D2A decommissioned: What Superannuation Funds Need to Know About APRA D2A decommission.
- Team Nuj
- Mar 30
- 5 min read
Updated: Apr 23
Updated 11 April 2026, this article has been updated to reflect developments since initial publication |
On 19 March 2026, a routine penetration test identified security vulnerabilities in APRA's Direct to APRA (D2A) data submission system. APRA acted immediately, taking the system offline on 20 March. The decision was precautionary and consistent with APRA's low risk tolerance for system vulnerabilities, and APRA has confirmed there is no evidence of any security breach or exploitation of its systems. A formal public announcement followed on 27 March.
With D2A decommissioned, APRA Connect is now the sole platform for all regulatory data submissions. If you work in regulatory reporting in superannuation, this will have landed with a thud. APRA Connect itself is not new territory; superannuation funds have been working in it through the SDT collections for some time. What is new is the timing. The super industry's transition of remaining legacy D2A collections was anticipated to kick off in September 2026 and go live on 31 March 2027. That timeline is now highly likely to change. In other regulated industries where familiarity with APRA Connect is less established, the shift is even more abrupt.
APRA interim reporting arrangements: what to do now
APRA has put in place interim submission arrangements to maintain reporting continuity.
For any submissions currently due:
Prepare your files as you normally would ahead of your due date
XML or XBRL formats are preferred for APRA Connect-compatible submissions
APRA is setting up an ad hoc submission in APRA Connect for each entity to lodge their data
If you have not already received direct communication from APRA about the interim process, or have any questions, contact dataanalytics@apra.gov.au.
One further step: uninstall the D2A client from your systems immediately. APRA has advised that its continued presence could pose a residual risk to your data integrity and security.
Your APRA reporting obligations have not changed.
Submission deadlines, data requirements, and prudential standards remain in effect. While the submission channel changed, obligations and quality expectations are the same.
If your entity has not yet begun using APRA Connect, it is urgent that you act now. Do not wait for formal migration timelines. Contact APRA directly at dataanalytics@apra.gov.au and start assessing your internal data and workflow readiness in parallel.
For all regulated entities, the accelerated timeline underlines one thing: the quality of your lodgement is as important as timely submission. In our experience, funds that prepare upstream have less stress during peak lodgement periods. That means arriving on Connect with submissions that are:
Complete. All required data is present and verified before you get anywhere near the lodgement screen.
Correlated. Data is consistent across all related forms. APRA Connect reporting involves multiple forms with overlapping data points. Inconsistencies across those forms are a common source of validation failures and data queries. Catching them before lodgement, not after, is the difference between a clean submission and a stressful one.
Current. With a full picture of your data over time, you can see what your data is actually telling you. Anomalies surface. Trends become visible. You are not reporting blind.
This is Nuj's three Cs framework, and it sits at the core of how we help funds prepare their submissions. The goal is simple: by the time your data reaches APRA Connect, the heavy lifting is already done.
Our perspective about APRA D2A decommission.
Prudential reporting in Australia has always been dynamic. Timelines shift, collections are redesigned, and phases evolve. This does not surprise us, not because we predicted this event, but because planning for change is central to our approach. Our dedicated team monitors every phase of APRA's data transformation programme, so our clients never have to navigate it alone.
We have been immersed in APRA Connect since its early stages, across six years of SDT phases, taxonomy changes, and evolving submission requirements in superannuation regulatory reporting. When something like this happens, we are not starting from scratch. We are ready.
For superannuation funds: if your team needs support navigating the D2A shutdown and the period ahead while formal migration timelines are confirmed, please reach out. We are here to help.
Superannuation is our home ground, but APRA Connect and regulatory reporting challenges are not unique to super. If you work in another regulated industry and need support with upcoming changes, let’s connect.
Update - 11 Apr 2026
Since we published this article, the fuller picture of what the D2A decommission means for funds has become clearer.
Lodgement is largely sorted. Most funds have worked through the interim APRA Connect arrangements, and submissions are moving. But a second problem has come into focus that the interim arrangements don't address.
D2A validated your data before it was submitted to APRA. That check doesn't exist in the interim arrangements. Until the legacy D2A form collections are formally migrated onto APRA Connect, every fund submitting through the interim arrangements is doing so without that safety net. The first sign of a problem won't come before submission. It will come when APRA responds with a data query or a resubmission request.
We've updated the Nuj platform to close that gap, with a structured workflow available now, validation ahead of June 26 reporting, and full coverage as APRA's programme evolves. We've been working with APRA Connect since its early stages, through every SDT phase and submission requirement. When D2A went down, we had a plan within days. That's not a coincidence, it's how we work.
Update - 23 Apr 2026
This morning, APRA hosted an industry session on the D2A decommission. With over 600 participants, the turnout speaks to the scale of impact this transition is having across the industry. APRA confirmed a forensic review found no evidence of breach or exploitation, and that D2A will not be used for data collection going forward.
The most significant news from the session is that APRA is proposing to accelerate the migration of D2A forms to APRA Connect. The proposed timeline brings the first full reporting period on APRA Connect forward from end-March 2027 to end-December 2026, with forms available for external testing from September 2026. That is an abridged testing window, and funds should plan accordingly. APRA has noted that the substance of the collections is not changing, and that entities not ready to transition by December 2026 will have flexibility to continue with the manual interim process for a period.
APRA is actively seeking industry feedback on whether this timeline is feasible and on the risks and trade-offs to be considered. If your fund has a view, now is the time to share it.
APRA also used the session to reinforce the most common submission errors it has observed ahead of June 26 reporting. These are worth reviewing as most are already covered in APRA's FAQ page, but the volume of errors suggests they are still catching funds out. In particular, using the wrong Excel template, incomplete returns where not all forms were submitted together, and missing ABN or entity name on submissions. APRA's Alternative Submission Arrangements page is being updated continuously and should be your first reference point:
When APRA confirms the revised migration timeline, we will respond quickly. Our clients will have clarity on what it means for their fund and how the Nuj platform will support them through it.
Get in touch
Contact us if you need support team@nujsuper.com
Connect with us on LinkedIn to follow our work and stay up to date with practical guidance on APRA reporting requirements.
Find out more about how we work visit our website.
P.S. Spotted something in the news we should cover. Please let us know; we're always keen to hear what matters to you, email team@nujsuper.com