Australia’s super funds suffered a coordinated cyber attack today. Does that mean the bad guys can make off with your super? No it doesn’t.
Your super fund doesn’t ever actually hold your money. A global custodian holds the money. The picture shows which global custodians are used by different super funds that were attacked today, and how much those custodians each hold in custody, in total.
When your super contributions flow into AusSuper, for instance, the money is never actually held by AusSuper. Instead, it goes to the global custodian that AusSuper employs, which is JPMorgan’s custodian business.
When AusSuper decides to buy or sell shares on your behalf, the shares are not held by AusSuper; instead, the title over the shares is held by JPMorgan’s custodian business — which is completely separated from everything else in the JPMorgan group.
Custody is a commodity business that is mostly about data processing and security, at huge scales. JPMorgan has $30 trillion USD under custody. The largest global custodian is Bank of NY with $52 trillion under custody. They only get 2-3 bps for their custodian services. But 3 bps of $52 trillion is is $15.6 billion per year, so a nice business.
You can imagine how seriously cyber security is taken by these custodians. People sometimes ask me whether they should split their super across more than one fund to mitigate the risk of one of these funds going under through embezzlement or cyber-attack. There is no need — the super funds never hold your money anyway. They manage the assets you are invested in, but they don’t have title over them. The global custodians do.
Copyright Sam Wylie 4 April 202