Pension funds face new governance test as AI, cyber threats reshape risk

Staff Writer

BULAWAYO — Pension fund trustees are being urged to overhaul the way they oversee retirement savings as artificial intelligence, cybercrime and faster-moving financial risks create new vulnerabilities for the industry.

The call was made at the Zimbabwe Association of Pension Funds (ZAPF) Principal Officers and Chairmen’s Convention, where industry executives warned that while trustees’ fiduciary responsibilities remain unchanged, the risks confronting pension funds are becoming more complex and difficult to detect.

Masawara Group Industrial and New Business Cluster chief executive Bothwell Nyajeka said trustees remained ultimately responsible for protecting members’ retirement benefits, regardless of how quickly the operating environment was changing.

“That mandate remains constant, regardless of whatever change is happening in the environment,” Nyajeka said.

“What has changed is speed. What has changed is the risks of the investment. What has changed is how we do things.”

He said trustees needed to become more questioning and forward-looking, including testing their funds against scenarios such as de-dollarisation instead of waiting for risks to materialise.

Nyajeka said artificial intelligence could assist boards in analysing management reports and identifying issues requiring further investigation, but should not replace the judgment and accountability of trustees.

Trustees, he said, should scrutinise the language used in board reports because seemingly routine descriptions could conceal serious governance or control failures.

An “internal control lapse”, for example, could potentially mask a fraud, requiring trustees to probe further rather than simply accept management explanations.

“AI can help you decide what to ask, but it doesn’t take away your responsibility to understand the game, because you’re going to be given wrong answers,” he said.

Nyajeka also called for greater agility in board oversight, arguing that pension fund boards should consider more frequent meetings and faster renewal of trustees.

He said waiting for quarterly meetings to address emerging risks could expose funds to avoidable losses.

“If you wait for a quarter, damage would have been done,” he said.

He also urged trustees who disagreed with board decisions to formally record their dissent, highlighting the potential for individual accountability where directors are later called upon to explain decisions.

The governance concerns were reinforced by Xarani managing director Agrippa Mugwagwa, who warned that pension funds were increasingly attractive targets for cybercriminals because of the combination of valuable member data and substantial financial assets.

“Your attack surface is much bigger than you think,” Mugwagwa said, pointing to the network of members, administrators, custodians and employers connected to pension funds.

“You are as strong as your weakest link.”

Mugwagwa said the growing sophistication of artificial intelligence was also enabling criminals to make fraud attempts more convincing.

He cited deepfake scams in which cloned voices and videos of senior executives can be used to impersonate authorised officials and facilitate fraudulent payments. In one case he cited, a fake video meeting was allegedly used to facilitate a US$20 million transfer.

His advice to fund officials was straightforward: verify payment instructions through an independent channel.

“Always verify. Pick up the phone and call back,” he said.

Mugwagwa urged pension funds to develop formal AI governance frameworks covering the period before, during and after deployment of AI systems.

He said funds should consider the requirements of Zimbabwe’s data protection and cybersecurity laws, as well as the country’s National AI Strategy, when adopting new technologies.

The objective, he said, should not be to prevent pension funds from using AI, but to ensure that its deployment is properly governed and risks are understood.

Funds were also urged to examine the cyber and AI exposure of third-party service providers and assess whether existing risk-management documents adequately cover emerging technologies.

At the same time, Mugwagwa said digitalisation could provide opportunities to reduce operating costs and improve service delivery, including through digital member onboarding and identity verification using primary data sources.

The discussions point to a changing governance environment for Zimbabwe’s pension industry, where trustees are increasingly required to balance technology-driven efficiencies against new forms of operational, cyber and investment risk.

For pension funds, the challenge is therefore no longer simply whether to adopt new technology, but whether governance structures can keep pace with the risks and opportunities created by it.