (paragraph 23).

Duties of responsible persons and employees. They must understand the framework (paragraph 11). Responsible persons must disclose relevant duties and interests before appointment (paragraph 12). They must comply with the conflicts management policy. They must record conflicts in minutes (paragraph 18(e)). They must cooperate with reviews.

Rights. The standard creates no directly enforceable rights for beneficiaries. It is a regulatory standard, not a contract or statute conferring private rights. If a licensee breaches the standard, APRA can take enforcement action, but a beneficiary cannot sue for breach of the standard itself. Beneficiaries may, however, rely on the underlying SIS Act provisions (sections 52 and 52A) which are enforceable via civil penalty orders. The priority rule in section 52(2)(d) - that the licensee must perform its duties and exercise its powers in the best interests of beneficiaries and give priority to those duties and interests over any other duty or interest - is the substantive obligation; SPS 220 merely prescribes process for ensuring compliance with that obligation.

Rights of licensees. Licensnees have a limited right to seek adjustment or exclusion of a specific prudential requirement from APRA by notice in writing (paragraph 24). APRA has discretion to grant or refuse. There is no right of appeal under this standard, though judicial review of APRA’s decision may be available under the Administrative Decisions (Judicial Review) Act 1977 or the SIS Act.

SPS 220 is a prudential standard made under section 34C of the SIS Act. The prudential standard is a legislative instrument. Section 34D of the SIS Act provides that a licensee must comply with the prudential standards. Failure to comply may result in APRA taking enforcement action under the SIS Act, including: imposing additional licence conditions; issuing a direction to comply; accepting an enforceable undertaking; or applying to the Federal Court for a civil penalty order (section 197). Civil penalties for a body corporate can be up to 10,000 penalty units (currently about $3.13 million) per contravention, plus a daily penalty. Individuals (including directors and executives) can face penalties of up to 2,000 penalty units (about $626,000) and/or disqualification from being a responsible person.

The standard itself does not create any new penalty provisions. It is a “soft” instrument that sets process standards; enforcement is triggered by the underlying statutory obligation to comply with prudential standards. APRA has issued guidance that it will typically aim for remediation first, but persistent or serious non-compliance invites escalation. Factors APRA considers include the nature and materiality of the breach, the licensee’s response, and whether members suffered loss.

The triennial review and annual review are themselves mandatory. Failure to conduct a review (or to have it conducted by operationally independent persons) is a breach of the standard, regardless of whether the conflicts framework is otherwise sound. Similarly, failure to maintain an up-to-date register is a breach. The frequent use of subjective phrases such as “reasonably be considered”, “appropriate”, “reasonable steps”, and “adequate” gives APRA and the courts considerable interpretive latitude. A licensee that has a policy but does not follow it consistently may be found non-compliant.

The SIS Act also contains criminal offences for providing false or misleading information to APRA (section 130). Since registers and review reports are likely to be provided to APRA on request, a knowingly inaccurate entry could attract criminal liability.

Importantly, the standard does not prescribe a penalty for the licensee’s failure to ensure that employees or responsible persons comply. The obligation runs to the licensee; the employee’s own breach of the policy may be a matter of employment discipline, but the licensee bears the regulatory risk.

APRA has power to adjust or exclude a requirement in writing for a particular licensee (paragraph 24). This does not relieve the licensee from complying with all other requirements of the standard or the SIS Act. A licensee that obtains an adjustment must still comply with the adjusted obligation.

SPS 220 sits within a web of overlapping regulatory obligations. Its primary anchor is sections 52(2)(d) and 52A(2)(d) of the SIS Act, which impose the substantive duty to give priority to beneficiaries’ interests. The standard interprets and operationalises that duty. It does not replace it; compliance with the standard does not per se establish compliance with the underlying duty, though it is strong evidence.

The SIS Act also contains covenants that form part of the governing rules of the fund. These covenants include the obligation to perform duties in the best interests of beneficiaries. The standard buttresses those covenants by requiring documentation and review.

Corporations Act 2001: Directors and officers of corporate trustees (which most RSE licensees are) owe duties of care, diligence, and loyalty under sections 180-183. The obligations under SPS 220 to identify and manage conflicts overlap with the directors’ duty to avoid conflicts of interest under general law and the Corporations Act. However, SPS 220 goes further by requiring a systemic framework that covers employees and associates, not just directors and officers. Breach of the standard may also be evidence of a breach of directors’ duties (e.g., failure to properly oversee conflicts could be a breach of the duty of care). Conversely, compliance with the standard may help a director discharge the duty of care by showing that they took reasonable steps to put in place a conflicts management system.

Australian Financial Services Licence (AFSL) conditions: Many RSE licensees also hold an AFSL issued by ASIC. ASIC’s regulatory guides on conflicts of interest (e.g., RG 181) apply to AFSL holders. The AFSL obligations overlap with SPS 220 but differ in detail. For example, RG 181 focuses on licensing and disclosure, while SPS 220 focuses on governance and review. A licensee that complies with SPS 220 may still need to separately comply with ASIC guidance, though APRA and ASIC coordinate supervision for dual-regulated entities.

Australian Anti-Money Laundering and Counter-Terrorism Financing Act 2006: AML/CTF compliance programs may intersect with conflicts management, particularly regarding customer due diligence and suspicious matter reporting. Conflicts that involve a service provider’s potential to facilitate money laundering may need to be flagged through both regimes.

Privacy Act 1988: Registers of relevant duties and interests may contain personal information (e.g., an employee’s outside business interests). The licensee must ensure compliance with Australian Privacy Principles when collecting, storing and using that information. The standard requires disclosure of interests; licensees must get consent or have a lawful basis.

Group policies and group governance: Where the licensee is part of a corporate group, paragraph 13 requires board approval of group policies. This interacts with corporate law principles relating to director duties to the licensee as a separate entity. The board must not merely defer to group-level policies without considering the licensee’s specific needs. This can create tension in group governance arrangements, especially where the group has a centralised compliance function.

Trust law: The standard does not codify trust law. The duty to avoid conflicts is a fundamental principle of trust law, and the standard supplements it. However, trust law may impose a higher standard (e.g., the rule that a trustee must not profit from the trust). The standard does not excuse a breach of trust law; it only requires the licensee to manage the conflict. Beneficiaries retain their rights under trust law.

Financial Accountability Regime (FAR): For licensees that are also accountable entities under the FAR, the conflicts management framework will be part of the accountability map. The FAR imposes personal accountability on senior executives for the conduct of their business units; failures in conflicts management could lead to accountability breaches.

The source text states that SPS 220 commences on 1 July 2013 (paragraph 5). No amendment history is provided within the text itself. The standard was made under section 34C of the SIS Act. It has been in force for over a decade. APRA may have issued revised versions or amending standards since 2013, but those are not reflected in the source. Practitioners should consult the current version on the APRA website to confirm if any amendments have been made.

Commonly, APRA issues a new prudential standard with a date stamp. The numbering SPS 220 has remained consistent. There may have been minor technical amendments, such as changes to defined terms to align with other prudential standards (e.g., changes to the definition of “responsible person” or “associate” following amendments to the SIS Act). Additionally, APRA has issued guidance (e.g., SPG 220) which elaborates on APRA’s expectations but is not binding. The standard itself is a legislative instrument; amendments must be made by APRA and registered on the Federal Register of Legislation.

It is important to note that the standard’s requirements are static in the source text provided. If the user is relying on this version, they must verify that it is current. The fact that the text was provided without amendment history suggests the standard may be quoted as originally issued. For a full understanding, one should examine any replacement standards or variations.

The source text contains no references to litigation. No court decisions are cited. The standard has not been the subject of any reported judicial consideration as far as the text indicates. This is unsurprising; prudential standards are typically enforced via APRA’s administrative powers and civil penalty proceedings are brought under the SIS Act, not the standard itself. Cases that involve conflicts of interest in superannuation often cite the underlying SIS Act provisions (sections 52 and 52A) rather than SPS 220 specifically.

However, the standard’s interpretation could be relevant in litigation. For example, if a beneficiary sued the trustee for breach of duty, the licensee’s compliance or non-compliance with SPS 220 could be relevant evidence. A court might consider the standard as an industry standard of care. But that has not happened in a reported case.

The lack of litigation does not mean the standard is unenforceable. APRA has taken administrative action against licensees for governance failures, and conflicts management has been a feature of enforcement outcomes. But those are regulatory actions, not court judgments. The standard’s broad language and the discretion it gives to the licensee may make it difficult for a plaintiff to enforce directly. The phrase “reasonably be considered” and “all reasonably practicable actions” leave room for disagreement. That interpretive flexibility may deter litigation.

Potential future litigation could arise if APRA imposes a civil penalty and the licensee challenges the reasonableness of APRA’s interpretation. The court would then have to construe the standard. The lack of prior litigation means there is no authoritative guidance on key terms such as “significant impact” or “operationally independent”. This uncertainty increases compliance risk.

Broad scope of “relevant interest”. The definition includes non-pecuniary and indirect interests. A board member’s membership on a club board or a personal friendship with a service provider may need to be recorded if it could have a significant impact. The cost of checking every employee’s secondary sources of income or social connections is high. Over-inclusion is safer than under-inclusion, but it dilutes the usefulness of the register.

“All potential and actual conflicts” (paragraph 8) is an impossibly wide standard. The standard tempers it with “all reasonably practicable actions”, but the business judgment rule does not fully apply because APRA reviews the framework ex post. A licensee that fails to identify a conflict that a peer would have spotted may face enforcement, even if its process was reasonable.

Group policies must be approved by the board (paragraph 13). This is more than a rubber stamp. The board must ensure the group policy gives “appropriate regard” to the licensee’s specific requirements. If the group policy is generic, the board may need to supplement it. Failure to do so could leave the licensee without a tailored framework.

Triennial review must be “operationally independent” (paragraph 20). This means the reviewer cannot be part of the day-to-day management of the conflicts framework. Internal audit may qualify if it has no line responsibility. But if the licensee is small and has no internal audit function, the cost of hiring external reviewers recurs every three years. The review must also be of the framework, not just the policy. It must consider whether all relevant duties and interests have been identified (paragraph 22(a)). This is a scoping review that can be invasive.

Annual review must be reported to the board (paragraph 23). That requires preparation of a report, board discussion, and minutes. For a seven-member board meeting quarterly, this is a recurrent time cost.

Incoming responsible persons must disclose all relevant duties and interests prior to appointment (paragraph 12). This creates a recruitment delay: the candidate must fill out disclosure forms, the licensee must assess relevance, and only then can the candidate be appointed. In a tight labour market, this may deter candidates.

Service provider conflicts (paragraph 19): the licensee must have processes to identify conflicts arising from relationships with service providers. But the service provider is not bound by the standard. The licensee must extract conflict information contractually. If the service provider refuses or gives incomplete information, the licensee may be non-compliant through no fault of its own. The standard does not require the service provider to cooperate.

“Prudently managed” (paragraph 8): this phrase implies that merely documenting a conflict is not enough; the management must be prudent. If a conflict is not avoided, the licensee must justify why avoidance was impracticable and why the chosen management strategy is adequate. APRA may disagree.

Register maintenance (paragraphs 15(c), (d) and 18(f)): the registers must be “up-to-date”. A register that is not updated within a reasonable time after a new conflict emerges could be found to be out of date. The policy must include processes for maintaining them, but the standard does not prescribe a frequency. A quarterly update may be insufficient if conflicts arise daily.

Minutes must record conflicts (paragraph 18(e)): at board, board committee and other relevant meetings. This requires meeting chairs to specifically invite disclosure and to minute the details. Failure to do so is a breach of the policy, and thus of the framework.

No carve-out for immaterial matters: Unlike the Corporations Act’s materiality thresholds for related party transactions, the standard’s relevance test is based on “significant impact on capacity to act in best interests of beneficiaries”, not on financial materiality. A non-pecuniary interest that is trivial to the beneficiary but could influence a decision (e.g., a spouse’s employment at a fund lawyer) may be relevant.

An RSE licensee should approach compliance as a continuous process, not a one-off documentation exercise. The following steps, while not prescribed in the standard, are necessary to meet its requirements.

1. Board ownership and culture. The board must take ultimate responsibility (paragraph 10). This means the board should receive regular training on conflicts identification, the standard’s requirements, and APRA’s expectations. The board should approve a conflicts management policy and framework, and review them at least annually. The board should also approve the appointment procedures for responsible persons (paragraph 12) and ensure they are implemented.

2. Develop a conflicts management framework. This is the totality of systems, structures, policies, processes and controls (paragraph 9). It should be documented in a single overarching document or a suite of documents. The framework must be appropriate to the size, business mix and complexity of the licensee. For a small fund with simple investments, a shorter framework with simpler processes may be acceptable; for a large fund with multiple asset classes, complex fee arrangements and related parties, the framework must be detailed.

3. Conflicts management policy. The policy must be board-approved and must include the controls and processes listed in paragraph 18. It should also include the service provider conflict identification process (paragraph 19). The policy should be made available to all employees and incorporated into training.

4. Determination of relevance. The licensee must have a documented process (paragraph 16) for deciding which duties and interests are “relevant”. This process should set out the threshold of “significant impact on the capacity to act in the best interests of beneficiaries”. The process should also specify who makes the determination (e.g., a compliance committee, a conflicts officer) and how appeals or reassessments occur. The process should be applied consistently.

5. Registers of relevant duties and relevant interests. These must be maintained and updated. The policy should set out how and when updates occur (e.g., annual attestations, event-driven updates). The registers should be accessible to the board, the compliance team, and auditors. They should be used as a live tool: when a new duty or interest is registered, it should trigger a conflict assessment. The registers must be reviewed as part of the triennial and annual reviews.

6. Disclosure by responsible persons prior to appointment. Before a person becomes a director or senior executive, they must disclose all relevant duties and interests. The licensee should have a standard disclosure form and a process for assessing the information. The board should be informed of any significant conflicts before the appointment is finalised.

7. Training and communication. The board must take all reasonable steps to ensure that responsible persons and all employees understand the need to identify conflicts, the circumstances giving rise to them, the content of the framework, and their obligations (paragraph 11). This requires induction training, periodic refresher training, and ongoing reminders. Training should cover how to identify potential conflicts, the process for raising them, and the consequences of non-compliance. The licensee should maintain records of training attendance.

8. Embedding in business units. Each relevant business unit (investment, legal, HR, procurement, etc.) must be made aware of the framework and have processes and controls for monitoring compliance (paragraph 17). This could involve assigning a compliance liaison in each unit, incorporating conflicts checks into standard operating procedures (e.g., before entering a contract), and providing unit-specific training.

9. Group policies. If the licensee is part of a corporate group and uses group policies, the board must formally approve that use (paragraph 13). The board must satisfy itself that the group policies give appropriate regard to the licensee’s specific requirements. This may involve a formal gap analysis and supplementary local policies. The board’s approval should be minuted.

10. Recording conflicts in minutes. At board, board committee and other relevant meetings, the minutes must record each conflict identified and the action taken to avoid or manage it (paragraph 18(e)). This requires a standing agenda item for conflict disclosures. The minutes should include enough detail to demonstrate that the conflict was properly assessed and dealt with.

11. Review cycle. The licensee must implement an annual review of the conflicts management framework, reported to the board (paragraph 23). The annual review is less intensive than the triennial review but should cover key performance indicators, any material changes, and any reported non-compliance. The triennial comprehensive review (paragraphs 20-22) must be conducted by operationally independent persons. The licensee should engage an independent reviewer well in advance. The reviewer’s report must consider the registers, compliance levels, and steps taken to address non-compliance. The board should receive the report, consider it, and take any necessary action.

12. Liaise with APRA. If the licensee believes a specific requirement is disproportionate or impractical, it can apply to APRA for an adjustment or exclusion (paragraph 24). The application should be made in writing and should state the reasons. APRA may impose conditions. Licensees should not assume that APRA will grant relief; they should plan for full compliance unless relief is obtained.

13. Document everything. The standard operates on the principle that if it is not documented, it did not happen. Boards should keep minutes of all approvals and decisions. Registers should be maintained in a secure format. Review reports should be kept for at least the relevant limitation period under the SIS Act. Documentation is the first thing APRA will inspect.

14. Continuous improvement. The conflicts environment changes as the licensee grows, enters new markets, or engages new service providers. The framework should be updated accordingly. The annual and triennial reviews are opportunities to improve, not just to check a box. Non-compliance identified in a review should trigger corrective action, which should be implemented and monitored.

15. Service provider oversight. Paragraph 19 requires the conflicts management policy to include processes for identifying conflicts arising from service provider relationships. Licensees should include conflicts disclosure clauses in service agreements, require annual conflict attestations from key providers, and perform due diligence before onboarding. The licensee should maintain a list of service providers and assess their potential conflicts (e.g., where a provider also provides services to competitors or is owned by a related party).

Costs are real. The standard does not require proportionality in the sense that a small fund can skip the framework; it only requires the framework to be appropriate to the size and complexity. But the minimum requirements (policy, registers, roles, reviews) are fixed. A small corporate fund with a few hundred members and no related parties will still need a board-approved policy, registers of duties and interests, a conflicts officer, an annual review and a triennial independent review. The cost per member may be high. Options such as sharing a conflicts framework with other unrelated funds (common in the public sector) may be possible but must be tailored to each licensee.

In short, compliance is a systems, not a substance, exercise. The standard does not tell the licensee what conflicts are acceptable; it only requires that they be identified and managed. That leaves the licensee with broad discretion but also with broad risk. The most prudent course is to over-identify and over-document, while acknowledging the cost.