Federal Court fines Mercer Super $10.3m over three years of unreported breach investigations

The Federal Court has fined the trustee of Australia's seventh largest superannuation fund $10.3 million for spending almost three years failing to tell the corporate regulator about investigations it was running into problems affecting its own members, including insurance premiums that kept being charged after members had died.

Justice Button made the orders on 26 June 2026 in Australian Securities and Investments Commission v Mercer Superannuation (Australia) Limited [2026] FCA 832. The trustee of the Mercer Super Trust must pay $4,062,500 for deficient compliance systems, contrary to sections 912A(1)(a) and 912A(5A) of the Corporations Act 2001; $5,300,000 for 15 contraventions of section 912DAA, the breach reporting provision; and $937,500 for three contraventions of section 1308(5), on materially false or misleading documents given to ASIC. It must also pay ASIC's costs of $1.2 million, all within 30 days. At 30 June 2025 the trust held about $79.8 billion for roughly 1,062,008 members.

The regime Mercer breached is a direct product of the Hayne royal commission. Since 1 October 2021, an investigation by a licensee into whether it has significantly breached a core obligation becomes itself a reportable situation once it has run for more than 30 days, and must be reported within a further 30 days, whether or not a breach is ultimately found.

Justice Button found that Mercer's governance, risk and compliance database, called Scout, had no field for recording when an investigation started, when day 31 fell, or when a report was due. Between May 2023 and June 2024, a period of about 13 months, the risk and compliance team stopped using its supplementary tracker and stopped holding weekly triage meetings, and the trustee operated on the incorrect belief that an investigation began only when a review panel first considered the incident. Deloitte, Mercer's external auditor, had raised concerns between March 2022 and April 2024 that incidents were sitting open for more than 30 days without being reported, and that Mercer's reporting volume was at the low end for comparable retail entities. Those warnings reached the audit and risk committee. The parties agreed that being on notice in this way was a significant aggravating factor.

Eight investigations were used as examples. Seven were never reported at all. They concerned a failure to update member accounts that left people on higher fees and worse insurance, a failure to provide death and disability cover to eligible members, premiums charged after death, and an incorrect investment fee in a product disclosure statement. Investor Daily and Super Review, on 29 June 2026, added that one investigation concerned $64 million of member money not allocated on time.

The eighth, incident INC-0011906, produced the false statement findings. A fault in Mercer's replacement employer gateway silently closed member registration requests where details matched an existing account, so employees missed their employer sub plan's lower fees and default insurance. The investigation began on 2 December 2022 and a report was due by 1 February 2023. Mercer lodged one on 21 April 2023, by which time the investigation had run at least 140 days. Asked in an October 2023 update whether clients were affected, Mercer answered "not known", although its own database had recorded 231 affected and remediated members since 12 May 2023. A May 2024 update said about 50 clients. A November 2024 report declared the investigation complete and put the figure at about 450, two weeks after the database recorded 12,357 registration requests reviewed, 122 requiring remediation and 5,709 invalid requests still under consideration.

ASIC accepted there was no deliberate attempt to mislead. Mercer told Investor Daily it acknowledged and apologised for falling short, said the agreed facts showed the shortcomings brought it no financial benefit, that no loss to members was alleged, and that the penalty would be paid by Mercer rather than by the fund or its members.

The statutory maximum for the 15 reporting contraventions was $234 million, and $47.5 million for the three false statement contraventions, figures Justice Button accepted were too high to be useful yardsticks. She treated each set as a single course of conduct, and noted that the total exceeded Mercer Superannuation's own 2025 calendar year profit of $3,960,000, so it would not read as a cost of doing business. She added that, absent an agreed figure, she may have been inclined to impose a somewhat higher penalty for the false statements. That test is arguable: the trustee's parent, Mercer (Australia) Pty Ltd, which supplied the staff and systems, made a profit of $106,058,000 in 2025, and the trust's operational risk reserve stood at $210.1 million.

The case sits in a run of superannuation enforcement. On 25 November 2025 the Federal Court fined United Super, trustee of Cbus, $23.5 million over delays affecting an estimated 7,402 death benefit and disability claimants, alongside about $32 million in remediation. On 30 April 2026 the Court found Telstra Super had missed the mandatory 45 day complaint deadline in about a third of relevant complaints; a penalty hearing is pending.

What is not yet known is how many members INC-0011906 finally affected. The fifth and final report to ASIC was lodged on 30 April 2025 and its contents are not set out in the judgment. Nor is it known whether Mercer's replacement compliance database, Frank, closes the tracking gap the Court identified. Accounts also diverge: Business News Australia reported 60 admitted contraventions on 29 June 2026, where the judgment records 15 and three.