Plan Participants Have Their Own Responsibilities for Cybersecurity

There are common and advanced approaches retirement plan participants can take to derail data breaches and retirement account fraud.

Plan sponsors are taking measures to battle cyberattacks on retirement plan participant data and accounts, but is there anything participants can do to protect them?

It’s already known that participants should be registering their retirement plan accounts online. If a participant has his account hacked, there is a higher probability of catching it when they are registered.

For more stories like this, sign up for the PLANSPONSOR NEWSDash daily newsletter.

“We sometimes hear people say, ‘My account is safe because I never registered for online access,’ said Charlie Nelson, CEO of Voya Retirement, during an interview with PLANSPONSOR in May. “That can be misguided. Fraudsters will sometimes try to get access to an unregistered account so they can set the original data points, such as a phone number or other piece of information.”

The first step towards securing personal assets and data is knowing where that information lies, says Ted Schmelzle, senior director of Retirement Solutions at Securian Financial. While data breaches can happen at any point, participants who take ownership in protecting themselves will be more observant of their assets, thus avoiding losses in the case of a hack.

“Participants are going to have to be aware of where their information is, and in particular, where there might be vulnerabilities because they’ve got assets held at a particular institution,” explains Schmelzle.

An approach participants are always urged to employ is creating a strong, complex password. Constructing these passwords are common sense, adds Schmelzle, along with updating anti-virus malware on personal computers to reflect current models and avoiding links from unknown users.

Additionally, participants should be aware of what material they’re adding to their social media accounts. Profile information, including the city in which a participant lives, a photo of the company they work for, or even political opinions, for example, can expose individuals to hackers. Schmelzle uses the term “cyber-hygiene,”—ensuring participants are enforcing these precautions to the best of their ability, for both financial and personal wellness.

“Make sure that you have a very intentional view of what you’re putting on social media, so that you don’t compromise the security of account balances or give fraudsters a view into things that might compromise your security,” Schmelzle says.

Possibly one of the top methods in preventing breaches, attacks and hacks is two-factor or multi-factor authentication. A stronger back-up to secure passwords, it allows participants to sign into their account in multiple steps, which may include inputting their password and approving it on another device (such as cellphones and tablets).

Although one of the most popular measures for protecting a participant’s data and information, the approach can prove inconvenient for some. A 2017 report by SecureAuth, an adaptive authentication firm, found 74% of respondents using two-factor authentication said they have received complaints about the process from their users. Employing several devices and steps to accessing information can be tricky or irritating for these consumers, but for most, the additional security it adds curtails the hassle.

“[Convenience] is a small price to pay for the additional security,” says Schmelzle. “We are likely going to have to sacrifice some convenience for security, but there are many times where folks are going to have to understand that additional hoops have to be jumped through, or additional protocol followed in order to protect the essence of the account, even though it seems inconvenient at the time.”

Schmelzle likens the role of participants in cybersecurity to that of driving a car. “It’s like being a good driver,” he says. “You can still get into an accident, but if you’re employing good driving techniques, chances are you won’t.”

DB Plan Cash Flow Needs Are Greater Than Ever

In these days of low interest rates, and following money market reform, investing strategies are needed to meet cash-flow needs from retiring Baby Boomers and pension risk transfer actions.

With Baby Boomers retiring every day, defined benefit (DB) plan sponsors have more cash needs now.

Jeff Whitehead, head of client investment solutions at Aegon, based in Cedar Rapids, Iowa, believes if a DB plan isn’t already experiencing negative cash flow, it’s headed that way.

Get more!  Sign up for PLANSPONSOR newsletters.

Peter Yi, director of short-duration fixed income and head of credit research at Northern Trust Asset Management (NTAM) in Chicago, says his firm is having conversations with DB plan sponsors about how they can be more thoughtful on optimizing cash holdings. “We are challenging our client to rethink cash and more effectively and efficiently use it. For the time being, DB plans are holding more liquidity and less risk assets,” he says.

Money market funds were at one time an effective cash preservation vehicle. NTAM believes the Securities and Exchange Commission (SEC) money market fund reforms requiring higher cash (or similarly liquid vehicle) ratios at daily and weekly intervals redefined “illiquid” securities, restricted lower quality securities in fund makeup and stricter maturity limits on fund components, resulting in their income levels becoming extremely modest.

In a paper, it says, “Investors are developing a sharper understanding of the tradeoffs among safety of principal, income and access to funds in managing liquidity. Many now recognize a single product solution may no longer be viable. The regulatory and ultra-low rate environment is forcing them to be more open-minded about the broader menu of investment options available in today’s liquidity investing marketplace.”

According to Whitehead, what most DB plan sponsors do is either raise money every quarter by selling assets from certain funds or maintain a short-term bond fund (duration of 2) and raise money from that.

He points out that DB plans don’t want to hold too much cash—if they are raising money once a quarter, they could have at least three months of cash on their balance sheet only earning 1.5% or 2%. He suggests combining cash and a short-term bond fund customized to the plan with inflows coming in and outflows going out—a portfolio that provides money as needed month after month. “With this strategy, DB plan sponsors are not selling assets at an inopportune time and investment committees don’t have to decide what to sell,” he says.

Cash flow-driven investing

According to Whitehead, cash flow-driven investing (CDI)—an investment approach focused on delivering a consistent, reliable stream of cash flow to meet the obligations of a DB plan—is growing in popularity. “If a plan has cash and a short-term bond fund, which most would, take those asset allocations and add some other fixed income allocation to create a special portfolio,” he suggests.

Whitehead explains that with CDI, a laddered portfolio is created to provide cash flows that mature at the right times to meet outflows. CDI can be tailored to different situations. For example, if a plan has far more retirees than active or terminated, vested participants, it is more cash flow negative and needs additional money. Other plans may not need as much.

“I think CDI works for other plans as well, especially for public funds or multiemployer plans, church plans, hospitals—any plan that doesn’t discount at the AA rate. Many of these plans are not as well-funded and tend to focus more on their expected return on assets,” he adds.

According to Whitehead, some plan sponsors may question whether CDI will cost them in returns. His answer: “It doesn’t have to, especially in the current yield environment because treasury rates are so flat they are all the way out to where a core aggregate portfolio will be built.” A core aggregate portfolio is primarily focused on investment grade corporate bonds, foreign and U.S. government securities, and mortgage-backed and asset-backed securities, with limited allocations to high-yield securities. Whitehead adds that DB plans do get more yield when they take credit risk, so Aegon’s strategy is take credit risk on the front end to have a higher yield than a core aggregate portfolio.

Cash segmentation strategy

Another strategy for managing cash-flow needs, advocated by NTAM, is to segment cash based on what plan sponsors need and when they need it.

The three segments, or portfolio buckets, plans need are Operational, Reserve and Strategic. Yi explains that Operational is the most critical bucket for immediate or very short-term liquidity needs (1 day to 30 days). Recommendations for investments are government securities vehicles with a sweep function and of the highest credit quality. A sweep account automatically transfers cash funds into a safe but higher interest-earning investment option at the close of each business day, for example, a money market fund. Sweep accounts try to minimize idle cash drag by capitalizing on the immediate availability of high-interest accounts.

The Reserve bucket is for intermediate spending needs (up to 90 days), according to Yi. Investment vehicles used for this bucket offer investors a better balance between risk and reward—e.g., separately managed accounts (SMAs), conservative ultra-short funds, and prime money market funds. Yi explains these vehicles offer direct investment with the ability to get daily liquidity. Not all are eligible for a sweep, there may be modest amounts of principal fluctuation, but DB plans get a better yield.

The Strategic bucket covers a DB plan’s longer-term spending needs (six months to 18 months). Yi says investment vehicles are still high-quality but designed to have a better balance of risk and reward. DB plan investors turn to ultra-short bond investment vehicles. “The Strategic bucket has a total return structure, offering a little less liquidity, more principal fluctuation and better yield,” he says.

According to Yi, ultra-short product use has been growing. “Low interest rates and how long they’ve been low has brought a lot of investors into ultra-short products,” he says. NTAM has created the Ready Assets Variable Income ETF, or RAVI, an ultra-short duration exchange-traded fund (ETF) with a variable net asset value (NAV), designed for investing liquidity. The parameters of RAVI are broader than registered money market funds and not quite as standardized as other ultra-short products. DB plan investors can transact during equity trading hours, and they know exactly what price they get in at and get out at, Yi says.

With cash segmentation, Yi says the goal is to find the right allocation between the buckets. It will create a portfolio optimizing cash but with a better balance of risk and reward across cash holdings.

Both cash segmentation and CDI are aided by actuary and investment committee communication. “When actuaries do their math, plan sponsors can know the liabilities that need to go out on certain date. This helps them have a level of precision in forecasting what they need,” Yi says.

According to Whitehead, in any plan of a decent size, the amount paid out month-to-month is pretty stable, but there will be new retirees and there will be retirees passing away. “Actuaries can predict these cash-flow changes, and that is important,” he says.

Whitehead adds that communication is also very important if there is going to be a big change, such as pension risk transfer activity. “DB plan sponsors should work closely with their actuaries to determine how much money will be paid out during a lump-sum distribution window or when buying an annuity,” he says.

«