D2A Is Gone: What Superannuation Funds Need to Know About APRA D2A decommission.
- Team Nuj
- 2 days ago
- 3 min read
On 19 March 2026, a routine penetration test identified security vulnerabilities in APRA's Direct to APRA (D2A) data submission system. APRA acted immediately, taking the system offline on 20 March. The decision was precautionary and consistent with APRA's low risk tolerance for system vulnerabilities, and APRA has confirmed there is no evidence of any security breach or exploitation of its systems. A formal public announcement followed on 27 March.
With D2A decommissioned, APRA Connect is now the sole platform for all regulatory data submissions. If you work in regulatory reporting in superannuation, this will have landed with a thud. APRA Connect itself is not new territory; superannuation funds have been working in it through the SDT collections for some time. What is new is the timing. The super industry's transition of remaining legacy D2A collections was anticipated to kick off in September 2026 and go live on 31 March 2027. That timeline is now highly likely to change. In other regulated industries where familiarity with APRA Connect is less established, the shift is even more abrupt.
APRA interim reporting arrangements: what to do now
APRA has put in place interim submission arrangements to maintain reporting continuity.
For any submissions currently due:
Prepare your files as you normally would ahead of your due date
XML or XBRL formats are preferred for APRA Connect-compatible submissions
APRA is setting up an ad hoc submission in APRA Connect for each entity to lodge their data
If you have not already received direct communication from APRA about the interim process, or have any questions, contact dataanalytics@apra.gov.au.
One further step: uninstall the D2A client from your systems immediately. APRA has advised that its continued presence could pose a residual risk to your data integrity and security.
Your APRA reporting obligations have not changed.
Submission deadlines, data requirements, and prudential standards remain in effect. While the submission channel changed, obligations and quality expectations are the same.
If your entity has not yet begun using APRA Connect, it is urgent that you act now. Do not wait for formal migration timelines. Contact APRA directly at dataanalytics@apra.gov.au and start assessing your internal data and workflow readiness in parallel.
For all regulated entities, the accelerated timeline underlines one thing: the quality of your lodgement is as important as timely submission. In our experience, funds that prepare upstream have less stress during peak lodgement periods. That means arriving on Connect with submissions that are:
Complete. All required data is present and verified before you get anywhere near the lodgement screen.
Correlated. Data is consistent across all related forms. APRA Connect reporting involves multiple forms with overlapping data points. Inconsistencies across those forms are a common source of validation failures and data queries. Catching them before lodgement, not after, is the difference between a clean submission and a stressful one.
Current. With a full picture of your data over time, you can see what your data is actually telling you. Anomalies surface. Trends become visible. You are not reporting blind.
This is Nuj's three Cs framework, and it sits at the core of how we help funds prepare their submissions. The goal is simple: by the time your data reaches APRA Connect, the heavy lifting is already done.
Our perspective about APRA D2A decommission.
Prudential reporting in Australia has always been dynamic. Timelines shift, collections are redesigned, and phases evolve. This does not surprise us, not because we predicted this event, but because planning for change is central to our approach. Our dedicated team monitors every phase of APRA's data transformation programme, so our clients never have to navigate it alone.
We have been immersed in APRA Connect since its early stages, across six years of SDT phases, taxonomy changes, and evolving submission requirements in superannuation regulatory reporting. When something like this happens, we are not starting from scratch. We are ready.
For superannuation funds: if your team needs support navigating the D2A shutdown and the period ahead while formal migration timelines are confirmed, please reach out. We are here to help.
Superannuation is our home ground, but APRA Connect and regulatory reporting challenges are not unique to super. If you work in another regulated industry and need support with upcoming changes, let’s connect.
Get in touch
Contact us if you need support team@nujsuper.com
Connect with us on LinkedIn to follow our work and stay up to date with practical guidance on APRA reporting requirements.
Find out more about how we work visit our website.
P.S. Spotted something in the news we should cover. Please let us know; we're always keen to hear what matters to you, email team@nujsuper.com
Comments