Every group pension pipeline I have inherited or built in the last decade has had the same weakness in the same place: the employer interface. Not the participant onboarding flow, not the fund allocation engine, not the tax reporting layer. The point where an HR system hands off a monthly contribution file and expects the pension provider to absorb it cleanly.
The industry treats this as a solved problem. It is not. It is a class of problems that individual-contribution architectures were never built to handle, and the failures are almost entirely predictable if you have owned both sides of the interface long enough.
The Assumption That Breaks Everything
Individual BES pipelines assume a participant is the source of truth. The participant decides when to contribute, how much, into which fund, and whether their status is active. Every downstream system — EGM submissions, fund purchases, state contribution eligibility, tax treatment — is anchored to that participant's declared state at the moment of contribution.
Corporate contributions invert this. The employer is the source of truth for the contribution event, but the pension provider remains the source of truth for the participant state. Those two truths drift constantly, and nobody owns the drift.
A concrete example: an employee resigns on the 22nd of the month. HR processes the exit on the 28th. Payroll had already cut the contribution file on the 25th, based on a snapshot from the 20th. The file arrives at the pension provider on the 1st of the following month. EGM submission windows close on the 5th. By the time reconciliation runs, you have a contribution posted to a participant whose corporate relationship ended before the payroll cycle even closed — but whose individual account is still open, still eligible for state contribution, and still allocated to a fund that may or may not accept the deposit under the sponsor's group agreement.
Which system is wrong? None of them. Each is internally consistent. The pipeline is wrong because it assumes these events are serializable. They are not.
The Four Failure Modes Nobody Designs For
After enough incidents, the taxonomy becomes obvious:
-
Timing drift: Payroll cycle, contribution cutoff, EGM window, and fund valuation date are four different clocks. When they align, nothing goes wrong. When they don't — which is most months for any employer with more than a few hundred participants — every misalignment creates a reconciliation exception that has to be resolved manually or absorbed silently.
-
State drift: The employer's view of who is an active employee lags the pension provider's view of who is an active participant. Terminations, unpaid leave, transfers between group sponsors, and re-enrollments all create windows where the two systems disagree about whether a contribution is even valid.
-
Amount drift: Salary changes mid-cycle, retroactive adjustments, bonus contributions, and matching formulas that depend on YTD figures produce contribution amounts that do not match anything the pension side is expecting. The file balances internally on the employer's side and fails validation on ours.
-
Allocation drift: The participant may have changed fund allocation between the payroll snapshot and the contribution posting. The employer's file references the old allocation. The pension system honors the new one. Nobody told the employer. Next month's reconciliation report will show a discrepancy that took three days to trace and had no operational impact whatsoever — except that it did, because state contribution was calculated against the wrong fund basis.
Why Individual-Contribution Pipelines Can't Absorb This
An individual pipeline handles exceptions the way any transactional system does: reject, notify, retry. The participant sees a failure, corrects the input, resubmits. The feedback loop is tight and the responsible party is obvious.
Corporate pipelines have no such loop. The employer submits a batch. The pension provider processes what it can. Exceptions accumulate in a queue that nobody at the employer is looking at, because from their side the file was accepted. Meanwhile the pension operations team is manually resolving discrepancies against contract terms they may not have full visibility into, because the group agreement lives in one system and the contribution processor lives in another.
I have seen operations teams spend the better part of a week reconciling a single employer's monthly file, not because the file was malformed but because the file was internally correct and externally impossible.
What Actually Works
The fixes are not technically difficult. They are organizationally uncomfortable, which is why they rarely get built.
-
Treat the employer file as an event stream, not a batch. Every contribution line is a proposed event with its own lifecycle: proposed, validated against participant state, accepted, posted, reconciled. Losing the batch abstraction is what unlocks per-line error handling.
-
Snapshot participant state at file receipt, not at posting. The gap between those two moments is where most state drift lives. If you validate the file against the state that existed when the employer generated it, most "phantom terminations" disappear.
-
Publish exceptions back to the employer in a channel they actually read. A reconciliation report emailed to a shared HR mailbox is not a feedback loop. An API endpoint with structured exceptions, tied to a ticketing obligation in the group contract, is.
-
Model the four clocks explicitly. Payroll date, contribution effective date, EGM submission date, and fund valuation date should be first-class fields on every contribution record. Not derived, not implied. Explicit. Half the reconciliation logic I have ever written could have been deleted if these fields had been captured at ingestion.
-
Stop treating individual and group as the same pipeline with a flag. They are different products with different consistency guarantees. The sooner the architecture reflects that, the sooner the operations team stops firefighting.
The Real Cost
The cost of ignoring this is not the reconciliation labor, though that is significant. The cost is that state contribution errors accumulate silently, group contract terms drift from operational reality, and by the time an audit or a large employer exit forces a full reconciliation, the discrepancies span years.
Participant behavior is unpredictable but bounded. Employer integration is predictable and unbounded. The pipeline should be designed around the harder problem, not the more visible one.