Maintaining your connection to the pensions dashboards ecosystem

Connecting to the pensions dashboards ecosystem is a significant milestone for pension providers and schemes, but it is just the start of a journey. Once your organisation is connected, there is an ongoing set of responsibilities to maintain your connection.

This article explains what your organisation needs to do to remain connected to the ecosystem, meet your obligations and ensure a reliable user experience for dashboard users.

What you need to do depends on whether you are:

• a pension provider or scheme connected via a third-party connection provider
• a directly connected organisation managing your own connection or managing the connections of other organisations

If you have connected via a third party

Most pension providers and schemes are connecting through a third-party connection provider, such as their administrator or an integrated service provider (ISP).

This means much of the day-to-day technical management will continue to be handled by the connection provider after connection, rather than by the pension provider or scheme itself.

However, pension providers and schemes still have duties after connecting to pensions dashboards, and are legally responsible for making sure they are carried out. For more information about these duties, providers and schemes should consult information provided by their relevant regulator.

Occupational pension schemes should see the pensions dashboards guidance from The Pensions Regulator (TPR), including checklists for before and after connection. Pension providers should see the pensions dashboards rules from the Financial Conduct Authority (FCA).

Keeping your data clean and up to date

Making sure member data is accurate, complete and up to date is the responsibility of the pension provider or scheme. This is central to dashboards working well for members, who rely on the quality of this data so they can be matched to their pension and be shown its value. Pension providers and schemes must build regular data quality checks into business-as-usual processes so issues can be identified and corrected early.

The scheme member data quality guidance from TPR and the FCA rules provide more information on what this means for you.

If you have connected directly

If your organisation has connected directly to the pensions dashboards ecosystem, you are responsible for managing your connection through the connection portal. Or, if you are an organisation like an integrated service provider (ISP), you may be managing the connections of other organisations.

Actions after connection include data management, handling transfers, maintaining security, and dealing with downtime. Let’s explore what this involves in practice.

Managing pension provider or scheme data

You must keep pension provider and scheme data accurate and up to date in the connection portal. Some changes can be made immediately, including updating your pension provider or scheme name, changing the view or PAT refresh endpoint associated with a holdername GUID, changing your find data model, or adding a new holdername GUID.

Other changes need review and approval before they are made. This includes requesting a change to your connection status (for example, to disconnect a pension provider or scheme) or correcting an incorrectly entered holdername GUID. These requests can take up to 5 working days, so it is worth planning ahead. Some changes can also be made in bulk using a CSV file upload. Read the full guidance on pension provider or scheme data management.

Managing account and organisation data

You also need to manage account and organisation data and keep user accounts in the connection portal up to date. This includes activating or deactivating user accounts, resetting accounts, resetting multifactor authentication (MFA), and resetting passwords.

It is worth checking who in your organisation has access to the portal from time to time, particularly when staff change roles or leave. The guidance sets out the different roles and responsibilities involved in managing user accounts. Additional guidance covers how to manage cryptographic materials.

Making technical changes to your connection

If you need to change the underlying technical solution behind your existing endpoints, or add new endpoints, you need to inform us through the technical change process. This applies to any change beyond a minimal one, and covers everything from minor software updates to significant changes such as migrating to a new cloud provider. Read the guidance on technical changes to understand what applies to your situation.

Handling transfers

When a pension provider or scheme changes connection provider, this needs to be reflected in the connection portal to ensure users can still see their pensions information on a dashboard. This covers the movement of a whole or part of a pension provider or scheme, not individual transfers. Read the separate guidance for ceding providers and acquiring providers.

Security: IT Health Checks and penetration testing

Maintaining a secure connection is an ongoing requirement. You need to submit a new IT Health Check (ITHC) or penetration test annually to demonstrate that your technical infrastructure remains secure. Make sure you understand the timescales involved and build this into your organisation's wider security testing schedule. Full details are available in the guidance on submitting a new ITHC or penetration test.

Planned and unplanned downtime

You must notify PDP at least 5 working days in advance of any planned downtime, and report any unplanned downtime or incidents as soon as possible, even if they are resolved quickly. Both should be submitted through the technical support portal, where you'll provide affected scheme details and updates until resolution. For full details, see the planned and unplanned downtime guidance, which also explains what to expect if downtime occurs on the Money and Pensions Service (MaPS) side.

Summary

Connecting to pensions dashboards is just the beginning. Whether you have connected directly or via a third party, there are ongoing responsibilities to maintain your connection, keep your data accurate, and ensure your systems remain secure.

Understanding where these responsibilities sit, and how they are shared with any third parties you work with, will help you stay compliant and support the smooth running of dashboards for members.

If you have technical questions around connecting and staying connected, take a look at our connection hub or get in touch with us directly via support.

For questions relating to legal responsibilities around post-connection duties, including staying connected, see the information provided by the relevant regulator – TPR or the FCA.