Breaking Down ERISA Section 404(c) to the Basics

This provision is designed to protect plan fiduciaries from participants’ poor investment choices, but the plan sponsor is still responsible for providing a range of investment options, among other requirements.

Although retirement plan participants have the freedom to make their own investment decisions, plan fiduciaries are still responsible for providing a wide range of diversified investment options for them to choose from.  

Fortunately, however, fiduciaries are protected by ERISA Section 404(c)—a provision that shields plan sponsors from employees’ poor investment choices. In order to obtain Section 404(c) protection, fiduciaries must adhere to a number of requirements, issued in 1992 and amended in 2010, as part of the Department of Labor’s efforts to improve disclosure to plan participants. 

For more stories like this, sign up for the PLANSPONSOR NEWSDash daily newsletter.

Before this provision was passed, it was unclear whether employers were liable for participants’ investment choices, says Michael Kreps, principal at Groom Law Group. 

“Absent 404(c), there’s this question of, ‘what if I give [participants] seven choices [of investment options] and an 80-year-old [invests] 100% into small-cap equities… is that my fault or theirs?’” Kreps says. 

After Congress passed the ERISA amendment, saying that employers are not liable for participants’ investment direction, the DOL clarified that the employer remains liable for selecting prudent investments, while participants are liable for choosing those investments. 

What are the Requirements Under 404(c)? 

To be 404(c) compliant, plan sponsors must first ensure that they are offering a broad range of investments, including at least three options, each of which is diversified and has materially different risk and return characteristics.  

Additionally, the plan sponsor must provide participants the ability to “transfer among investment options with a frequency appropriate for each investment’s market volatility” at least once in any three-month period, according to Fidelity Investments. Essentially, participants must be able to make changes to their investments at least quarterly. If a particular investment option is sufficiently volatile, more frequent opportunities to change investments may be required. 

“The whole point here is that participants are exercising discretion over their own account, and the employer is not liable for that,” Kreps says. “But if they don’t have [enough options], the [plan sponsor] doesn’t get that relief. Or if [the investments] have lockups, the [plan sponsor] doesn’t get that relief.” 

As per Section 404(c), plan sponsors are also responsible for delivering information to participants about the plan, its investment options and its operations before participants make investment decisions.  

If a participant requests additional information about the investment options, the sponsor must provide that information so that the participant can make informed investment decisions. An example of this type of information could be a description of the annual operating expenses for each investment option, which should be expressed as a percentage of average net assets in the investment. 

What About QDIAs? 

As many participants today do not actively make investment decisions and default into their plan’s qualified default investment alternative, Section 404(c) offers plan fiduciaries a measure of protection even if the participant does not provide any investment direction. 

In the Pension Protection Act of 2006, Congress created a safe harbor for plan sponsors using automatic enrollment in their plans, essentially treating a participant’s default into the QDIA as an investment direction. 

“The goal was, ‘let’s level the playing field,’” Kreps says. “You get this 404(c) protection, regardless of whether [the participant] is auto-enrolled or they make their own election.” 

Section 404(c) also provides protection for employee stock ownership plans, according to Fidelity. When employer stock is offered in the plan, there are additional requirements that fiduciaries need to meet in order to be protected by 404(c). For example, one of the requirements is that employer securities must be publicly traded on a generally recognized exchange with sufficient frequency and volume to enable prompt trades. Participants also must be provided with the same information as other shareholders.  

Understanding Compliance Status 

For plan sponsors who are unsure if they are complying with 404(c), Kreps says it is important for them to have conversations with their recordkeeper. 

Luckily, recordkeepers have automated a lot of this process to ensure that plan sponsors are following all the requirements. However, Kreps says employers should confirm with their providers that this automated process is working. 

“They should be talking to their recordkeeper or TPA to understand the process by which people are enrolled [and] the notices they get,” Kreps says. 

He adds that it is important for plan sponsors to ask their recordkeepers if they are providing an adequate number of investments on the platform, if they provide a diverse array of choice and if participants are receiving the right disclosures. 

Kreps finds there is often confusion, among sponsors, about the scope of relief that 404(c) provides. 

“I think sometimes 404(c) is thought [of] as complete relief for employers, like if you give people enough choice, then you’re off the hook,” Kreps says. “You’re responsible as a fiduciary for prudence—selecting and monitoring the investments that are available. What you get relief from is where the participant chooses among that. But putting [the investment options] on your platform to begin with is a fiduciary act.” 

J.P. Morgan Data Breach Exposes 451,000 Plan Participants’ Information

Participant names, addresses, Social Security numbers and bank information were exposed in a breach the bank learned of in February.

More than 451,000 plan participants at J.P. Morgan Chase were impacted by a data breach in which their personal information was exposed, according to a regulatory filing that the company made to the Office of the Maine Attorney General on Monday. 

The participant information that was exposed included participants’ names, addresses, Social Security numbers, payment and deduction amounts, as well as bank routing and account numbers if the participants had set up direct deposit. 

For more stories like this, sign up for the PLANSPONSOR NEWSDash daily newsletter.

The breach was not part of a cyberattack and there is no indication of data misuse, a J.P. Morgan spokesperson told PLANSPONSOR. A notice of the data breach that J.P. Morgan submitted to the Maine Attorney General revealed that on February 26, J.P. Morgan learned of a software issue that caused certain reports run by three authorized system users to include plan participant information that they were not entitled to see. 

The three users were employed by J.P. Morgan customers or their agents, according to the notice. 

The system users ran a limited number of reports between August 26, 2021, and February 23, 2024. 

Lynne Atchison, executive director of benefit payment services, wrote in the disclosure notice to the Maine AG that J.P. Morgan “promptly addressed the access and applied a software update” once they were aware of the issue.  

The bank is offering individuals affected by the breach two years of identity theft protection services through Experian’s IdentityWorks platform. J.P. Morgan is also making its call center available to address participant questions.  

“Safeguarding client information is a priority,” a spokesperson said. 

In 2023, a cyberattack on data transfer software firm MOVEit, which is owned by Progress Software Corp., ended up revealing the private data of nearly 95,000 people across more than 2,500 firms, according to anti-malware company Emsisoft. The breach included retirement plan participants exposed via services vendor Pension Benefit Information LLC; firms hit included Fidelity Investments, TIAA and the California Public Employees’ Retirement System, among others. 

Later in 2023, there was a separate breach of Infosys McCamish Systems LLC, a U.S. subsidiary of Infosys BPM Ltd., based in Bangalore, India, that shut down access for a number of nonqualified compensation benefit accounts held with firms including Ascensus’ Newport, T. Rowe Price and Vanguard. 

In both incidents, impacted firms responded by providing identity theft protection to customers affected by the breach as hackers can sometimes use or sell the data to try and defraud consumers. 

«