actions that update the basicUserRegistry with {aes} encoded passwords

We have noticed that with a Liberty basicUserRegistry that passwords are automatically updated to {aes} encoded passwords at certain times. Firstly, when you add a new user from the Web UI or edit a user and click Save, it will update the JazzTeamServer\server\liberty\servers\clm\conf\basicUserRegistry.xml file. But it seems that it will also update when you change anything in the same Active User page and hit Save. For example, repository access permission or CAL license or email address etc.

But we noticed that the whole file was suddenly updated the other day, not just individual user passwords. Does someone know when that can happen? We installed report builder and DCC and ran /jts/setup to register the applications but we don't know of anything else that might have caused that. Would that have caused it? I tried running the setup wizard again as a test and it didn't seem to precipitate a change.

We have policies to keep the passwords in clear text similar to in the past with Tomcat, which is why this is a little problematic. Could someone tell us what actions cause the basicUserRegistry to be updated with {aes} encoded passwords?