Benefits June 23, 2023

PSNC 2023: Are You inSUREd?

In the shadow of the recent data breach at a large third-party vendor, experts shared relevant tips for how plan sponsors can protect themselves if and when such attacks occur.

Reported by

In the unfortunate case of a participant’s retirement account data being breached, speakers on a panel at the PLANSPONSOR National Conference in Orlando, Florida, said it is critical that plan sponsors have the proper insurance and cybersecurity practices in place to avoid lawsuits and catastrophic results. 

Daniel Aronowitz, managing principal at Euclid Fiduciary, said at the “Are You inSUREd?” panel that plan sponsors need to have safeguards like multi-factor identification and regular information back-up in place, as well as setting up an indemnification with their recordkeeper in the case of a digital threat. 

Never miss a story — sign up for PLANSPONSOR newsletters to keep up on the latest retirement plan benefits news.

CalPERS Third-Party Cybersecurity Breach 

In related news, the California Public Employees’ Retirement System, which serves state employees in California and is the largest pension fund in the U.S., and the California State Teachers Retirement System, the public pension fund serving California teachers, were among the public and private sector institutions affected by a major breach. 

In statement, CalSTRS said, “On June 4, 2023, a CalSTRS vendor, PBI Research Services, advised us that its systems were involved in the recent mass exploit of a vulnerability in the MOVEit secure file transfer system. This incident did not involve unauthorized access to CalSTRS’ network. CalSTRS is working with PBI to identify the CalSTRS members whose information was involved in PBI’s incident. CalSTRS will provide notice to any members and beneficiaries whose personal information was involved in accordance with applicable law.” 

According to published reports, other affected organizations include Genworth Financial, a Virginia-based life insurance services provider, and Wilton Re, a New York-based insurance provider. In all, the security breach at PBI Research Services, which recently merged with The Berwyn Group, impacted the personal information of approximately 769,000 members, according to CalPERS’ Tuesday communication to its retired members and their families. 

PBI provides services to CalPERS to identify member deaths, and these services ensure that proper payments are made to retirees and beneficiaries and prevent instances of overpayments or other errors. The security incident did not impact information systems operated by CalPERS, according to the press release.  

Retirees and beneficiaries with impacted personal information are being contacted by mail with information on how to take additional steps to protect their information, and CalPERS offered free credit monitoring for two years.  

In addition, PBI notified CalPERS that retired member files were impacted as well. Some of those include inactive members who may soon become eligible for benefits.  

PBI has reported the incident to federal law enforcement and has told CalPERS it has “resolved the vulnerability,” while also adding additional security measures. According to a press release, CalPERS has added new protocols on its member benefits website, myCalPERS, as well as additional safeguards for those who use the member contact center and those who visit any CalPERS regional office. 

What Plan Sponsors Should Keep in Mind 

Aronowitz said plan sponsors need to make sure they have indemnification in place not only with their recordkeepers, but with every third party involved in their plan and anyone who handling money in retirement accounts.  

Indemnification clauses are promises by service providers stipulating that if they do something wrong which causes harm to the plan or causes a third party to sue the plan sponsor, the service provider will cover their legal costs. 

On top of that, Aronowitz said every plan sponsor, third party and plan adviser should make sure it has fiduciary insurance, as well as cyber insurance and crime insurance. 

Robert Massa, managing director and Houston operations retirement practice leader at Qualified Plan Advisers, said his firm sends an RFP specifically dedicated to cybersecurity practices to plan sponsor clients, with the intent it be sent to their recordkeepers.  

“Some of the big recordkeepers share data together about cyber hacks,” Massa said. “This is a place where they’ve all agreed that they’re all at risk, and it doesn’t benefit any one of them to allow the other one to get hacked. … I think that’s a great step in the right direction.” 

Massa added that the smaller the recordkeeper is, the higher the risk of a breach, because it is most likely more financially constrained and more likely to outsource cybersecurity to other service providers. Smaller recordkeepers also may not be able to afford as expensive an insurance policy as larger recordkeepers can. 

Even if a plan sponsor and their recordkeeper have “airtight” cybersecurity, Massa said it is important to educate employees on cyber-risk and “break it down to the human level.” 

If a participant’s personal email gets hacked, for example, Massa said there is the possibility that the breach could snowball. The plan sponsor may not be at fault in this situation, but Massa said it could result in a lawsuit against the plan anyway.  

Aronowitz predicted there will be more lawsuits filed over cybersecurity issues in the future. As one example, he cited a December 2022 lawsuit against Colgate in which a participant in the company’s defined contribution plan alleged breach of fiduciary duty claims against the plan recordkeeper and plan fiduciary committee, but not the bank custodian.  

Aronowitz said these cases typically come down to whether the plan sponsor breached its fiduciary duty by not properly monitoring its recordkeeper or choosing the best recordkeeper.  

Importance of Fiduciary Insurance 

“When I think of fiduciary insurance, it’s malpractice insurance,” Aronowitz said. “Doctors need malpractice insurance, lawyers need malpractice insurance [and] fiduciaries of retirement plans need malpractice insurance.” 

Aronowitz explained that fiduciary insurance protects the plan sponsor against claims it was negligent or committed “malpractice.”  

“Essentially, a breach of fiduciary duty claim is a claim that you messed up,” Aronowitz said.  

As many plan sponsors experience high premiums for insurance, Massa added that if plan sponsors have their fiduciary process in place and do the proper documentation and due diligence, they will likely see those premiums become more reasonable. 

“Insurance companies are asking a lot about how you do your business,” Massa said. “They want to know if you’ve been benchmarking, meeting regularly [and] your average fund expenses.” 

Administration June 23, 2023

Industry Concerns About Roth Catch-Ups Escalate

SECURE 2.0 Section 603 would require catch-up contributions made by those making more than $145,000 in wages to be made after-tax, and plan sponsors say it is probably going to be the hardest mandatory SECURE 2.0 provision to implement.

Reported by

Section 603 of SECURE 2.0, which would require catch-up contributions made by participants earning $145,000 or more to be made to a Roth source, has earned a reputation in the retirement industry for being a pain in the neck.

The provision is mandatory and becomes effective in 2024.

Get more!  Sign up for PLANSPONSOR newsletters.

The National Association of Government Defined Contribution Administrators has penned two public letters since March to the Department of the Treasury asking that government plans be given more time to comply with Section 603. NAGDCA argues that many government plans do not even have a Roth feature, and many will need state laws and/or union contracts to be updated in order to comply with Section 603.

NAGDCA announced Thursday that it will sign a draft letter written by the American Benefits Council, the trade association that advocates for employer-sponsored benefit plans. The letter, which has not yet been sent, is different from those sent by NAGDCA in recent months because it is addressed to congressional leaders and asks for a legislative fix, rather than a regulatory one. It begins by saying, “The undersigned organizations commend you for your leadership in enacting the SECURE 2.0 Act of 2022,” suggesting the ABC anticipates others signing on.

The ABC letter implores Congress to pass legislation postponing the implementation date of Section 603 by two years to 2026. It also requests that plans that require updates to state laws or collective bargaining agreements be given additional time to do so on top of the two years, if necessary.

Mark Iwry, a nonresident senior fellow at the Brookings Institution and former deputy assistant Treasury Secretary for national retirement and health policy, speaking Thursday at the PLANSPONSOR National Conference in Orlando, Florida, called the provision in question a “plan sponsor focal point.”

He and certain plan sponsors at the event cited vast implementation challenges caused by the provision that affect not only plan sponsors, but also recordkeepers, payroll service providers and plan administrators. Iwry said he was reasonably optimistic that the Treasury Department and IRS would agree to at least a one-year delay for the provision.

The ABC letter states bluntly that if Congress does nothing, many plans will simply have to cancel catch-up contributions entirely as a temporary compliance solution: “For many of these plans, unless this requirement is delayed very quickly (i.e., this summer), their only means of compliance will be to eliminate all catch-up contributions for 2024. If a delay is not announced until, for example, the fourth quarter, it will be too late to prevent this adverse result, since compliance systems need to be designed well before the effective date.”

«