Compliance August 9, 2023

IRS Plans Increased ESOP Enforcement

The tax agency intends to use outreach and expanded exams over the next year to address compliance by companies with employee stock ownership plans.   

Reported by

The IRS has expanded its focus on ensuring high-income taxpayers pay what they owe, warning businesses and tax professionals to be alert to a range of compliance issues that can be associated with employee stock ownership plans, the tax regulator announced this week.

Over the next year, the IRS will continue to use a range of compliance tools, including education, outreach and additional examinations, to address compliance by companies and individuals associated with ESOPs, according to the statement.  

Never miss a story — sign up for PLANSPONSOR newsletters to keep up on the latest retirement plan benefits news.

“This means spotting aggressive tax claims as they emerge and warning taxpayers,” IRS Commissioner Danny Werfel said in a statement. “Businesses and individual taxpayers should seek advice from an independent and trusted tax professional instead of promoters focused on marketing questionable transactions that could lead to bigger trouble.”

Werfel credits the IRS’ renewed enforcement to a bolstered budget at the agency, including funding for agency enforcement included in the Inflation Reduction Act. Prior to the bill’s passage, more than a decade of budget cuts had prevented the “IRS from keeping pace with the increasingly complicated set of tools that the wealthiest taxpayers may use to hide their income and evade paying their share,” he stated.

ESOPs are a type of defined contribution retirement plan that permits employees to own stock in their employer’s company. Any company that has stock can sponsor an ESOP for its employees, as long as the ESOP invests primarily in the securities of the employer, the IRS explained.  

ESOPs can be complex plan arrangements, because the stock ownership plan can borrow funds from the employer or a third party to purchase shares of that employer, the IRS stated.

“The IRS has seen promoted arrangements using ESOPs that are potentially abusive,” the agency announced.

For example, the IRS is concerned about arrangements in which a business creates a ‘management’ S corporation, the stock of which is wholly owned by an ESOP, for the sole purpose of diverting taxable business income to the ESOP.

“The S corporation purports to provide loans to the business owners in the amount of the business income to avoid taxation of that income,” the agency stated. “The IRS disagrees with how taxpayers interpret this transaction and emphasizes that these purported loans should be taxable income to the business owners. These transactions also impact whether the ESOP satisfies several tax law requirements, which could result in the management company losing its S corporation status.”

The IRS has identified “numerous” issues in its compliance efforts, including validation issues with employee stock; prohibited allocation of shares to disqualified personnel; and failure to follow tax law requirements for ESOP loans, resulting in prohibited transactions, the agency announced.

Compliance August 9, 2023

Compliance With SEC Cybersecurity Rules Will Require Resources, Training

The new disclosure requirements for public companies will not be easy to meet without added time and focus.

Reported by

New cybersecurity rules adopted by the Securities and Exchange Commission last month will require investments in additional training and resources, according to compliance experts who have studied the rules.

Under the new rules, public companies need to disclose significant cybersecurity events within four business days of their discovery and maintain policies and procedures to ensure compliance. The first step for businesses to meet these regulations will be determining if a digital risk is “significant” or not, according to Richard Cooper, the global head of financial services at Fusion Risk Management. To do that, he says, firms must first understand what their business is and what security breaches would be a concern.

For more stories like this, sign up for the PLANSPONSOR NEWSDash daily newsletter.

“This isn’t an IT problem; it’s a business problem,” he explains.

Different firms have different priorities, and a regulator such as the SEC does not have insight into the nuances of every business, Cooper notes. The word “significant” is ambiguous, but “it’s ambiguous for your own good,” because the alternative would be the SEC deciding how to run and protect individual businesses.

Cooper gives the example of a bank’s access to cash, loans or key information on their clients and the market being breached or compromised as a “significant event.” But leaks of internal training material, preliminary data or publicly available information probably would not be considered “significant.”

Cooper adds that, for all relevant companies, employee training will be essential. If one department is compromised, then the entire firm only has four days to report it. This means employees will need to be able to recognize an event and know how to report it and to whom. Cooper asks, “Are you confident they will tell you quickly enough?” Companies should therefore focus training efforts on all departments rather than just the IT and legal divisions, he says.

If there is a significant digital event, a firm can request two 30-day extensions, followed by a final 60-day extension, by appealing to the U.S. Attorney General’s office to determine that disclosing the event would compromise national security or public safety, according to the rule.

Helen Christakos, a partner in Allen & Overy LLP, says, “It’s going to be a challenge to get in touch with the AG in that short a window.” She adds that, “there will be something of an art to writing these disclosures” to ensure compliance with the SEC’s rule while not complicating investigations taking place at the state or local level, since those officials do not have the authority to request a postponement of the disclosure.

Speaking of state law enforcement, Christakos recommends that companies “make sure everyone is in the loop and comfortable with what is disclosed,” but that, ultimately, a firm must still comply with the SEC rule.

There is no additional postponement for a significant cybersecurity event after 120 days, according to the rule.

Michael Borgia, a partner in Davis Wright Tremaine LLP, quips that, “after 120 days, it no longer matters what the AG thinks about national security; you have to disclose it.”

 

«